{ "Event": { "published": true, "date": "2021-04-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-29", "timestamp": 1619740982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fae04721-772d-4e47-a0a8-9b1e4e37ad78", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078890a7-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658776, "uuid": "a8c9c0c7-c811-48f5-bb65-4b92afca1570", "comment": "Malware payload (QuakBot)", "value": "e9d3b02c642d02abe7c1ba3129f47e10", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658776, "uuid": "087dc673-13a9-4b44-8fb3-492e74b7a7ad", "comment": "Malware payload (QuakBot)", "value": "000e2ba63152bdbd13622e527565503e22f98b41069cefb9a152f3a5a09001d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658776, "uuid": "a98f7827-78aa-47f1-ab81-03fbd7a36585", "comment": "Malware payload (QuakBot)", "value": "c27bf2d70ea7563bf440aca7261ca15cbf34c986", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658776, "uuid": "c0d26750-a4f7-49e0-b691-0a2e27452234", "comment": "Malware payload (QuakBot)", "value": "e3b69a22129eb80b7343f699c8ff8d33e5920c1ae02173d139b403a2f37f5ea96d81db2f8dd98a7d5d03b1927831bf22", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658776, "uuid": "664ed399-5da6-4e32-beb4-37926f359244", "value": "AB549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658776, "uuid": "fe3d3a7d-d7dd-4e21-b0c2-12dc7b0b5a59", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658776, "uuid": "ce4f15ba-185a-40ec-8d2e-f62e37aef5b0", "value": "3072:H3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZGe:Xvv9sMoXBaRmr/dukbvuZ/7fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658776, "uuid": "31f664c0-3e00-4ec6-bb1b-8650d3f64288", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658776, "uuid": "f1b11253-8a00-4535-8a32-6469c1a5bb76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658776, "uuid": "a10d1f14-b7f7-4060-9550-16a9b5a0737c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37748ea5-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619734018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734018, "uuid": "141dab4d-1fd5-48b4-9ee3-1a1f6b3a4587", "comment": "Malware payload", "value": "2988b4cad91348f3753a1bc3bd0a4889", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734018, "uuid": "111c7290-2c28-48fd-b80e-b1bf7498e5ce", "comment": "Malware payload", "value": "0020420c8a2ee2b9436dc6a52f30b392b9f10724e518e559483dac5d4cd64aa1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734018, "uuid": "ab87f991-8f08-404b-85f5-48ad3278ac17", "comment": "Malware payload", "value": "8797c47d3d4d0f36e85394e4a8079d27fa9fe566", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734018, "uuid": "f667ab32-670b-43f9-aa3d-330553c217ca", "comment": "Malware payload", "value": "b6927176ca8048a3fe673707de673ce01f628d228b3ed36a10bd2f68422ed40cab5d4022dc62a089abd24fd2a604030a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734018, "uuid": "8c807e4c-f785-4d00-88d3-f1c4ab231839", "value": "4DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734018, "uuid": "bd7d1ec9-c52d-499f-9995-261aafcc975c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734018, "uuid": "2086fe84-793a-4b1e-a421-e3134fd5e4e4", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619734018, "uuid": "b91f8dcd-34cc-44cb-80ca-75e0936d56cf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619734018, "uuid": "e6235996-a2f3-43f2-ab05-753efeda6ad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734018, "uuid": "24544a86-4abc-4476-be76-02f284e76e96", "value": "2988b4ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc091b9-a87e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619654785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654785, "uuid": "237debc1-20b9-42c4-940a-d184ee0a05eb", "comment": "Malware payload (Dridex)", "value": "fb8707182b9fc604e5bcaf59cc7f55f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654785, "uuid": "a8160e0c-e315-49cc-b3d6-87d600d03423", "comment": "Malware payload (Dridex)", "value": "0022e1b5696c29b6f1db4f0c6beee26bdf47a167cc933270f87dec409f751706", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654785, "uuid": "7820679d-35c3-43a0-acb6-72d130783192", "comment": "Malware payload (Dridex)", "value": "c6e7b8b766f8705658282c765c4e0ad840cb6d2e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654785, "uuid": "291a37d1-5d8f-49eb-ad34-2543c35647ab", "comment": "Malware payload (Dridex)", "value": "1247848fac5a983e8c441928d8fe5d8d98e9f02568e72c677de840d25d7fb2b62af9a688b6388e2452a1cfdab3d23900", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654785, "uuid": "e9587de0-5cb2-4b60-a8c7-d05db81fe97d", "value": "AEF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654785, "uuid": "f8605d93-6880-479e-af7e-be83c0176bcf", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654785, "uuid": "3392e1b5-b419-4233-8733-3051ec450355", "value": "3072:278CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYOZwd:dnClX8WZ7/HrRCADTR0VlIZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619654785, "uuid": "1f9fa879-4696-44c8-ac90-5fcc71723abc", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619654785, "uuid": "579c7ff4-7f5e-4e68-81d0-2c17c133574a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654785, "uuid": "9bcecf3a-bd82-41f7-a789-ea3edde32587", "value": "fb870718_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f6d051-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701716, "uuid": "59112dcf-98da-4e59-a107-d0ffb409abcd", "comment": "Malware payload", "value": "bf1d9b61916bff50a7fd2d961bfa1cb4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701716, "uuid": "64e8f601-78d7-49ec-81d1-0361dbe5adf4", "comment": "Malware payload", "value": "0031983e3f733438a63d454a2a8217a1472e907182b0b18bc892975c15208f3d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701716, "uuid": "639669ff-eb64-4de6-9848-2e34d4c2910c", "comment": "Malware payload", "value": "695f846ac6b9cf721784d11a358948a31531cd34", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701716, "uuid": "1fdad136-b2f5-416e-be0c-0056cd2a1cba", "comment": "Malware payload", "value": "fc257ddc0777fe3793c3d4a1e48a55a8b26a59b64066d9ed384fa80d7c38569650ca5ba34f5e6295b9b769992ff99c27", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701716, "uuid": "e72961bb-0199-4542-bab8-d7deb42fe7e2", "value": "6133F188C688D33298F63531AC79CB01D578A96B4816D5A1C2F78EDBBD07E95170ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701716, "uuid": "02ee24cf-9ca6-4f36-94ee-d7328ac2c908", "value": "1536:RFugXVpoD8ZxhrLAuNS07MrxrKsYlwvmH:Rq41rLZNkZLYlGmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701716, "uuid": "46e645ea-be23-464f-887b-6bd9951379f2", "value": 51490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701716, "uuid": "26f7b228-eea6-44de-8fad-64559f4a9cda", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701716, "uuid": "1e928037-1f33-46be-ab04-3318f9440b32", "value": "catalog-62344280.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4efffa-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658780, "uuid": "fcfb0423-aede-48d6-8d50-67b8f20749c6", "comment": "Malware payload (Quakbot)", "value": "068f8b84b0bb1a51fe12695556e004bb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658780, "uuid": "59263ab6-a502-4f6c-84f5-265e1bd1d0ac", "comment": "Malware payload (Quakbot)", "value": "003e50a9747e1c5143f936942ff6f92af409bc6eabe73ea3973138d0a32a614c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658780, "uuid": "ff444884-7263-4d3a-90ea-1091cde11d31", "comment": "Malware payload (Quakbot)", "value": "2a1b3dbac9b423f74da28dcc7c227a8a5fcc75e4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658780, "uuid": "ce5e6e81-d49a-46d8-87ae-3f64b9d87295", "comment": "Malware payload (Quakbot)", "value": "7776a563d3bbf3ab33873f58cc6934aaba19233959efb1b5a2cd2dd7266a4fb58e53fd9a2b41428ccc7ab0fc95122c69", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658780, "uuid": "4a6bb029-4b85-4121-8d7d-b32b358b481b", "value": "9474BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658780, "uuid": "d9c586d8-0c31-4f2c-b481-6ad1c594eeb0", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658780, "uuid": "78c69d54-f256-468d-8165-20787bc7378d", "value": "6144:2nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRus:ZFrkNK11G9AEtMxQyOi6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658780, "uuid": "2a647a1f-df7b-49b6-8b3d-d7f5d4201e9d", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658780, "uuid": "6860ad13-06e0-4260-bc94-49c7b19c40cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658780, "uuid": "fbbc0c5c-ce41-4cca-97f9-f2a3abc89337", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d132cf1-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658785, "uuid": "7cd77481-1ade-4a5a-b880-dd06315f571c", "comment": "Malware payload (Quakbot)", "value": "d9ddd7eaa37c716f1f3882723c3f90eb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658785, "uuid": "78a4b5bb-f549-4a71-91fb-c078e6acd6f1", "comment": "Malware payload (Quakbot)", "value": "00437e91ca96d4ad530e3d9a5968402f9e43254e7e5d95c57dafc73419c62fa1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658785, "uuid": "67aa999b-297d-4c3d-8d9f-060ae3981b84", "comment": "Malware payload (Quakbot)", "value": "d910fa45b3b0b4c3b8ae6c14dfc4bc19923da65b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658785, "uuid": "afbdd907-b4b6-46fd-84a2-e74bbc49ce69", "comment": "Malware payload (Quakbot)", "value": "a6eac823e8e5e71f29f425094a2dbeaf96f6b3f81b896efc7bb5058a56ad93510dcb9f290f17a0ce3eee12f3726741ed", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658785, "uuid": "0967fba2-f1be-410c-b4a0-458dcc4c9d44", "value": "C274B07DBB17DC23E26C1BB062D35B581A53DAD63250210A1AB19E58ACE73E47C37EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658785, "uuid": "4fc1d035-92be-4396-9165-3345f18bbccf", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658785, "uuid": "7463646f-b515-422c-9e9a-8cf909168375", "value": "6144:STfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuR:Sbi7/xZrkNK11G9AQyOi6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658785, "uuid": "75dd69c7-0cd0-4874-9d33-527f3600b444", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658785, "uuid": "38e98148-ffe3-4c52-a160-9aaf93dfc541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658785, "uuid": "f0768e90-fe99-40b9-90d6-0a85a99707c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1517d247-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703466, "uuid": "103708d6-9fea-42d0-a0ab-0a38c92db59a", "comment": "Malware payload", "value": "8da49e05b1066401750231784f084dc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703466, "uuid": "3b6c7ee5-64b2-4b94-ad3e-4e65a5953ebd", "comment": "Malware payload", "value": "0055a9e30be40fb6d68f55e3e5e65065d080014cded4de920ab4c71cbb754512", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703466, "uuid": "9e318757-5273-4870-9acd-cd3bd0dac8c9", "comment": "Malware payload", "value": "6796febd2b8160a66a901cd79a9bfc940cf82391", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703466, "uuid": "a1bb232b-f2c7-4064-b638-cd6c39b15c80", "comment": "Malware payload", "value": "1d64038852cbff7bd25c8185170d6cb130adf3592c161b51963cc8e46ad2d200ea0c48219f5a01ac0c619b22a49cf8d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703466, "uuid": "5a221efd-77f5-49e8-9972-d2d00297ecf4", "value": "6D33023E48AE7719576D14B08945871EEA43688F3C2ECA821DCCF8A6EC05659137E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703466, "uuid": "63793137-bbae-42f9-8404-6eb29484a7ab", "value": "1536:PP6z4+ADViS8CWoD94pUnQ64x11RiCErW:XPZBiS8jopkUQ64xiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703466, "uuid": "555cf4aa-b13a-48c2-8558-27aba679884f", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703466, "uuid": "cfe18887-0ab2-4ef1-abb8-2f2bcb36926a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703466, "uuid": "be2ee3ad-327a-42ae-bfb2-9d43aec32b6f", "value": "diagram-19247753.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd46442-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658789, "uuid": "82944941-540a-404a-88ac-971d54bd54fb", "comment": "Malware payload (Quakbot)", "value": "1a674d28534c4aa33d4251b2ba4e97c1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658789, "uuid": "9c9c36e2-a872-4323-ba87-9a94e9ab4b2d", "comment": "Malware payload (Quakbot)", "value": "005d5b45443d080ce7799c96e8aaf58b72922287d5e712547857192f140a8bbf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658789, "uuid": "d7b01e58-c15b-4c62-99d2-52b63b2fbb76", "comment": "Malware payload (Quakbot)", "value": "6e7e802c0d110e1788ebd58ba2195b616dcd29b1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658789, "uuid": "d594b125-3c1d-4612-8e40-2cb22d9e0bdc", "comment": "Malware payload (Quakbot)", "value": "35f53d94310d87c3f86a662551662602ccd59fe5698b50948fb248a36e436ba9af04821d9d8f2834ec141e240790f5bf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658789, "uuid": "0e45d86f-d8e8-4311-835c-e2abbc9cf40f", "value": "2A74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658789, "uuid": "682d5118-c85c-4d9e-b451-69c617ff0eaa", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658789, "uuid": "e4ce9995-257f-403d-967c-c767c7162411", "value": "6144:XnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuS:AFrkNK11G9AEtMxQyOi6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658789, "uuid": "156eef48-2d55-440a-b735-2ab003036913", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658789, "uuid": "f18feb31-b9af-44f8-9719-435c3fffed96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658789, "uuid": "8b657a31-5281-4742-8414-14264a314b5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bb1f36-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658794, "uuid": "3cb366c3-f9f1-46a6-b0b3-90e495627af3", "comment": "Malware payload (QuakBot)", "value": "6c32d8bd095c3776f6cc6bb716788b3c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658794, "uuid": "58653b48-f8f2-47d1-a070-0fe62d6c9abd", "comment": "Malware payload (QuakBot)", "value": "005e247672a78828b9fa6d8dba3c614c49429a0b5af84fece73611adcc0af745", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658794, "uuid": "a5e58aa5-ddc8-4138-b969-ddbff91c8474", "comment": "Malware payload (QuakBot)", "value": "d92ea69ed71d2ae7958db22d80b18100c93a8a74", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658794, "uuid": "6d87c160-ef4e-4c0c-88f6-8780c61e8972", "comment": "Malware payload (QuakBot)", "value": "6bf7dfbe32473d6d95d31d3fc9a2058d89919912b40f13dd6016174a8e5da7d085b8526f4d3ae4b42fe00c5a20329aae", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658794, "uuid": "0688e1b2-38c9-4f80-9b92-55f4a468484f", "value": "EC74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658794, "uuid": "e6251f92-fed1-4812-b171-ad65062010d7", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658794, "uuid": "4b20aa45-a336-4610-bad7-18d669b550c1", "value": "6144:SnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuF:tFrkNK11G9AEtMxQyOi6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658794, "uuid": "b9456b8a-a78b-4dc3-afd1-00c48de007e0", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658794, "uuid": "30713796-a408-4013-ab59-b4e0edd8c254", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658794, "uuid": "53db23e0-d0c2-48d0-bff4-30d6d6c4da02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307893eb-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704371, "uuid": "02187f18-4b3c-4a24-9705-dee65457c72f", "comment": "Malware payload", "value": "58496d0acfd39d5c2ab30b6ea8f51e98", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704371, "uuid": "cdec8094-3229-44c1-b6d8-9666582d1ca0", "comment": "Malware payload", "value": "00687b413afa2511005212085318f22ebe3ae7713c1bde00db806150645f3626", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704371, "uuid": "91c91853-d57a-4f5c-aa2f-cb3ed99964e4", "comment": "Malware payload", "value": "5de9627a56e328deb6e795f36fe16ba548a74518", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704371, "uuid": "03897364-f767-4dcf-835e-725e15dc567f", "comment": "Malware payload", "value": "a242353ce9649ab0b70865e04ff85a42cb6efe0efffe41e3fb1a7243f30fafdbea738e3eb34ee26c8d21c5d3e6319c6f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704371, "uuid": "a3823e1b-b0a9-4ff3-9564-2416063ee9bd", "value": "4633021E5CAE3A39572E10E485469B5EE51718DE3C6DCAC21C8CF4AADC052A5027FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704371, "uuid": "2a2b22a1-f267-4bb7-8ba5-3def13c2af1a", "value": "768:N9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCPHq:IP6z4+ADViS8CWoD94pUnQ64x11RiCPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704371, "uuid": "14622ba8-875e-46c5-9b4c-1ab8324a6278", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704371, "uuid": "1f35542c-8c9e-48d9-862b-4f07a9488cd3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704371, "uuid": "db8e61c3-bccf-41f2-ae74-c9f586b70319", "value": "diagram-711233707.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0730d4-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700874, "uuid": "e9f6284a-4739-4a56-973f-303f2255f7f2", "comment": "Malware payload", "value": "72809eabcf6db0ac4a81b0591f32e0b5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700874, "uuid": "9bd64ffa-5a60-432d-9391-e496c6e18e84", "comment": "Malware payload", "value": "0082d1d69fd041eb0cf01100691de6bc2698ecf5587fd27e9697a844a99bc1f3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700874, "uuid": "5abd919f-1e21-4206-9806-cdb14152f966", "comment": "Malware payload", "value": "62d2c81bff6c37ee21b5fc47d8d5199d8abae769", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700874, "uuid": "6b29605c-6f7f-4926-ae09-a6a2ae2ff4b9", "comment": "Malware payload", "value": "0e4dc025bbfa55c58cb4eadde11f803ddc34691fdc8caf87741216d9a90d0fa0d0d901cdc1dabe8de7670b454ff4ab7c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700874, "uuid": "6c16b9d5-f860-4ec8-b548-d64880e33fb3", "value": "273302C4C58CD37698F6B8319C78CB02C5B4A96B4426D95580F30AEBB807DD5274ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700874, "uuid": "2d15711e-49d7-4cb3-97a6-ab5eab8d2859", "value": "768:AwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2J:dFugXVpoD8ZxhrLAuNS07MrxrKsYy6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700874, "uuid": "37fb9d87-71eb-442d-baeb-8be2e6813366", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700874, "uuid": "cf0b8201-d953-4392-bffd-3b5fb0e4f170", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700874, "uuid": "7fb2e039-33d6-4bfa-8d53-53a5b41929b4", "value": "catalog-1903983383.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169d3911-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658801, "uuid": "2419bd0e-91c7-4990-9b86-3b3ca19fc133", "comment": "Malware payload (QuakBot)", "value": "db5dee281ea109803ad858a6065cec2f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658801, "uuid": "0d462686-e2e6-4ce7-b874-92040e8d9fd3", "comment": "Malware payload (QuakBot)", "value": "0095703b47e92e3d55a6b836f8b8fbd97826c276abdfb3b2c83e079a0daa477d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658801, "uuid": "cee660cc-cfc2-48f8-a8be-6ba2cb98071e", "comment": "Malware payload (QuakBot)", "value": "7157d77f83069fd955309a063653963e8b501b7e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658801, "uuid": "0699ef7e-e37f-4358-8897-5a8fca5168c9", "comment": "Malware payload (QuakBot)", "value": "4afca5412137f8547a3e41cdcd464e675db836768b0abea139280392d29af0d1a0083c2ead19d56570aff084a971e895", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658801, "uuid": "0d77149c-0696-4914-8233-c66746f96e8c", "value": "56549E7AFA12DC02E7A82BF023C36F581A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658801, "uuid": "7621240d-e8e2-49a7-9aec-f05d9135a7b2", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658801, "uuid": "9efce1f3-554d-4825-88c2-ce5a52de8f10", "value": "3072:93FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ7L:Nvv9sMoXBaRmr/dukbvuZ/7fV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658801, "uuid": "ac1c5e48-082f-4f27-a311-db391ee8b618", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658801, "uuid": "bd6971ef-a7ea-4e31-80f1-9906c606b320", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658801, "uuid": "833e0d19-e8b6-4b83-8c16-8078fbe917f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1982c8c9-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658806, "uuid": "c68360c7-bdac-4cfa-952c-3957ad842e7b", "comment": "Malware payload (QuakBot)", "value": "94eeac3ece5f6ea658643cb9a7fc92af", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658806, "uuid": "8974e67b-ae4a-469b-96c5-735a63e9a4a2", "comment": "Malware payload (QuakBot)", "value": "0098d4c0340b538562c32c3057d001cdc5922a738a0e1166bb9aa03cf0f8da8c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658806, "uuid": "3ae9273b-2a24-4948-8512-bc3a729e7625", "comment": "Malware payload (QuakBot)", "value": "6aa9720c76bfd351861b32ae39562d14930fb769", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658806, "uuid": "3a094dd6-5870-412a-ba38-28105a80832f", "comment": "Malware payload (QuakBot)", "value": "dd8e74563192fc6509f4dae5d35bd625e76f18a54d333fc6e50c2f6b9ca806cedddce09b07970345079a0362c2a0bc3d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658806, "uuid": "73715dde-a776-4508-96bc-5895dcd4f1e4", "value": "9D549E7AFA12DC02E7A82BF023C36F581A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658806, "uuid": "8c7fb0ef-7133-40df-adfe-b70dcb37dc80", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658806, "uuid": "98069dc6-0007-4a52-b49e-cee38f14d950", "value": "3072:E3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZVm:ovv9sMoXBaRmr/dukbvuZ/7f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658806, "uuid": "868e78fb-9b07-455b-b191-db446ba06141", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658806, "uuid": "fc231166-9fa9-4a64-b8a1-89ec7409318b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658806, "uuid": "132bbfaf-feff-47f3-9ca0-2eb3f09a45da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c61dccd-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658811, "uuid": "1d4f088e-c00e-45ff-bce8-00d392a7e792", "comment": "Malware payload (QuakBot)", "value": "b39bb018a70a1bfb3588b25b896da7d0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658811, "uuid": "80ff464a-38a8-4745-a64e-bafb8cf0bf09", "comment": "Malware payload (QuakBot)", "value": "00a2292aeb04ae0eb01f47839ff67bfeb45c5a7191323e4e369aaf24099eb74a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658811, "uuid": "4288ebf6-6ccb-46d7-aa3f-680fd03a22c2", "comment": "Malware payload (QuakBot)", "value": "a1a91f6183c44fc4c5d78d049c9bda11bc415163", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658811, "uuid": "16e391b9-99d3-4737-8fe2-0a6ba25dfd8e", "comment": "Malware payload (QuakBot)", "value": "713d59c494788067dff7d4ae13962cef6d00d17e9c3cc8b94846d8d56e5596fb067deef121298df6b3aeb74b6f175699", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658811, "uuid": "45977e20-19e3-42c6-bde6-e1403f4a43c7", "value": "1B549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658811, "uuid": "d3fccc32-e648-4717-a975-ad5f6c946004", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658811, "uuid": "99878096-8341-41ac-8c3e-146aa85f00c0", "value": "3072:i3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZlN:evv9sMoXBaRmr/dukbvuZ/7fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658811, "uuid": "e18ecddc-e67b-4d3b-b610-591d01b80530", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658811, "uuid": "0b135152-2107-4e1b-bfec-98b692add6ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658811, "uuid": "8db6b47a-ba89-476c-9b7d-54fa356ea037", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a17cee-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619734045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734045, "uuid": "dd6fffc3-954d-4a6a-b4cf-47aff583f618", "comment": "Malware payload", "value": "fd66253cde4bb6e484c44192a9ca24d5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734045, "uuid": "93ac5fb4-9867-4cb3-97a1-db62e7f86e4a", "comment": "Malware payload", "value": "00a6e69eef642ec628710d5268cc8520f8443adc9799a59bfc35c4be6fe84efc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734045, "uuid": "52dd4343-fc9d-44f5-8f52-44a80d45ca34", "comment": "Malware payload", "value": "9ae2d14b2eed498e1f65e46515479597b0c3fe35", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734045, "uuid": "795eafa6-c981-411b-a840-b7d89fdd65f5", "comment": "Malware payload", "value": "b3e39bd011cff4a028c1e1c30d68548612be9f929e27259144b690c039abcca69f30626da3ee721f3be3e6a98f1f2d99", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734045, "uuid": "a708bd3a-f6e5-4698-a8d7-ef5d30c194be", "value": "9DF3CF82D702C1ADFE212C7A28E677753D9833905E54CA68E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734045, "uuid": "a12cd3c8-16ab-4437-9b34-c4a813a9ab77", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734045, "uuid": "c663cebb-36cb-4e37-8d69-381328911f5b", "value": "3072:pO5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh8gH6:s52j4pk5zMbVO6/HUIXU8KgMyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619734045, "uuid": "dfb99f4e-94cf-42e9-ab6d-17bc094cb148", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619734045, "uuid": "f4a5d87c-0c78-437a-b9f4-362b1ddd06e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734045, "uuid": "92016e99-2d15-4cfd-9390-ad1953aa5942", "value": "fd66253c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16de2e35-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705187, "uuid": "5211c92b-109b-4207-acc7-07e31483a540", "comment": "Malware payload", "value": "0caefb45c1ea96ea89a7e7367be53b5c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705187, "uuid": "c0a0728e-d7be-4755-90d9-68ceb682d557", "comment": "Malware payload", "value": "00b8fb046b81d5ba3a6ad8d4cc942d49dd4df2d0fba8f8837f20c3624b859925", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705187, "uuid": "039fa798-4ff6-4b8a-8208-b80d8b12360b", "comment": "Malware payload", "value": "196b8a59ef16d649f2e6802bd6378ed137742149", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705187, "uuid": "f6933e46-8d17-4c81-89b3-f0791c17c37f", "comment": "Malware payload", "value": "2f8cb6c8a7a87eedcc324004d7ca08ab50514485430af6bda9be9e9f18ddb7fa91dcb7a2f4eabc096823aecd7cb98b7e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705187, "uuid": "217d55e6-b8f9-4c9f-a1fc-f535176c385c", "value": "4833022999AD762D473E00F04985CB8EE21318ED386DC1525CDCF4B5DC067A9063E77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705187, "uuid": "d37b1931-8e02-47d3-bff5-6a19cb55ca3f", "value": "1536:WP6z4+ADViS8CWoD94pUnQ64x11RiCfgdW:YPZBiS8jopkUQ64xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705187, "uuid": "326b3fdc-8d4a-468d-a2be-caecb53572be", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705187, "uuid": "e6e0c85c-e6e9-4aed-bb1e-6699ff070111", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705187, "uuid": "ce3298ec-ba5e-483b-8472-82a1c13adffb", "value": "statistic-126141395.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d402c2f6-a936-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619733851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733851, "uuid": "a5cb1113-5df8-4553-817a-bb19e071e68d", "comment": "Malware payload", "value": "9a46871646a2be9b0d50e41c314a17e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733851, "uuid": "32ddf304-98d7-4380-b468-1f085d73f916", "comment": "Malware payload", "value": "0103f7106078e4eb9f138d7aaa9c585a86524c1b0c1024ce93c4f0407556c017", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733851, "uuid": "d0cd64e3-0f65-4baa-854b-733f0731a629", "comment": "Malware payload", "value": "0e6f700aa5ab06dda18b7ea51eee89b3d330ff46", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733851, "uuid": "6512ce52-29b9-4264-8bb0-6b7f78fe4ca0", "comment": "Malware payload", "value": "0a2a92db0570daad93ae62d744a5dbadfdc7055bdf852417403118db99a07ac14dc35bb0c504e46ddb869154a5129c2e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733851, "uuid": "fe4ce62c-a7ff-403b-92c9-d84bc1428a86", "value": "FFF3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733851, "uuid": "0bc8d576-95b6-46db-9eaf-bc2a46d5ad46", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733851, "uuid": "1b5b962f-3c24-4a64-be29-74198c2607a9", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619733851, "uuid": "d68ebf9b-8de2-4b50-8bda-a880d268687a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619733851, "uuid": "2960c963-ad9b-400e-929f-74a5229c9c77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733851, "uuid": "5c5dc538-1246-438f-b982-490566015bf9", "value": "9a468716_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f41e21a-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658815, "uuid": "01cfaa07-f339-471b-adb2-43cef3df3555", "comment": "Malware payload (QuakBot)", "value": "962fda805ae718d7bd4e5b48f892887f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658815, "uuid": "9b32bc64-df46-4bd1-8856-c4f74044ea31", "comment": "Malware payload (QuakBot)", "value": "01055945b4aee1506fdf54387156f1fedde7d10a2a375c880a63d4e0e2514051", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658815, "uuid": "1ba5c1af-3d22-41b1-b45c-929c3e8e852a", "comment": "Malware payload (QuakBot)", "value": "7d41005407db33437c4d5d067de57d9fc400bad6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658815, "uuid": "ed26547e-d98e-4334-9959-2fc069ad4222", "comment": "Malware payload (QuakBot)", "value": "32f5dd62557328e09681acfd970966b33700d92d6b218ec8ff09f2ba77da1edce2c9de3c89ce9d61b5384509ac885d8a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658815, "uuid": "291f5192-f38b-454a-9c43-9eb63e3b5403", "value": "B8549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658815, "uuid": "a5201272-f080-4f86-801e-94bc1c1d5da1", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658815, "uuid": "b91e7e03-2872-4d7c-ad23-e4b5e75e4641", "value": "3072:h3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZdR:Rvv9sMoXBaRmr/dukbvuZ/7fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658815, "uuid": "4bdf80b7-b346-42b9-aef7-f06d2fce31dd", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658815, "uuid": "5acf6987-3fe9-41fd-abfa-962464ba07ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658815, "uuid": "76b7acc9-f618-4362-a334-72f5f424b786", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c226244b-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706333, "uuid": "aacf62ae-5512-46d9-adc9-6d51cba56df2", "comment": "Malware payload", "value": "8b9874b7c4ba6ca449eded6a716c882d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706333, "uuid": "e94b1688-c4ce-4d11-a58e-dac1c8463396", "comment": "Malware payload", "value": "01090f5f1573402548dbabb35282b70167fac63c7e11fbf2b31d5bfa9df37f68", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706333, "uuid": "8121a8b1-f20c-4816-8725-7021135f3693", "comment": "Malware payload", "value": "de6314ca0e113fed8b2791c881e2e8a897f395e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706333, "uuid": "4d7bae43-d770-411f-8ceb-bc319a0311f2", "comment": "Malware payload", "value": "32d1aec9889366995d5d03a362c3010c9750a161e89f1f30ba880fec2364150f764340c1b07fe4bdce9e49e68a1259bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706333, "uuid": "b3d53112-2594-4ff3-b3fe-8789bcadfc35", "value": "9A3301298C6E752E577E10F481898B0ED507689E3C2EC5825CDCF4B6BC456A8127EBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706333, "uuid": "a6879a6d-6ef6-45ac-97a8-2af2f56bf529", "value": "768:m9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCWBV:3P6z4+ADViS8CWoD94pUnQ64x11RiC+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706333, "uuid": "326eeabf-e928-4e0f-9e00-0daafea440e9", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706333, "uuid": "8420e8b8-6e42-4057-ba5d-14fc26d6e380", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706333, "uuid": "453df871-a09c-4d45-971e-2a9df42cb3fc", "value": "statistic-289619621.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122f3b41-a87f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619654928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654928, "uuid": "69a4b32d-217f-4dc9-b1c9-9fd817bf6633", "comment": "Malware payload (Dridex)", "value": "22019d3d538bbf0f8b896301a7cc1c0d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654928, "uuid": "df07a694-9086-4e9f-9e74-dd68abb61a90", "comment": "Malware payload (Dridex)", "value": "01286e16bb4180e1c657a2e378c8235648b94f11629031ca05312517b89d2eb4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654928, "uuid": "a33daffc-a388-404c-bb2f-84253aa18a39", "comment": "Malware payload (Dridex)", "value": "2d1931900f2875115f8071caa1727d86a5cedaf4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654928, "uuid": "56383e60-91bb-4835-87a8-5cd3621c6689", "comment": "Malware payload (Dridex)", "value": "9cfd432f63ff120364851a1482234184b16c95f1e90441b11f17105d3acf39dfce9a780ea19a22d911ef43be214aca26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654928, "uuid": "fe70e3f1-f4a1-4c9f-9a0a-08eb0f179f7e", "value": "D6F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654928, "uuid": "0b391011-37c8-4f55-9671-a91bf8a2c32d", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654928, "uuid": "4b5eb2c6-dd94-4f20-ae27-ac003295d72d", "value": "3072:C78CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYOZwd:xnClX8WZ7/HrRCADTR0VlIZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619654928, "uuid": "e01a11f4-af58-48a7-ac59-94e349a3b2df", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619654928, "uuid": "8cd792ac-d41c-4e2a-9a55-9eb5f3aa59d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654928, "uuid": "16ea7d2c-751c-4d8d-83a0-6143d402ac96", "value": "22019d3d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852bcbbe-a87e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619654691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654691, "uuid": "4ed1aa64-0558-4aa0-9641-65e60e2baef1", "comment": "Malware payload (Dridex)", "value": "84bc92264057ed3fddbefa31e16b3fee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654691, "uuid": "9e5aec69-baef-4ea2-9df2-22275f288143", "comment": "Malware payload (Dridex)", "value": "013684816cc7a26c30cb3840d3a774a5a311dd6df6100b1cb044cd31d60eeac3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654691, "uuid": "d5c17682-94d8-4b94-b45c-292bc57ab0d4", "comment": "Malware payload (Dridex)", "value": "c3b50df90d2dd71a819c1acfca1cf0fa779eb9c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654691, "uuid": "e4e043e9-924f-4e40-84d4-270a6db8e50f", "comment": "Malware payload (Dridex)", "value": "7920ed763fdfea7910d1829dda0584398b522cb5925081d308bb61a1869cc3b902e34a9bba9a88893c7b5ea82ab1ba42", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654691, "uuid": "a4e9cc3a-51c0-4426-9e65-915b50261f55", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654691, "uuid": "c5663f0b-d224-4036-bbd4-56abc7f91a58", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654691, "uuid": "a2d9fb06-080d-4bdb-8fba-fb63755c96c9", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619654691, "uuid": "5cd084a9-5b3c-4848-99bf-917b3ed8a1c5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619654691, "uuid": "d2337bb6-3563-45b3-b120-23254ff4522e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654691, "uuid": "b7a79979-e670-46c0-ae7b-5aade27995b1", "value": "84bc9226_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2f4f68-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702570, "uuid": "a3168718-4a75-4fbf-9d4a-4a1250e1ce9e", "comment": "Malware payload", "value": "d13287dd2f03b1c1d3b1274ff797056d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702570, "uuid": "9126afc5-6eb2-4169-837f-7a0121e3d478", "comment": "Malware payload", "value": "013f735b1ae2b317053f4ac5a2ad2a7055b4e19a6db5f9f629a8dfa55d093b07", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702570, "uuid": "2ce407cf-a911-41da-b46f-d0ea48e61315", "comment": "Malware payload", "value": "8c17a7d71c438c297c242b897a416326aed63086", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702570, "uuid": "98623acc-d901-4a5e-a003-b561be53a29c", "comment": "Malware payload", "value": "7773dcf359e0cecf9492b8d07a91d3736374dd1ad696e5b36ec86b2a89e9bc53e068da58ce06929b596e64df9bd1f17d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702570, "uuid": "b444a2e6-68a8-4e69-bca3-d25165b312ea", "value": "89331229886E761E572C14F08985D74EDA1328DD386DCAC31C9CF06AEC05AE9127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702570, "uuid": "3662bb03-2512-46a8-a61c-c1495746158d", "value": "768:29cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCvke:HP6z4+ADViS8CWoD94pUnQ64x11RiCv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702570, "uuid": "0494fa72-5ca2-45ff-bd98-180a4e991a97", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702570, "uuid": "437e9769-04cd-49a3-bd49-15c7b4f2a928", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702570, "uuid": "2cd360df-8d40-4a62-b45b-a3c0e078cc90", "value": "diagram-1300493530.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb465de-a87e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619654865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654865, "uuid": "20a1c3ce-65f5-4dc6-94b9-ffe1b8ea1254", "comment": "Malware payload (Dridex)", "value": "cda4edd7db2b22b4f1abdc3a06bc6d26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654865, "uuid": "522bf2cd-61dd-4d07-8f63-5ef9955b1297", "comment": "Malware payload (Dridex)", "value": "01425f72370871f7dcb5abb89a1393b1c5b1a2aa3c1f447d4e0d261e4a199170", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654865, "uuid": "e9840ae2-9b0b-46b9-a971-7396afb69de7", "comment": "Malware payload (Dridex)", "value": "7952bf38c3082e41c31ecdd684fe9c35264f248c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654865, "uuid": "3b080bec-2fcd-47e3-a62d-7180e34c765f", "comment": "Malware payload (Dridex)", "value": "bb159f9ff03b16e319c321a8234c3925d23c3f9f24de313080dcc6b23a86876da1f65ffd9fcf846de4b992ade6284a9f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654865, "uuid": "abfc6555-202e-4170-b5d8-801566585284", "value": "A2F3BFC6E7EFE0D6C02BB43385CDB036EF6069D88A3ACF35C104892E69D7D549A35469", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654865, "uuid": "cde743f6-265a-4cfd-b843-f934fb1199df", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654865, "uuid": "7b524532-5e9a-4968-8662-da86e0391a6a", "value": "3072:K58CMtKJlXoDRl4epTGmoAc7iTRilfn6wlYYbZwd:PnClXSRCADTR0VlJZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619654865, "uuid": "c50e1090-c39a-4080-87ae-0f262384aca5", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619654865, "uuid": "936a4916-8451-4d63-9731-9b864cecac8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654865, "uuid": "a98da8ba-b2d7-454d-b175-86884a4600fb", "value": "cda4edd7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d5b347-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701774, "uuid": "1edc400d-c482-4822-90dc-70274e462418", "comment": "Malware payload", "value": "4a8b36572343333984ce2e1cdc608013", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701774, "uuid": "b6733249-d7cf-490f-88b3-c92cc91650b9", "comment": "Malware payload", "value": "014fdb1ecfa3ecdc1fdc1b5726325ff60ea98bdc513ef9a1eadd7208feffb44d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701774, "uuid": "730208c5-384b-487e-9f56-fd47688064b1", "comment": "Malware payload", "value": "713f423a12ff9d548d4f5ca27a7248328d2e4f93", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701774, "uuid": "e06de268-99ef-4f81-a42a-2c1dab5a918f", "comment": "Malware payload", "value": "b93c6ca5f684408eb58bd41439f86c9177c255c5b27851000f1beeeaeb23899702fc41453a12979dcca778f6e4ed03e6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701774, "uuid": "f37c80f3-a0a5-4315-bc12-0ed47dea33af", "value": "F3330188D9C9E332E8F575306C398B01E5B8B9AB081785A1C1F387A7AD07D915B0ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701774, "uuid": "e18f48c7-3357-47fb-aa8b-921d199bf45b", "value": "768:2wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2Q:LFugXVpoD8ZxhrLAuNS07MrxrKsY0Ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701774, "uuid": "2931d8ab-b983-4946-96e9-df6c9a5f8c12", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701774, "uuid": "3fee4718-3c4b-4423-84be-f6a8cd57226d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701774, "uuid": "8d42d146-be81-43b9-befc-6d2059b15a48", "value": "catalog-659861341.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22028c5d-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658820, "uuid": "5ef0c856-cf58-4fe9-9e5a-a549dfc774d1", "comment": "Malware payload (QuakBot)", "value": "32507444a918ed022ab019d6a8eb4d19", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658820, "uuid": "11bc1a7c-5181-45fc-a90f-d997ab5342de", "comment": "Malware payload (QuakBot)", "value": "0153a82bc0d89eaf24cc49769ea42fe24c0f9d1106a6987021d1e3a8c665873d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658820, "uuid": "88457f71-3c0d-4055-8a1c-0b44249b8096", "comment": "Malware payload (QuakBot)", "value": "7bd704477401936dc5a4b7aab968ce49fe9f69b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658820, "uuid": "383aff8a-fb4f-4fbd-824a-34c123a8d93b", "comment": "Malware payload (QuakBot)", "value": "43d6a44d16c9d8dce36e55bb63b2ace597d74470bdc369097dbbaf138f6b569e8d1f142526a7c442720d271e432fb0c5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658820, "uuid": "1f8c3843-9072-48af-adb5-ad84a93667c8", "value": "B874BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658820, "uuid": "42d8a886-814e-4571-8895-f6465c0a445c", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658820, "uuid": "cdbde46a-0108-474d-a8cc-6dcf50edb589", "value": "6144:7Tfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuM:7bi7/xZrkNK11G9AQyOi67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658820, "uuid": "2683da7d-3cac-4056-b27f-9a33d8b5ed07", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658820, "uuid": "d0f54e33-2740-408f-93b1-10764e086cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658820, "uuid": "9ee741c7-8b9d-4e01-9b20-3e6a294e2564", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c48d21-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702157, "uuid": "4b9807e0-5de2-4a14-91e3-39d078756163", "comment": "Malware payload", "value": "000a253ed72ed8133625cf99e3f7a521", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702157, "uuid": "8b1fb51b-261e-484c-814b-2e821dc63c54", "comment": "Malware payload", "value": "016c7a63f2e2bd7ff8308dde32e3be939eddc484337331b1131e621e1048b426", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702157, "uuid": "db270f55-ef2d-4b01-a518-56c9e673a877", "comment": "Malware payload", "value": "f662086220fd41115185b50f3121292876c6833b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702157, "uuid": "f8ed6f68-3db0-4de2-a7cd-728b16019864", "comment": "Malware payload", "value": "510ec44d96e966adb29f90aa20702623247b14b29d33e835f61240ba5bd325f99f28d3dc57127548f209b470d43d8bb8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702157, "uuid": "0042764a-3076-47fc-95da-247bd5b99622", "value": "18330148D6C8D372D8F639319C7AC702D9B85A6B0406C99182F387A77D07AD5274EDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702157, "uuid": "c3618cab-71b0-4497-913e-36c17a9ac7ab", "value": "1536:kFugXVpoD8ZxhrLAuNS07MrxrKsYw37B2:uq41rLZNkZLYWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702157, "uuid": "80722c56-6c63-44f4-8ffb-ad34a03d365a", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702157, "uuid": "c21628ef-394e-4c67-9397-539a776796ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702157, "uuid": "f95774af-ac17-4ca3-b212-694d16e6e6a3", "value": "catalog-956244145.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cf80f5-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706500, "uuid": "aa48f552-a9da-4d1d-aa63-679df94b8558", "comment": "Malware payload", "value": "b040aac43d79cc20e817c2675811f16a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706500, "uuid": "d3219dad-a013-44ad-b9d6-cb22f24cf869", "comment": "Malware payload", "value": "01746891805c11fdd9931d2941c7d5f7b55eb54b4371f028f95957dae8c670fb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706500, "uuid": "6ecd3be0-346c-4739-9fb4-1b770816fc30", "comment": "Malware payload", "value": "9a43bb2b3ad0fa59082ec99e22e35de8bfe4ef7d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706500, "uuid": "d9d462c7-2564-4a0f-8ef8-0ffafd941916", "comment": "Malware payload", "value": "17ac99ab88b9a7eeb05c7030cc4e96a35963a0d35205d97f8a54a2892352941a0da5bd3db11cd171ae110934f76532d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706500, "uuid": "957c754c-0b70-4bac-8628-311e17f56455", "value": "D833022A986EB536577D10F885858B0CE50758AD38ADCA812C9CF475FC093E8117FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706500, "uuid": "069dfcfd-678e-434b-9994-5475cf615c5b", "value": "768:U9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpNQ:NP6z4+ADViS8CWoD94pUnQ64x11RiCHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706500, "uuid": "4b8cce4a-fb1f-4999-80f8-2f448d920d26", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706500, "uuid": "0750c673-d7bc-4403-88af-b88d4df41c39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706500, "uuid": "ef974a64-cf1b-4d31-8dd2-3092b3adf88e", "value": "statistic-390006249.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f459ec8-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705335, "uuid": "b9152105-282d-43df-b51c-12cf98f2565f", "comment": "Malware payload", "value": "46a8a4c00a875fdd48cfbb10ef144c5a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705335, "uuid": "72641973-bba1-4f17-a731-340fab0e03a3", "comment": "Malware payload", "value": "017e09dabbefe891c24e99478ad60d2b44fa0b8620dc0a1e87e29b0a35a9fcd9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705335, "uuid": "75fae25f-8d2a-4e2b-8095-31d17134b528", "comment": "Malware payload", "value": "f017098f2f6b80fab7f718e249ab27e2db09a4c1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705335, "uuid": "98ea2ad4-7efb-4e26-a3fd-37b391699666", "comment": "Malware payload", "value": "b20edd10f8d41fd4183798ca9d36f3bd01ea6d6d537e25cb937b625d2eab26d86676a559778e01dc998cca1836e2c92a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705335, "uuid": "617ad2e8-5d96-4ee6-84e9-c7249447dedf", "value": "2233022A58AEB539173D10B0448A9B5FD547689E782EC6410C9CF4B6EC0A3D9153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705335, "uuid": "87e70f43-be7a-4ef9-b13a-a2df5f9cd129", "value": "1536:LP6z4+ADViS8CWoD94pUnQ64x11RiCK61Y:bPZBiS8jopkUQ64xQ6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705335, "uuid": "f4c30324-f1c0-4a0b-8d2e-7ea9e49a4288", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705335, "uuid": "28d43206-ef09-40f8-b4b2-c952a0696814", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705335, "uuid": "0df468e0-b25e-4631-aaeb-34dd9dce7868", "value": "statistic-1393884226.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d20e6d-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705043, "uuid": "06a5c862-32ad-4b19-93fb-d8761eb6beb5", "comment": "Malware payload", "value": "92a44137842207f6e92fe70ae101fcde", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705043, "uuid": "518d4945-189b-4688-860a-0f1229eebd5d", "comment": "Malware payload", "value": "017eb49ea1c05985dda8502e1b2ce28a48904b158dbae0bc7f7c4cebc169e900", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705043, "uuid": "1b26537f-14a5-4384-a220-2e923d52b64d", "comment": "Malware payload", "value": "1f3475652c2cd27c7a9744c32c373fbcaa38ed50", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705043, "uuid": "94829f50-21ea-4296-bd7f-efacf4d72079", "comment": "Malware payload", "value": "12b477c1b7dd5619b46a2d9b07fde08ea28c5c38ac9fd7c44d16fabb915bd0d270ecfc239dd2a5e5ebea725b4a9aef47", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705043, "uuid": "6d1ab0a5-f4cb-4344-a8db-b5d9d400a6ab", "value": "C833022E986EB629473D10B484498B0EE667189D386EC2821CDCF5B2DC017EC153F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705043, "uuid": "7d87f37e-16e2-465f-b6df-aebde86dfb29", "value": "1536:yP6z4+ADViS8CWoD94pUnQ64x11RiCFXPv+:MPZBiS8jopkUQ64xPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705043, "uuid": "3ce8c39d-2db7-4b03-8793-2a27717e87e0", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705043, "uuid": "ee9a0682-3c64-43b8-909d-f85a8c5eb724", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705043, "uuid": "2d69023c-c93f-4cdb-9955-3a73e5f60fbb", "value": "statistic-1152473297.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c683bf-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658825, "uuid": "1a4d74da-ab4c-4777-ba51-e09d4732dcc6", "comment": "Malware payload (QuakBot)", "value": "37db625f46cb6198f0e6de499dcb4e48", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658825, "uuid": "13dc6d25-a522-4108-b68a-99bb6db0f2a4", "comment": "Malware payload (QuakBot)", "value": "01852f8512801aed4a3c125f5547ed5bcdaedcd4cf51ea503ba1b1b8fd9dae06", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658825, "uuid": "4c4a7e62-3910-45c0-ab33-3ec9e508d5c0", "comment": "Malware payload (QuakBot)", "value": "dc97759102cf4c884b2c092cac533ec8d764879a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658825, "uuid": "9fbca121-d1b7-49c5-ba78-80d048dd5641", "comment": "Malware payload (QuakBot)", "value": "2d8b3bf108e9e63299cbdbe13362a80038ec5e679217b3ba433769d476f74d51826f84b23858ea0027d4d28d8d018e8d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658825, "uuid": "0ad72d0e-e596-4001-b733-c5d1956dbe2c", "value": "0F74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658825, "uuid": "a45bf146-8cef-4df7-a5a6-57c2f85c443f", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658825, "uuid": "7fb36097-1bc9-4563-a2f5-2540237f251d", "value": "6144:CnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRui:dFrkNK11G9AEtMxQyOi6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658825, "uuid": "1575fc82-543f-4355-8312-e0ad2a86db4b", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658825, "uuid": "08b3719d-96bb-4a99-ae6f-47f5dfedb9ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658825, "uuid": "d69419b8-674c-4101-898f-2bf02d341449", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08d08b4-a8df-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619696506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696506, "uuid": "932de6c4-6f92-45ef-9dea-4e88a757df56", "comment": "Malware payload (Dridex)", "value": "41a6bed5b0a14e690af3275aa3236bc3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696506, "uuid": "275e7db6-fd25-4cbd-b97d-111ece958416", "comment": "Malware payload (Dridex)", "value": "018dc2bc238b7895c1a8c0542498421be63fb22f840ddfc7db1bff5f0e5b7cb6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696506, "uuid": "9ff309ba-a5c4-4714-8f41-e39272d38b5a", "comment": "Malware payload (Dridex)", "value": "dd54064113c456b05b478d9399676fcc6f696eff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696506, "uuid": "ee81f6a7-2fa4-46ef-a346-bfeb90abe08b", "comment": "Malware payload (Dridex)", "value": "7df61b95b5d53c7b705b411574f583ea1293f4c770e009c52830eec7a9979d6af457bb6b6474597b16b23f8df9bcc73b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696506, "uuid": "66ca406f-b01e-4a5c-84ae-304a7a6b3375", "value": "11F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696506, "uuid": "9741c783-5d7a-46b0-8cb6-adc5bc08694e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696506, "uuid": "f167fc04-13c7-4f91-b6ea-ea5d11cb78ac", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619696506, "uuid": "643d5596-e4ad-41fd-a2bb-0d8c803c1f51", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619696506, "uuid": "2b2077a5-cbdc-44a6-992b-acc689e0a543", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696506, "uuid": "a0f707e3-2608-4e99-b09b-c7f766d1e1cb", "value": "41a6bed5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4feba8d-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702446, "uuid": "c4a54819-d9f4-439e-be8b-e82bb1ec234e", "comment": "Malware payload", "value": "c1be3a3b8900c02f2c689ed2a9e403cb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702446, "uuid": "6cb8daea-3339-4b4b-995f-aac6f220c848", "comment": "Malware payload", "value": "018f409cf4da6c7b9cb41d39397867018d3ee7981d585a697b757b925808851d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702446, "uuid": "80e4cc5e-eb8e-4270-9235-9e1586fd740a", "comment": "Malware payload", "value": "f5c17cf8d2a5c2e66711221cb5a581daaf42a74a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702446, "uuid": "3062dcbe-5648-4916-a1ba-5d722b978a9b", "comment": "Malware payload", "value": "dd2958a185d95fff79fc915730b86395106fb8fbf4d2fff99568ecd521ad506537fbfaac81ebc60a93b8d478e8807565", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702446, "uuid": "304917ac-2575-4f40-9085-03fd0d136691", "value": "2B33022588AD773D537D10A085859F0EE9176C9A3C1DC1D21D8CF86AEC05669117FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702446, "uuid": "d2f26d27-fa30-4939-8d52-def8a15e0260", "value": "768:g9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCQUV:BP6z4+ADViS8CWoD94pUnQ64x11RiCQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702446, "uuid": "4f3cc6c2-debd-4705-bc26-97012adeca79", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702446, "uuid": "535ba22f-61f0-414c-8e09-e35af331a12a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702446, "uuid": "4550154e-8980-4d19-9320-580c82fc8750", "value": "diagram-1172306350.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd532772-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701654, "uuid": "433bc634-95e1-4d5c-a947-c2fd79100512", "comment": "Malware payload", "value": "7f90292b57da726b4f8a7fa9488220e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701654, "uuid": "d286a8c1-9736-4340-a846-f22fb284ce93", "comment": "Malware payload", "value": "018fe4b5f2bf11318e480fd90b5a42043400db733e30a5353e3daceb681e074b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701654, "uuid": "f7764542-8c78-4850-852c-90bc93d7ec58", "comment": "Malware payload", "value": "49364825183870decff60bcb0028ccf5f238ffdd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701654, "uuid": "6ce110b7-eaa9-4e30-9acf-6a2480dde70e", "comment": "Malware payload", "value": "ea880b8106172ac3f806872b45e3ca6c54012d670058cf357c75c8c59cc8bf4ff33ecb96c8279a446b7edccc497f333b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701654, "uuid": "56470a97-dc25-4d48-9c45-e5a0dae002e1", "value": "96330288C6CDD372E9F178319C39CB00D978A9AB0816C0A586F78AD7B9079D1170EDDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701654, "uuid": "b2763fdf-84c8-46ca-b193-b9f8eb7a6129", "value": "768:hwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2W:oFugXVpoD8ZxhrLAuNS07MrxrKsYJX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701654, "uuid": "799027c4-7da7-4d97-9517-ab6f44ffc8f6", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701654, "uuid": "c40b6011-2ffd-42db-b18f-525a74ba65bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701654, "uuid": "5307afcf-fd36-49cf-a1f0-bef3dc363b01", "value": "catalog-566927527.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f58374-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702174, "uuid": "52a2d38b-abc1-419a-b153-eeca4386b038", "comment": "Malware payload", "value": "e216174543b46ff856296bccc05df336", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702174, "uuid": "20d364ae-a96d-4799-94a7-164ea999621f", "comment": "Malware payload", "value": "01a1a5e420733b6910b30d4d116b5122167ec2ac1377cf31de86c2bccfb15764", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702174, "uuid": "0bd539a5-d37e-40e5-a865-ed2672beab9b", "comment": "Malware payload", "value": "69c895a22160c7057965994fd026c5340033c787", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702174, "uuid": "3f4e1a4d-2a78-4e86-9c48-d24a67db219d", "comment": "Malware payload", "value": "906f21f97e2a71f3d0cbbbf9431d5c8c9830297c35b88bddd3126863f4e2b4a5df630b308b71f30b45805fba341eaffe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702174, "uuid": "37b1e575-77ea-4424-af1b-7558a6d70f7c", "value": "5D33F28CC688E375A4F23831AC74CB01D578AA7B4416C5A381F74AE77947DD1174ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702174, "uuid": "e157ada6-dc98-4f0e-aaa8-307db4912868", "value": "768:1wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV28:UFugXVpoD8ZxhrLAuNS07MrxrKsYTMPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702174, "uuid": "33b1fd5e-c84c-4917-99a0-b6ae50328b3e", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702174, "uuid": "a4d4ebdd-fdf2-4d42-9104-d24aab8465cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702174, "uuid": "f0d2252f-2354-47cf-9c9d-d41475c6fc50", "value": "catalog-961934576.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0ccbbf-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619734104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734104, "uuid": "8a1ce2d0-e202-44d3-923f-01d3eb167f17", "comment": "Malware payload", "value": "45b6cac70c457ac12151690b2d53b4a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734104, "uuid": "43f82624-74bd-4e62-bbcf-9babf10d4a54", "comment": "Malware payload", "value": "01c3aeabda08f34a010d1090242ad12696e87f17d831bdd5e06a552f4a4aa10d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734104, "uuid": "12e0f475-9243-412b-a0b8-1cbd8a9db4d8", "comment": "Malware payload", "value": "bda8904ac10071c3fc056731ca2fbf34f6a17a41", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734104, "uuid": "c8986135-025e-4568-ad15-c8443a1a814f", "comment": "Malware payload", "value": "3696d58cb2dadd563daa8af3d50da1a4f90267f21d739ad572ba8d57044b25c1def9d60987140fda786b9af27aeec651", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734104, "uuid": "2751c5b8-3385-4a82-9035-098ef1087ab6", "value": "71F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734104, "uuid": "9acfbae2-63fa-4c3d-8d33-73ecebb96de3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734104, "uuid": "2897de36-a7b2-4655-868c-e63e389eea8a", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619734104, "uuid": "339e9b6c-79fc-423f-a016-fe22cc937667", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619734104, "uuid": "311f0dae-d6a1-4817-98c6-d9ca4d93643c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734104, "uuid": "b3bb48dc-28fe-4314-9bb0-2c0d23f5768d", "value": "45b6cac7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278978c0-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658829, "uuid": "e0ebf56d-10ad-4148-81fb-ae4194c802a1", "comment": "Malware payload (QuakBot)", "value": "119d05915f3b2971bc7a4dd2020270ba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658829, "uuid": "1fe80733-5031-4974-b6c1-4b85ac34cdc8", "comment": "Malware payload (QuakBot)", "value": "01c53f276902311f4a35d26736d468836a514efd844bfa4d822be126d1f53ddf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658829, "uuid": "d24fc695-895d-47d0-b738-b0f40cfe2e1d", "comment": "Malware payload (QuakBot)", "value": "f57e203de0bc259e40d9105e8633ab2f6dd78a4d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658829, "uuid": "bc61e66d-6b0a-432c-9e8c-22989edbf427", "comment": "Malware payload (QuakBot)", "value": "b39c04c192260a584413c22e4de336dc5d81f0bc46f37382a3139d2752723df58daf12335aaebeea2874498f9d097c8e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658829, "uuid": "62e63532-9922-4762-9900-211a4aad1e32", "value": "28549E7AFA12DC02E7A82BF023C36F581A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658829, "uuid": "bb0ff0e2-466a-4789-beb6-3d010dda72eb", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658829, "uuid": "2383325e-db46-4c30-9f41-01e8c0686200", "value": "3072:x3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZI+:Bvv9sMoXBaRmr/dukbvuZ/7fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658829, "uuid": "ce55b57f-5f21-4423-b9d5-c4fbf74300da", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658829, "uuid": "a3543dcd-4695-491e-afd8-eb921ae6864c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658829, "uuid": "f422c3f2-97b5-4d99-8890-72bdb5c996a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4f98ac-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658834, "uuid": "9802d08f-c5fa-4ffa-adb3-07da52ac5ce8", "comment": "Malware payload (QuakBot)", "value": "f341f84d21e3bbb39e798441b3ea1367", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658834, "uuid": "1f868ec4-cdd5-45d8-a975-97f0988badd7", "comment": "Malware payload (QuakBot)", "value": "01d6ae2a8e20fd0ee039b9ee6997450dbe106d83dda599105bd39d14788abb1b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658834, "uuid": "4d4c82db-5a5c-4e6e-ac59-1e4ba765bdaa", "comment": "Malware payload (QuakBot)", "value": "c1812ad0baea3f60c55c94b2adc4740f51b25a13", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658834, "uuid": "6f654ab8-2ed9-4763-b803-2b504f7be34b", "comment": "Malware payload (QuakBot)", "value": "db212e021e86fc0a10ccbd5ce6d193827d50c3b66dc7c2ded39b3986d8c78d6e80d57d222c118fc5f211db7c6bb23611", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658834, "uuid": "28205b85-7fa4-4c0b-9839-af09748516c6", "value": "8974BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658834, "uuid": "c9a5791a-23a9-451c-8edd-3b1b8fa85c3a", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658834, "uuid": "31ee7667-e807-440b-9eee-2ae3dd553789", "value": "6144:qnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu/:FFrkNK11G9AEtMxQyOi60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658834, "uuid": "8b346571-506a-4da6-a3d7-c2aaaae3e9f0", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658834, "uuid": "321159ae-2867-43c7-a9f2-94621dd36aba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658834, "uuid": "c026d1f8-b647-4ba4-8a8f-0091cf554207", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d950959-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704044, "uuid": "2f37b851-3306-48ab-8d3a-b146f994937e", "comment": "Malware payload", "value": "daebcad25767105a0f84935b1aa196b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704044, "uuid": "4d2c00ce-98e6-41eb-a83c-57f33e992ff6", "comment": "Malware payload", "value": "01db3717274cabab2bd4a723b7c5f03074190ecf87b9b4b75093b696de8508d0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704044, "uuid": "278bd34f-309b-4230-8ae0-67218a1b2813", "comment": "Malware payload", "value": "6b8fb3bf0044f506f10afc61986415f1ea1d85e7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704044, "uuid": "68965701-e1f4-48d9-9d2f-47b5cce33039", "comment": "Malware payload", "value": "e95106f2fc2e5fc7c43a8de5414e60bddfa0b7e9bc57aa77eef1815983ddfbc2d7e0f3a56d9ecaa5709fd76b6c10b85c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704044, "uuid": "c4eeb879-5f9e-4763-8e39-560a6f19d9d5", "value": "0A33021A486EBA29173D20F44549CB5EEA0B64DD38ADCAC11CDCB479EC056A5123FFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704044, "uuid": "fe6cc951-b05b-4123-b106-6020d9db5367", "value": "1536:jP6z4+ADViS8CWoD94pUnQ64x11RiCqjy:TPZBiS8jopkUQ64xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704044, "uuid": "1083cc1e-f16a-4a80-9a5e-a59c8c4ffaa7", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704044, "uuid": "3fd2e281-ea19-4bdd-af2a-2bb8ebf88663", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704044, "uuid": "61b30ed6-ec21-4b28-ac36-053dd64254f0", "value": "diagram-448796734.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eac5f90-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705737, "uuid": "152234fc-566f-453f-bff0-08f74f843d0d", "comment": "Malware payload", "value": "fbc21e4ffc04e642a56f5cc81c060f75", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705737, "uuid": "a628bd0d-430a-4583-918f-e01659095347", "comment": "Malware payload", "value": "01ea74bda7318477bf1306d1c345cddcb4ab8e6bd61ef7f1e90cc639a7ba5f32", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705737, "uuid": "42fdfc94-908c-44e4-a3bc-080f58ffdb27", "comment": "Malware payload", "value": "c561d54f0ad322971e18197d5eb4a85457379654", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705737, "uuid": "3f78f608-a605-4bd9-808b-30d59d03241a", "comment": "Malware payload", "value": "a72e133786030016f07efd1b51204240f77e5447d12633ecb85c8dcb15a250a39dee0cc5f628801eeda852d340f5c27d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705737, "uuid": "3203d3e5-0c24-4631-95a5-dea2148646cc", "value": "0833021A5C9E362E536E14B08948CB1DE25764AD38ADC9812C9CF476FC057D8223F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705737, "uuid": "79f72ab9-22c4-4544-a9b3-0d549aa49606", "value": "768:s9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCp7X:FP6z4+ADViS8CWoD94pUnQ64x11RiCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705737, "uuid": "d7678793-7b8c-4e95-b6d7-eef357a01267", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705737, "uuid": "2b9dd537-43ce-46a6-b66f-b267e0ada30f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705737, "uuid": "ad1d8290-0c71-46d9-9f6d-28d72e4edb94", "value": "statistic-1735867515.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4bec6e-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699908, "uuid": "6f00d0e9-5131-4b0b-9c3e-8b47c739db97", "comment": "Malware payload", "value": "2dc618d24d09baf4e65c2fe1c144db87", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699908, "uuid": "c28e2e92-d509-4ff2-a998-e7f1d1d402ff", "comment": "Malware payload", "value": "01eba83a7d1fd108d05ee1936e38fe7d1d0c224fec34ca6d9688efb8f9e5aa8f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699908, "uuid": "85aaa3f4-1e6a-494b-9773-090fc4762fd9", "comment": "Malware payload", "value": "7a21be7dfec67ab42783f2719220ff0194635e62", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699908, "uuid": "07d47c3a-475a-43c2-807e-59ef95e4e225", "comment": "Malware payload", "value": "9e24711ee71aac265cef8005cb705ab732e98b8cc8f27b3a69ea62b5d1268ed7f505a42ae9e9685ed488cb49d7657640", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699908, "uuid": "83aa37b0-8251-471f-a020-82a249f358c2", "value": "6D33F188C6C8D332E4F57535AC79CB01D97869AE081BC5A280F78ADB7D07E85674ACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699908, "uuid": "bf013e08-a0b8-4bdb-bd60-6f858cec172e", "value": "768:KwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2w:3FugXVpoD8ZxhrLAuNS07MrxrKsYFIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699908, "uuid": "a71aadab-d306-4e1b-a0e9-cd584e25e57e", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699908, "uuid": "c9b0dc3a-6109-4304-8a2e-467a6094e462", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699908, "uuid": "b18d30df-e8ce-487f-9562-3b03739ec0fd", "value": "catalog-1155984737.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d12902e-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658839, "uuid": "0caeb0cf-a61d-453c-af50-765aaa7848d9", "comment": "Malware payload (Quakbot)", "value": "48b1bc9ce040d6da2df1afddf47302c2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658839, "uuid": "a9053e92-0582-4909-835a-4b54d2929abc", "comment": "Malware payload (Quakbot)", "value": "02095c623d941e87b2a3c4c3124c440afa04958e9a10911e96ea78c814229781", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658839, "uuid": "8c5566a9-19b8-44bb-ac2a-25a49aa70726", "comment": "Malware payload (Quakbot)", "value": "05ff5398ffb4a0ad59fa4e8e2f513409925690b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658839, "uuid": "e99f6592-ae33-4746-a4fd-63bef994f575", "comment": "Malware payload (Quakbot)", "value": "2ac1067e79d4d6fed1c7445e95b82726096108316ff25effcb2b9aa1a772d025a4dfde1f2378bc50f0423bcd42238520", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658839, "uuid": "99f3b19e-08e6-4a1f-a4ef-466cd1bf2a3c", "value": "85549E7AFA12DC02E7A82BF023C36F581A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658839, "uuid": "b2feecd6-030a-4d42-aa48-61d1344afa14", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658839, "uuid": "54f4fac0-9470-49b0-8dc2-faa4bf5c2802", "value": "3072:O3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZvfj:Kvv9sMoXBaRmr/dukbvuZ/7f97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658839, "uuid": "848d6ecb-01fd-4420-8011-9af9cb63dcd8", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658839, "uuid": "0047284d-26ee-41fd-899e-920977171e9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658839, "uuid": "980f208f-b194-4f34-963a-8ad94607c8f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fda4e81-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658843, "uuid": "97c05876-1b5c-4091-bbb1-51c8571ec4fb", "comment": "Malware payload (Quakbot)", "value": "b0f4a4de3edd641cc3291ab36000c067", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658843, "uuid": "ecd5f891-f540-48a6-862c-ce9124aad61a", "comment": "Malware payload (Quakbot)", "value": "020af5c1c149ce7ffd9569bf0b12371cd6ec5aab50caa07c2a0fe9d7e9fe396d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658843, "uuid": "685a20a3-4088-46e5-bb7c-54d5ceae9e2a", "comment": "Malware payload (Quakbot)", "value": "798fb4c4e7ae985272f91695be287e92999bd303", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658843, "uuid": "698dbe39-63b6-4822-8124-95e573ca7a90", "comment": "Malware payload (Quakbot)", "value": "86ef3609588b6e9ff76aafc27c42aeeadcf0b9b112365cb7acecfb5b139d6b6d9de12dea7956ccf65263519de381ad57", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658843, "uuid": "dc8f7dbd-733a-49c0-a83d-23efc3cf40f1", "value": "5774C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658843, "uuid": "f8975135-fce2-45a8-a28c-6f07ca9c667c", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658843, "uuid": "a482008e-33e6-440b-af70-9f778c33206c", "value": "6144:tTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuX:tbi7/xZrkNK11G9AQyOi64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658843, "uuid": "4ac22d27-dd67-4c35-b32b-c84d2f3bb1b0", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658843, "uuid": "39842453-b021-4050-a8f8-4e4510b7a5d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658843, "uuid": "046f9dce-b68b-4145-bec5-133d80a0811e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b0c8ef-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704888, "uuid": "5dbd83c3-cee0-4718-8562-7b35f141a2d9", "comment": "Malware payload", "value": "6dec3e526a967beb6e93a640bff3d382", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704888, "uuid": "a5d3304e-1f35-43fa-b5d7-8cf51768cd4a", "comment": "Malware payload", "value": "020b9c125df861dd4e371ba88b3e6aea70efdf99984443b3e190d825131ec186", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704888, "uuid": "3e1e800a-1b9e-4e35-b5de-bd6da5881bb4", "comment": "Malware payload", "value": "538c6ac26492c938f1e0aef391734c641a802254", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704888, "uuid": "37e1b290-efa7-4927-905c-1b2fd3849147", "comment": "Malware payload", "value": "9f7948b8501bfab5375e9bdbdf16d416a0b380bd40ca0e8865ec65c419da6dac88b9eb0a062ce5ccf4af7746679d9826", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704888, "uuid": "41d5fe48-290a-4df9-b56d-e10679ff3f34", "value": "D333022998AEB52A572E10E486859B5ED9076C8E3C6CC6815CCCF066DC067AE153F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704888, "uuid": "363b1190-f69f-4935-91b8-5af4efc557eb", "value": "768:z9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCPyC:GP6z4+ADViS8CWoD94pUnQ64x11RiCPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704888, "uuid": "2b807430-0fa6-4618-9185-e7db224c7c7b", "value": 51489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704888, "uuid": "486294b3-af36-434c-a75a-8468d69b2baf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704888, "uuid": "840cced9-ecea-45fa-aaa9-bb8da1ac3e85", "value": "statistic-1030986334.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a05ffa-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658848, "uuid": "8a916476-b8e3-49f8-812b-ca10cf653918", "comment": "Malware payload (QuakBot)", "value": "9cd65520573f00c7a964b49afe50e77d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658848, "uuid": "30db23f9-5b1c-40fc-b790-670a37503310", "comment": "Malware payload (QuakBot)", "value": "021164df613e8a5ac802c14f310f19a1203ee8cbe87110eb5472a2dd54a9474b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658848, "uuid": "badff1f5-ff3a-44dc-a5d8-104955d5c152", "comment": "Malware payload (QuakBot)", "value": "371c193c5cf441e8b0dc3f987d975716079b84b9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658848, "uuid": "525be914-dcc8-448c-8ba3-b23b0e6252d7", "comment": "Malware payload (QuakBot)", "value": "43844dc87851ea8ff24da77673e07d86a14628a9f1c323eb890c7f18fba04e21eab8071121bd65b3f775bb2daae127d1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658848, "uuid": "ce430657-ddcf-4e9f-b497-5de44cd7e91a", "value": "0C74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658848, "uuid": "79fe6338-fa88-4afc-8c30-2a3fb4fae24b", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658848, "uuid": "b834974c-347b-48ef-9f71-e64c21fdbf8b", "value": "6144:ynQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuP:NFrkNK11G9AEtMxQyOi64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658848, "uuid": "af4b1ed8-c524-4e1b-a364-12b7f3f779db", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658848, "uuid": "be052a07-f7ff-471c-9837-4d7893da6fdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658848, "uuid": "c3478785-a726-492e-9eef-166d6e53e832", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35681997-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658852, "uuid": "34489f8a-ccb1-41c4-be85-6d5c78858f41", "comment": "Malware payload (QuakBot)", "value": "9b31f504b6c9a7b4bfaea504e35beacb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658852, "uuid": "47d084f6-f874-4ef8-9087-a31230cd0ebf", "comment": "Malware payload (QuakBot)", "value": "021f67d3925e7f112a6241a0de2f3f0cfd1e48fccb822942c79d834c74c6f520", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658852, "uuid": "f8762adb-4996-40ed-9aec-862288d8ea73", "comment": "Malware payload (QuakBot)", "value": "1d8d23dd31f9b51e96fd31f5c921267b40195874", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658852, "uuid": "0316482c-63d1-4c4c-9c48-e9d44242fda3", "comment": "Malware payload (QuakBot)", "value": "623121f51846f7d3e768e5af14db617c9a5297fc09351606f71a70381db37c549c8ca0200492e88f5218c3857cf37278", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658852, "uuid": "ba5aebd5-495e-47d1-b791-bb6da97c4de1", "value": "ED549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F587EEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658852, "uuid": "f92e2828-d142-4df0-b047-5a3ee6b6acf6", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658852, "uuid": "0ec47369-15ff-4777-99b5-4ba33c752c3a", "value": "3072:f3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZE1:Pvv9sMoXBaRmr/dukbvuZ/7fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658852, "uuid": "a2e5d413-4813-446f-bc54-00bb5aa63aed", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658852, "uuid": "bb743025-646f-41af-a7f5-8d4a17f360f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658852, "uuid": "9019c70a-c711-42e1-9dba-61f9d007e47a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34c89e4-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702416, "uuid": "f000cda5-f4b3-432d-aaf2-c66031196fc1", "comment": "Malware payload", "value": "e84abd028d0a671c3673404339bfc41b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702416, "uuid": "faa351d1-5c28-4498-b091-3d0e8a48d797", "comment": "Malware payload", "value": "022fbb1a1b8b87dae4899af2539c9103e356da7642630dafaacc961e78191ff5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702416, "uuid": "5494e21b-f8eb-45bc-a598-22cfb25d4e44", "comment": "Malware payload", "value": "895ebdca77fe20bbe5d7bfa7027b64b72709a1b6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702416, "uuid": "bb5f5057-f7ab-4323-95cb-e32ea167e267", "comment": "Malware payload", "value": "0c1eec41e6f511e5d9fb063aae66633ddd9303907ccc7d6ef5025aae034cae6198e8993d8ca0c9e4ddead0ef585038b3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702416, "uuid": "7b93d579-4e7d-48bb-a4f1-cabd1a7ec94f", "value": "0C33022A986D3A2E932D10B08545EB5EE60B58DE3C5DC5812C8CF479FC066A9113FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702416, "uuid": "3063784d-9410-49c2-8c90-d399b59bdd76", "value": "1536:FP6z4+ADViS8CWoD94pUnQ64x11RiC7PL:xPZBiS8jopkUQ64xFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702416, "uuid": "27fca047-06c9-4342-9070-cef13bbe7d7b", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702416, "uuid": "b7a774ca-c5e4-4308-8943-cd69fff9f2f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702416, "uuid": "41a450bb-57b3-4e53-8fb8-3d088fcbc753", "value": "diagram-1146037726.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38281331-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658857, "uuid": "c8f646ca-7e26-48c4-9c45-0cee1e5815b0", "comment": "Malware payload (Quakbot)", "value": "35a3e9c97aba2373376109f3c4d87742", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658857, "uuid": "b7c5423a-b437-406f-91c8-d82a2dac4abf", "comment": "Malware payload (Quakbot)", "value": "02494455c6737b0a5a765a298e467fd3ae61c1d6cbeced7cc59a340a8ddb5293", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658857, "uuid": "cce40658-4e69-488a-8096-a149f1798eaf", "comment": "Malware payload (Quakbot)", "value": "686967923351833c3a7e7561d8455945e55c17fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658857, "uuid": "c3871436-20b1-4cf9-9635-9e540b2684f6", "comment": "Malware payload (Quakbot)", "value": "2e99240ce54e15e0cac52303b9489ba2d36e83ddd7e13a308119eb51cacf2f3fdf3153447e229e41881e1cc78a3b151c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658857, "uuid": "9aa4d3cf-a197-4577-b4db-2d153ac1c52a", "value": "5A549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658857, "uuid": "f0943fa7-83fd-4ef1-80d6-bcd731e5409b", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658857, "uuid": "f78a2af3-7ae0-4f61-9c6b-5fca891055ed", "value": "3072:d3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ2H:tvv9sMoXBaRmr/dukbvuZ/7f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658857, "uuid": "53aee196-7c4e-4e6e-8ca5-29bafa4a5bf2", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658857, "uuid": "beecd12e-0067-4801-9d10-67d3cc85ea32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658857, "uuid": "6120f60e-d2b2-4a82-a7a9-8b9ffb92e5d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e38401df-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702524, "uuid": "c3bc2c0b-052a-404c-8844-842159bd5b77", "comment": "Malware payload", "value": "1cac9284efecab36bcc3b3cfe232c976", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702524, "uuid": "adad83a3-832a-471c-b30a-548e5011713d", "comment": "Malware payload", "value": "024d695ff8673680533edd9341038b43a372c9e171176bb20fe0f73d4df57f9d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702524, "uuid": "52fdd291-a38e-46e1-bfdd-6820ead1e2eb", "comment": "Malware payload", "value": "bd9c293f88e5fc748595cb2a4c238ac72f096c57", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702524, "uuid": "23761103-7442-4534-9f00-a54f030a9138", "comment": "Malware payload", "value": "d1273aa9f0169fd029fb6ff98b42c4afad3593820d654e2669bfe93b824fa512318d12978842c35248aed7b3624ba784", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702524, "uuid": "29b93849-e2ad-4bbe-b26a-6f6dd1a7db70", "value": "1333022F585DB62A577C10F5C589CB1ED50B689E382DC9821CCCB826EC09669153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702524, "uuid": "6dff3c47-82bc-44ff-83e8-8acfa38ce9a0", "value": "1536:nP6z4+ADViS8CWoD94pUnQ64x11RiC+DYu:PPZBiS8jopkUQ64xcDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702524, "uuid": "60cbfa11-ad56-4f35-8ad8-01a1ce592a1f", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702524, "uuid": "06b41cf4-8b1a-40ee-9c6c-0018212f587b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702524, "uuid": "dc801551-a132-4a3f-a0c6-008484242fca", "value": "diagram-1254329098.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb5c563-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700095, "uuid": "27284e4b-8daf-4f40-ac25-057f3e883ae0", "comment": "Malware payload", "value": "bda7b477db98e94d58ef4161c4c25201", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700095, "uuid": "2be8b142-610b-4eae-9578-2465e7dc928f", "comment": "Malware payload", "value": "02593daf173200e759a9b6c6fde4c40b938eeda28c868b53aa7d6af9f83d76b5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700095, "uuid": "0d6ad195-3a8c-45ec-8472-19f415ac4fea", "comment": "Malware payload", "value": "61b49e00607fe601e411321208c65dd5c8b293c6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700095, "uuid": "4efbcac0-8990-4eef-9781-c9f9c02a5dfb", "comment": "Malware payload", "value": "bfe4bd312e3c2c1475ff1e2b9c80536f608ca5080e932546ce9150eb641e1a51711a8c5512542645d7d5a9972db6bf70", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700095, "uuid": "0145a6ca-2101-4b37-ae5e-8b8077c37fdf", "value": "B43301C8D2C9E371D8F57871AC75CB02D478B97B481AC0A281F74ADB39079921B4AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700095, "uuid": "8917fc6c-5efe-4119-900a-c4a847ebc53e", "value": "768:ownXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2W:FFugXVpoD8ZxhrLAuNS07MrxrKsY9M0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700095, "uuid": "1d823f2a-7185-49e7-ae56-b8e669a3ae2a", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700095, "uuid": "513cd4d1-a6d7-4a16-8b6d-8bbb7448ebd3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700095, "uuid": "35e6a005-baff-4447-bbc9-b4120a2c3d73", "value": "catalog-1278723121.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a7fd58-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705104, "uuid": "68f9b3de-7fba-4c20-ba00-c4f2f0c57e2e", "comment": "Malware payload", "value": "9aeb5003ff55378f40fe8f36f538c43c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705104, "uuid": "d14734aa-5d9f-4752-9025-f5767e451ea5", "comment": "Malware payload", "value": "0268f2ead320b92034747f12ca66e96775cd691627dfbc5d9f7a48921f823943", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705104, "uuid": "d59becaa-8a92-426c-a493-506627f70ae5", "comment": "Malware payload", "value": "52f9d06db333dbac5a33ed8081ecf8d15b39db97", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705104, "uuid": "1c4f7722-d1c8-4b06-834c-27a1b28eb2ec", "comment": "Malware payload", "value": "a7a6f773b1abd5ef7f583340e828352ba543fa1d514de5390362f2f99de58801cdab8276770f567a9e03a9211ebeaff2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705104, "uuid": "85c99959-a43d-4520-aeef-c5b8a3342d93", "value": "4F33022A9DAEB92D073E00F1044A9B5ED64765DE383EC5425C8CF4A5EC4A6D9013FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705104, "uuid": "443e34fd-8392-4dea-aeb1-ceca3726c9ae", "value": "1536:yP6z4+ADViS8CWoD94pUnQ64x11RiCyId22:MPZBiS8jopkUQ64x4Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705104, "uuid": "de88036f-ea6a-41aa-a384-49ee39b8b875", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705104, "uuid": "8f2ee7db-0f9b-4468-ade6-33be84f7f6b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705104, "uuid": "88ed695e-808b-4af8-b6d9-913133d2bd87", "value": "statistic-1200599559.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f6f063-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701211, "uuid": "2a31206f-504e-428d-9287-4363e254ab11", "comment": "Malware payload", "value": "51335b547ccb082ca37ee52a8b0c83f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701211, "uuid": "5486d3d5-fc4a-4ce4-9b19-04dd56bcc2da", "comment": "Malware payload", "value": "027c38b7e1ce2957a51f57206d7eb665c9c26d318aafaf1097bb824f96a0dc01", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701211, "uuid": "f46082a5-100e-4c84-98ee-a121cd62731e", "comment": "Malware payload", "value": "3070c05d7e6afe8269eabddd2c3fc08c396ed206", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701211, "uuid": "625a67f1-d599-48bb-8d6c-e2552da66a6d", "comment": "Malware payload", "value": "bc46d2ddaa8a1a6c9c7549eba8e8e7b88e0660607288a634373242539b55fe59b14bced0d0af1c1fc06e3f79c498bbc8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701211, "uuid": "7d139dd3-0b3c-4d97-9ba2-497784b9908e", "value": "C4330289C1C8D336A8F53931AC79C702C578AAAB480B846181F34AABBD07995174EDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701211, "uuid": "ec469b1e-ba6d-4164-9a22-51b4dde29165", "value": "768:2wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2H:LFugXVpoD8ZxhrLAuNS07MrxrKsYTm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701211, "uuid": "c2ca766c-27eb-423d-82c5-13048deb8e10", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701211, "uuid": "63311d7e-d8ac-467c-bc05-46423067d7ca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701211, "uuid": "6e86bfd1-39b5-4a87-8e78-cb48b7a73093", "value": "catalog-224749324.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aed86cc-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658862, "uuid": "3ed7b93a-e605-4d0c-9206-06a2ef3fef26", "comment": "Malware payload (Quakbot)", "value": "ebdff079e55735ebed3ede2a2dea3401", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658862, "uuid": "d5f8f0c4-5cb0-42ae-abf5-e602c09aeb75", "comment": "Malware payload (Quakbot)", "value": "028f3af0dfc60c8ad13ccdf9a507c4368d68a7c42b90060f2031cf73f95f31de", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658862, "uuid": "65978269-3e78-475c-9a3f-74a18aefc05a", "comment": "Malware payload (Quakbot)", "value": "205b058a096b3d2db26d52e8b9f46fa24c86e0d0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658862, "uuid": "3be47ced-c076-4a62-9a47-c7e2a1eac2a7", "comment": "Malware payload (Quakbot)", "value": "b0744d023bb80618cf9cf00737e733fdaa113d8b0c50ec26369ee1dee856d9f0865a72c46af145c1274ffe78d4eb9553", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658862, "uuid": "59c89300-18b2-400b-8f2a-dd3895bfadd2", "value": "A174BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658862, "uuid": "cd24d2fb-cb83-44cf-8489-b66d98de87c3", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658862, "uuid": "7cbf6149-9039-4261-a6ac-67a9e3860f87", "value": "6144:bnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuc:MFrkNK11G9AEtMxQyOi6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658862, "uuid": "b41ce117-bc0e-4e64-a529-e17d192ebd07", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658862, "uuid": "9c1e7644-a12a-4048-91f6-2fb082bfdc07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658862, "uuid": "5ab9552f-a860-4d3c-b04a-54ac9027e68a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbc6fb3-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658866, "uuid": "de5d9838-ef4f-4d67-bf15-a89a98701661", "comment": "Malware payload (QuakBot)", "value": "5578a0301a02a56dc10a7ab578aa0deb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658866, "uuid": "786cfb3f-1d52-4d05-a48d-ec7f64e09d26", "comment": "Malware payload (QuakBot)", "value": "02932fb0d658b03e912f993f65d62bf0561d219225413eb302e742c178aa9b87", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658866, "uuid": "0812b9f6-6ff7-4354-ba41-53f4f2f2a7f3", "comment": "Malware payload (QuakBot)", "value": "a2d6091f2e079d78fa33b8381ee1d8d95aa26587", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658866, "uuid": "c5ea6968-6f0e-40c7-879e-1ede82fc0503", "comment": "Malware payload (QuakBot)", "value": "a03ff19c858411c960866f5592f203137bf2051671167a89c4b7ea6a793684fab5a70f339e68c1e8e0d3723b19997943", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658866, "uuid": "72f82df8-48d2-4309-95d3-6d230de590a9", "value": "D2549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658866, "uuid": "d28990d4-5903-4f82-928c-2a03e19adc3b", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658866, "uuid": "261cd67e-2f2f-4e51-814b-bf146c35c7b2", "value": "3072:A3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZsO5:Uvv9sMoXBaRmr/dukbvuZ/7f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658866, "uuid": "abb890a3-2d14-4286-9c22-6389cbce1337", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658866, "uuid": "f9e12c07-5943-4e00-a1bf-3eb3ad730946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658866, "uuid": "cd067f94-b9cc-416a-b6ee-7d9aaca086ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407ccc56-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658871, "uuid": "5393daae-a157-4b0b-a01b-ef23dc435c89", "comment": "Malware payload (Quakbot)", "value": "5aad2deae0523e5ef62311a3fffe11a5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658871, "uuid": "93fe712a-9b36-4457-a0ad-4fb3ab5d6367", "comment": "Malware payload (Quakbot)", "value": "02a17c836b661696f7055bdd5f76c1e6be889d2a2d81241da921fc0a7e3c4b4a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658871, "uuid": "fa962f1c-0a94-4b5f-94b3-4b2a5a089a15", "comment": "Malware payload (Quakbot)", "value": "bfedf18f0e119bd3af12c8a2e734ed3ce8ca3a9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658871, "uuid": "04ecd12f-cac3-4c44-a89a-904635da938d", "comment": "Malware payload (Quakbot)", "value": "b22ba8fc938666ec531bc3cba843e1de3e9a0e7324abba52cbfae6507269f42d950526ee9373dc8c62dddd0b34afc487", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658871, "uuid": "db1994dd-e2d7-4681-adc1-1d7ba84c8ebe", "value": "7F549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F587EEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658871, "uuid": "767713e6-57c9-4b04-9dac-771debe05ead", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658871, "uuid": "3acab9cd-e1d7-4f36-9f2a-be680968d086", "value": "3072:x3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZlU:Bvv9sMoXBaRmr/dukbvuZ/7fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658871, "uuid": "484563e9-4346-4f4e-a87b-f4cde2497a61", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658871, "uuid": "015a132d-b77b-4265-ba00-fb6a9627c4f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658871, "uuid": "1322803d-f5cc-4c90-b9a5-4572c626b792", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434017a0-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658876, "uuid": "6e25467c-3466-45d8-b77b-fd02e12fc778", "comment": "Malware payload (QuakBot)", "value": "db7487d00d4dbf66bd7b014dcaaf40ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658876, "uuid": "ce5d3194-81f3-4b2b-b61e-2ec043caf697", "comment": "Malware payload (QuakBot)", "value": "02a5200121aeca73e58cd3b6a6980840b77dad36e1fab4f8d922c8b85339c3cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658876, "uuid": "4bff61d6-4f04-47d1-ae45-d73de90cc1a8", "comment": "Malware payload (QuakBot)", "value": "f50c40d2ae9c4ce28c79a01d3769247847428bda", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658876, "uuid": "b6393684-6c51-48ad-b661-6f596b18d75c", "comment": "Malware payload (QuakBot)", "value": "dcf99334f2a78f5320539a59d2e9dba6ed7fa8889bc9e6fe2ec6c65e248592cbe2261f9e2528e27fc902f6261a40c8f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658876, "uuid": "d00316d6-1a6a-41c5-a341-26c0e7189d2a", "value": "3E549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658876, "uuid": "d795f53b-1990-4345-a880-8ee0bc0b85b4", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658876, "uuid": "213e8077-4e0e-4b72-9c63-cb37eb13ea5b", "value": "3072:83FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZTA:Avv9sMoXBaRmr/dukbvuZ/7f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658876, "uuid": "a47b16f9-cf6c-44a7-99b7-6461bf95e42d", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658876, "uuid": "77e8e99d-fdea-4db2-a5ce-e9b8fe05b868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658876, "uuid": "35cbde4c-e6d7-4f80-9f6a-4d7f90bbb705", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e54a582-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703616, "uuid": "d7a1d2fa-56d8-4095-af39-d6f68d6bd2ab", "comment": "Malware payload", "value": "8e0627390cd28f9699c5ab47568b69b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703616, "uuid": "5f2f0ce2-be8f-4c75-9d7e-c746698375c5", "comment": "Malware payload", "value": "02a8646e9586bc3f125151b921d11316008fbb78814aa95b0f002186ff5472eb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703616, "uuid": "22b32374-66b0-4c24-93fb-daf426b57d2e", "comment": "Malware payload", "value": "09384dcfd701ebf3297a538fd383f4744ad1e8a4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703616, "uuid": "3706fe6d-8c67-4404-a040-670c461b5e87", "comment": "Malware payload", "value": "085ba0447f1e43a48b3b901bf3dc1ca93a5d0320e0c850442e0d062f544e1cd941a075ffaca434fcdf67751bc0e9516f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703616, "uuid": "d7d9d2ea-5b57-48c8-8d05-77ead51d256c", "value": "3233021A4C6DBA29173D20F40549CB5EDA0764DD38ADCAC11CDCB469EC05699123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703616, "uuid": "f3c62fe6-e511-4862-97da-71f0447db522", "value": "1536:7P6z4+ADViS8CWoD94pUnQ64x11RiCaS5:rPZBiS8jopkUQ64xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703616, "uuid": "ee7110bd-53a0-4156-a57e-3da5629fbf96", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703616, "uuid": "d5f86a4c-2028-4abb-a746-4e905e3a4285", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703616, "uuid": "27f5ff95-ca22-4796-b94c-d9680ff37116", "value": "diagram-2027818805.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670c3f5e-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701456, "uuid": "7d19f3da-097a-4c65-bbe5-33b36dd108e2", "comment": "Malware payload", "value": "156f1c6828f41819dee4b27c1ad97d11", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701456, "uuid": "5c0c9856-b710-4107-992a-ba7300e312e3", "comment": "Malware payload", "value": "02aa60f3b3771d8c714165245168afa1e2fa85f019dfc64b0cddbffe7c55a495", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701456, "uuid": "bc91eec6-92fa-41ca-8e68-f2ee57e86c19", "comment": "Malware payload", "value": "2e8e3b227bd7655de0fadb37a30e29277358d84b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701456, "uuid": "3b5fdde6-2415-4a9c-b6f2-95e13f2844be", "comment": "Malware payload", "value": "a4f32ceb338db100eaef8bc8beb6c3fffa550bb997573fe6e3fa256dff8821093c15099eb1fb4f54027c8ce1723f54a9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701456, "uuid": "75613a40-e7fc-49c0-bbda-5ddca9b98a49", "value": "FC33F188C98DE372E8F674319C398B01D93869AF4817D55582F74A9BBD07D811B4ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701456, "uuid": "6d09a608-80aa-4cd1-910f-b62a3b68474b", "value": "1536:3FugXVpoD8ZxhrLAuNS07MrxrKsYMKiPx:fq41rLZNkZLYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701456, "uuid": "fef88d19-9bac-4950-8592-4975d8af7917", "value": 51489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701456, "uuid": "e3950e54-1bf9-42c3-80a7-e2641e20e496", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701456, "uuid": "64b0a1c5-3aab-4b8a-b52c-c485c61a547e", "value": "catalog-40096697.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d546dd-a887-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619658672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658672, "uuid": "da427409-ff06-4f48-8859-2e7954ccc6f4", "comment": "Malware payload (Dridex)", "value": "63db3449af4636ca95f9a337317a25fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658672, "uuid": "9d02d0b9-d850-4a94-b644-b685d453dc2f", "comment": "Malware payload (Dridex)", "value": "02ad8a857a1eb0af6d16d37e406d45807f4616b5500eed10f54b1d4058d59632", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658672, "uuid": "a0cc16d6-df67-4d89-96f1-e59288614a13", "comment": "Malware payload (Dridex)", "value": "aff3224a51e0b1c4ea3b1388c803af3a60099ce4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658672, "uuid": "ff315196-19ce-4735-bd58-a2f2f70f962b", "comment": "Malware payload (Dridex)", "value": "62d03c3d25d8c048a03b5a76dba561340c8fba941dec3824add669cd1935ae0715dd70b35961e8207bbb7508425bb2e6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658672, "uuid": "6a4e1487-43a6-4b23-a912-fb631e4b4269", "value": "2EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658672, "uuid": "b10b751c-36c8-41cc-a067-b6fdafa2b117", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658672, "uuid": "d58f8400-ad87-4486-8676-cb52c1ca9591", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658672, "uuid": "2fa2754d-2394-4185-af68-c34261f3015e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658672, "uuid": "d248a50c-80f6-49d5-9d6a-a1f5719a242b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658672, "uuid": "23f71bed-1314-41e4-9e13-f86e9d3a6538", "value": "63db3449_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea874237-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703824, "uuid": "f16ac5e7-9124-4213-a42f-74f97bce041d", "comment": "Malware payload", "value": "51b62490b05c54a7b861910fb2587e4d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703824, "uuid": "cf04352f-6a59-4d7c-9d69-f3ae90c2af59", "comment": "Malware payload", "value": "02add521d54775228bc8420796dcbdffc3cc77a211704239cf045a47bcd4de60", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703824, "uuid": "9ce065d0-7b87-4b7a-9977-5f2c86598b60", "comment": "Malware payload", "value": "b687c7e356c970c3605ce4b4fb17650a1dd97572", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703824, "uuid": "7d11f70f-bbf2-4df4-84ea-741f67e3c533", "comment": "Malware payload", "value": "cd58c0b7f41c6b4d43130bde353885f74e2ca43fce53da6814785ea3276cc65128526542f7739486dcbbbadbd3bc4f5e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703824, "uuid": "2e5cf776-2157-4e81-b2b1-2596aa7ec0df", "value": "A8330229886EB639172E50F08549D71EE61768D9385DC9812CDCF467DC066B8013F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703824, "uuid": "6c7f4efd-55ba-488f-a6d0-4937132706a3", "value": "1536:7P6z4+ADViS8CWoD94pUnQ64x11RiCfeL:rPZBiS8jopkUQ64xEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703824, "uuid": "fd7a8f45-ab8f-4334-8258-467bae7c4a8b", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703824, "uuid": "a2a6232b-5ea2-416a-a49d-c315b1ae1076", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703824, "uuid": "114d6b2b-bb49-46bc-9ead-1d5f7a22bb7c", "value": "diagram-268133225.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52df1f3-a8fb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619708513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708513, "uuid": "782b48b5-0885-4dc1-926a-a0be32310438", "comment": "Malware payload (Dridex)", "value": "53301f28a5d999d210ce07e944b50aa3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708513, "uuid": "a67e9c7d-0c2c-4d78-8190-ba2eb2e8a761", "comment": "Malware payload (Dridex)", "value": "02b7d31e1d46e02e2a6ab567a28853bfb6f7399415486d5a3557ce82c041f03c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708513, "uuid": "583bab60-9042-4cff-b90e-9e33cb9570bb", "comment": "Malware payload (Dridex)", "value": "3c0e5b470f86060c8b932f647e1163b66f3e64cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708513, "uuid": "5e59b4fb-f3c6-4750-a8ef-938a9adca988", "comment": "Malware payload (Dridex)", "value": "a5f13b828b984fb3373420d6e32bb479f19cf7af3986c6beccd492121f41cbe206fd93105a53b1592da803e051aeb45a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708513, "uuid": "0f308934-19a2-4006-915c-17650c414d56", "value": "67F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708513, "uuid": "6834bc21-27ef-4407-874f-3c594937200a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708513, "uuid": "e2da3c41-6609-4ddc-841a-98a7dc8e37b1", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619708513, "uuid": "7f6f6943-28fb-4b1c-9486-2ad49d50574c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619708513, "uuid": "606b4463-9828-43bb-b4fa-538d4f6501de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708513, "uuid": "99cfb0f9-6665-473d-9aa6-76e9d4597c94", "value": "53301f28_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fe3d4d-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658880, "uuid": "244ec108-ee9a-4914-a547-ae94cec36007", "comment": "Malware payload (QuakBot)", "value": "2ae02b266b900cf08c3580e04d41b9d5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658880, "uuid": "d9e9ef52-dd85-4a19-b69b-8e533c98ca05", "comment": "Malware payload (QuakBot)", "value": "02be8ab57be5c37dc4fe4c468e3107c728eeae3e95fa16a6b98ca4a287e29935", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658880, "uuid": "abea9507-dfc5-4b4d-b090-4aa2fd789ecc", "comment": "Malware payload (QuakBot)", "value": "f1982b496634910a711320dca54e23c716dba93d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658880, "uuid": "13633aa7-d58e-40c8-865c-f13667b63733", "comment": "Malware payload (QuakBot)", "value": "366b0968ac9780d56607bfed89e1a9973eeaf5e94ef780ee2c6121610377feff3b1a341b087729423256b4191e4c0db3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658880, "uuid": "cf6715a3-7977-49b1-b5c8-64d18d6db078", "value": "93549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658880, "uuid": "22552b3c-f644-4748-b8aa-ab006dceaab9", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658880, "uuid": "89274726-0a15-43d5-873a-a0d30457cb22", "value": "3072:g3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZA9:0vv9sMoXBaRmr/dukbvuZ/7fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658880, "uuid": "5a8c65cb-755d-48a6-ab3b-ed920cf265dc", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658880, "uuid": "85805601-e3e7-4852-b84b-10f7e88eda91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658880, "uuid": "9b65b0cf-7d66-4b1b-8c4a-de4eafac6a77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c46b03-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658885, "uuid": "93c4e562-97cc-4356-9cf8-df58b01373c0", "comment": "Malware payload (Quakbot)", "value": "6b9a28125def45b6fcffd5b9d4fb102c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658885, "uuid": "873aadd4-ae94-49d7-9fba-e9b20f342c0b", "comment": "Malware payload (Quakbot)", "value": "02c8a7814a300e76d099f5a3530895b18c7ce6bcee494d02f986b364a6a5ae02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658885, "uuid": "777c8cf7-39d6-45fe-a1c1-a9fa64a088fb", "comment": "Malware payload (Quakbot)", "value": "499247045aeb272b234526a84a58e07a06886cbc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658885, "uuid": "f1f8379b-dd71-453b-8b8e-40b688489940", "comment": "Malware payload (Quakbot)", "value": "cc73c26cc8fdddfd873951433edb53080b82bd6486eb7d4d794850f1de5b829134789fb5efc5c09c486ea234ace74e6b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658885, "uuid": "10c156ee-951d-42ab-a9b4-36c15ce3d1b9", "value": "EA74BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658885, "uuid": "c2000f64-90a7-4649-817c-99adb4aebcc0", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658885, "uuid": "24e95049-d899-43f4-8aa9-595649a059ec", "value": "6144:nTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRu6E:nbi7/xZrkNK11G9AQyOi62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658885, "uuid": "601eaf1f-dc51-471a-a88a-5db311d56b31", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658885, "uuid": "359858d2-9ab9-40c1-ac1a-e33929b5ed4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658885, "uuid": "0d6922d6-93e9-4755-a1c5-cd878c520853", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147eab83-a8df-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1619696163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696163, "uuid": "3876d81a-8466-4179-b7a1-0f860e031f69", "comment": "Malware payload (NanoCore)", "value": "1a8692b3a3f1be14b4cc1fc2ec7a63d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696163, "uuid": "4ba88d0b-337d-4f7a-bb4b-2d730d665175", "comment": "Malware payload (NanoCore)", "value": "02cf189467fdb7246a974e84e0deed6ae1a6e5a592cf7b2dc1895ffb4b60370a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696163, "uuid": "818580db-2727-4335-9ec6-6f115cfed074", "comment": "Malware payload (NanoCore)", "value": "2278d8a9e474d5ca593497bf9a5abebbdf237b17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696163, "uuid": "c19b2c71-22c2-4995-be75-c10600ba36ca", "comment": "Malware payload (NanoCore)", "value": "9d6b96335058d5194f920dbae3d452966de4d6cb510f444d1786fa19d4b7757618dfe731847c7184a38abab9f49749e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696163, "uuid": "8c630d2c-5dcf-41ac-8c59-50cc86dd6a99", "value": "5D85ECD9FFD0707105C4FB604E89CB71E5C463784FA5326BAA68B0C01D527A96C6EE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696163, "uuid": "1edb4752-b85d-4338-84a1-1af3b88890eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696163, "uuid": "4ba00afd-a2f3-428d-b946-9cb51b6d1915", "value": "1536:jaQNaCCOLr2ZPZab4vcvRVZnBxzyI7mOMcsmkRZtLwZAZsvIcLtYZ9gB4ngG7g7u:jDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619696163, "uuid": "262c0360-0809-4450-b81f-720558432dfc", "value": 1752064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619696163, "uuid": "b037d474-3694-4a23-bd9f-2eb2c7f99632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696163, "uuid": "cb5aab3e-6391-47e1-996f-721b01d241ef", "value": "RFQ #QQO2103060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857eb727-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700219, "uuid": "01b26727-37e5-4e69-8eed-73fb7c2403b2", "comment": "Malware payload", "value": "e35f2e75034b397a168d3a613bda5e82", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700219, "uuid": "456ae49e-68e7-4ab4-aed2-a7b125d126a2", "comment": "Malware payload", "value": "02f19bc365a913e157d8ee97c35f038d8b84b8257fb839f0fbccf372c56d71d7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700219, "uuid": "ec9c2983-0398-422e-ab63-38a33a87b72a", "comment": "Malware payload", "value": "aaa3c234198df8c27600bdc75cb2db2eede96e39", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700219, "uuid": "d52cb397-3604-4289-a188-6923ce47f262", "comment": "Malware payload", "value": "4520067052c5c911ac685cc8d11c673f3e07529059ecbcd0f3ae0ad21d502c0273fa9dcb6a4c51bb6f62edb1197fb06b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700219, "uuid": "864d6f45-0d06-4357-be97-67f136ade98d", "value": "CA33F1C8C9C9E331A8F534346C398B02D578BAAB4427C17581F34AEB79479A51B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700219, "uuid": "555dce2b-34ed-4a9f-8459-f01ec1db08e6", "value": "768:3wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2w:OFugXVpoD8ZxhrLAuNS07MrxrKsYetd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700219, "uuid": "60afaccd-6d68-493b-8edd-c9d3a6a05b8e", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700219, "uuid": "79df9319-27e0-410a-bc1b-ec06165306cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700219, "uuid": "7db98edf-9158-41d2-a478-b1ec389b31fd", "value": "catalog-1368343517.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85543d3-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702022, "uuid": "db908846-c594-41d2-893e-89fdf1c982c2", "comment": "Malware payload", "value": "b6372788ca89b00a772d73d5d8b9a29b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702022, "uuid": "feb64c20-1d44-41cc-9f4c-c4b57e26340a", "comment": "Malware payload", "value": "02f1d3af9369013c887a977d05eef0c391c69aca57169d4097e9c619d22b1872", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702022, "uuid": "eba71c55-91ae-45e8-a327-1916639cc92b", "comment": "Malware payload", "value": "c8f6a6aab837203d4448ed445b9c2500adc19a8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702022, "uuid": "a830c485-f865-40e0-a8ce-aeb6597ad05a", "comment": "Malware payload", "value": "85aab4c4c713aeb66b351eeca8cd6700e4d0b8bbc75be780a9a8d314b6d6fc96842c7908a611e2195299d588dcea0d98", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702022, "uuid": "c8cc500e-e370-48ac-886b-e671c2e8aa31", "value": "7165AFF875047DE6266F576BDA96ACDC03B61B638ACBA4CD80647BC305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702022, "uuid": "ba5faa38-a4eb-46c8-b0d2-4ac44625b3b7", "value": "24576:pP5c6ZYK8g1F5wO90KCqxmVWbMqCKfc6ivygEraRAFQGqGw28hLBZOvRCNDW4:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702022, "uuid": "cd730050-0008-4b2e-bfc7-599a28c165e0", "value": 1482501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702022, "uuid": "4e7d06f1-b338-4956-bbb3-143b7a320a06", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702022, "uuid": "6be19cfa-d794-4e88-b95b-8265a495803f", "value": "b6372788_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bed000f-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706135, "uuid": "88565300-36ed-45a3-aca6-0c7c22fc6d3a", "comment": "Malware payload", "value": "8ca4b434dd0e60ab6c222af5ee0f8441", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706135, "uuid": "5fd28f42-d028-4b73-b6ca-872d8039f983", "comment": "Malware payload", "value": "02f909e429028dde7c35f8528b9b4efe4b0de5e77d19f57a780527611d1f03ca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706135, "uuid": "621bd877-4d29-486d-be71-d6d222ae7b9f", "comment": "Malware payload", "value": "43297417ed22cce1dd9eed7e0a68a0cd88f77d20", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706135, "uuid": "229b57d4-d698-4189-a3cc-b2b7ef99741b", "comment": "Malware payload", "value": "a6010f9964cf5fc83d35a5b1039d68ed2a606cf9d39d389584dd1ff7107b3113e35962525cbbeeb5ec3cf12fd3e2c053", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706135, "uuid": "a49a6fa0-3240-41c2-8900-e7dd09aa4b49", "value": "7A33022A4C6E7719572D20E405499B0EE55765D93CBDCA82089CF4B6EC063AD123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706135, "uuid": "69bf4e15-3be5-429a-a6d4-96cd9f61d58c", "value": "1536:eP6z4+ADViS8CWoD94pUnQ64x11RiCit5d:APZBiS8jopkUQ64xOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706135, "uuid": "cf1ec7c9-c286-4e02-8115-eb33062263e3", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706135, "uuid": "e46713e1-dc8b-4d5e-b10c-8a4a0b251bbf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706135, "uuid": "591387d9-b1e0-4453-b363-5e132ad82646", "value": "statistic-2065103533.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db26c3b1-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704228, "uuid": "1ea4cb69-18cd-4ed8-9137-5ab5404eb9ca", "comment": "Malware payload", "value": "02010987431f3bc6b7bc694b12a03282", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704228, "uuid": "7f711929-59ef-40d5-ad2d-d3506247c473", "comment": "Malware payload", "value": "02f9baaf12990d2e4f113137f9ab7a27abfb08cc1794b682b4057240736bc95a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704228, "uuid": "187521bb-587d-4152-912e-16056b3ba1e8", "comment": "Malware payload", "value": "932ac88f97c92eb6904355977dd5ceacea0ed2f1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704228, "uuid": "42bfd860-f655-4a8d-b4d6-4056e957d970", "comment": "Malware payload", "value": "544223f5e3e737707bb8b732099383894235f5f37205a0ea3ab7717a2349a10bddab72aba940d87a0e31f0f52a4f43c4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704228, "uuid": "d8a15ffb-fe1a-4610-9618-678dd59f48d3", "value": "FB330229887D772D572D10E08585876EE51B28A93C7DC5425CDCF4AAEC023AE163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704228, "uuid": "95dd32a1-a8a5-46b6-8eae-75d39f22664c", "value": "1536:jP6z4+ADViS8CWoD94pUnQ64x11RiCXPl:TPZBiS8jopkUQ64xpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704228, "uuid": "eb0dd944-0940-48c1-952c-5d3776d1cb42", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704228, "uuid": "bfa55bc8-2cd6-481e-9349-ffa89c0dc284", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704228, "uuid": "7f52ef44-20ac-406d-90f1-715153b6493a", "value": "diagram-610412427.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658b48c2-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707466, "uuid": "621c9885-8056-4478-b87a-a63d063f38f0", "comment": "Malware payload", "value": "2be7bfd3c4e72e8a82546f96e8560739", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707466, "uuid": "a1ebc74c-32ff-4a32-a7fb-9de551c61d8a", "comment": "Malware payload", "value": "03043f4f6e23abf74f5466604bb7e615c8957753efc08277770290bb856e092b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707466, "uuid": "5ef40e8a-a1bd-4ac8-9a6e-5720d05653a0", "comment": "Malware payload", "value": "728bd50bb2e7f4026c54ad5f97cc93cab61fc681", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707466, "uuid": "8de9002d-df70-4539-8ce8-0bd3daf8f648", "comment": "Malware payload", "value": "ff029da3a84d3519c82ffe334a8a479fa60cd3d737b190d89970295ef95ffa054d92de42aa459d3ade120f6f6ed10a24", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707466, "uuid": "dac87c03-6ab6-46c2-8f34-ce0f92448a9c", "value": "DA330116486E762E673D10F0468A870ED653A8DD386EC6011CDCF476EC02AE6263FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707466, "uuid": "9905b9bd-2b5e-4643-9ee4-544d4d9bcc69", "value": "1536:gP6z4+ADViS8CWoD94pUnQ64x11RiCi6Co:WPZBiS8jopkUQ64x46Co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707466, "uuid": "be3fc492-d54d-4f57-b2af-26e7b697aa53", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707466, "uuid": "41f67cb0-61eb-4ca1-82d9-e5a793114f3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707466, "uuid": "39dff151-a190-41b0-9527-8be96e4ee8f2", "value": "statistic-996579355.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1a1d37-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704127, "uuid": "8bfa4f7a-dfd0-422f-b3d4-b7b679e6faba", "comment": "Malware payload", "value": "da77af3c1b160c19f8474a5814a61369", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704127, "uuid": "be159392-ec94-422d-8c8a-7a03c33e3bea", "comment": "Malware payload", "value": "03099cc83c4fa28e4f5f809e3b9ad7ecea047048b6965052ec3c197bcb5a3381", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704127, "uuid": "e39563e6-bac5-4c3e-818d-96102622d772", "comment": "Malware payload", "value": "3a310e68a7172b64ccdd91e2a3c0830748a515ea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704127, "uuid": "7f775ba4-c067-4571-a37a-ae6d73c65b0f", "comment": "Malware payload", "value": "899821a4b58219765684a25dcd36a331ce0782379d163a9a4fcd78bbc579bd1b32cc1fdedb5a4f754efeb115afe0b44c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704127, "uuid": "6f51dae5-f81f-4c9f-81af-8016f1d60680", "value": "8533021A4C6EBA2A173D20F40448CB5ED60758DD38ADCAC11CDCB479EC056A5163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704127, "uuid": "7ecb1ef1-45de-44a9-9838-165d06381951", "value": "1536:3P6z4+ADViS8CWoD94pUnQ64x11RiCEKu:/PZBiS8jopkUQ64xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704127, "uuid": "388a6ba7-b5c6-4e4f-b71c-67b492b6382f", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704127, "uuid": "55572bf8-ed0a-4174-b377-a5b3eb10eca7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704127, "uuid": "9711b778-b09e-4039-8e8e-e72cf02482d8", "value": "diagram-523782335.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc16586-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700799, "uuid": "89b79ae2-8edd-4214-8415-022651dad265", "comment": "Malware payload", "value": "4938af66e76e8781a003b29ab4acb37a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700799, "uuid": "1c5b9f19-28c0-4db7-a058-cd1871fb6846", "comment": "Malware payload", "value": "0310a43e3824254788895f097730fa624472e434fee17979cc7b579f1d2ebd19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700799, "uuid": "0c069218-600a-45d7-bf69-e9c2b13db734", "comment": "Malware payload", "value": "9f8fbf83651e82b5d2040a2d4669e99f00c81ce0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700799, "uuid": "113dc1e9-0faa-42fd-972c-495b433fa917", "comment": "Malware payload", "value": "8cb7faec6b9ec0f4a27f6083e9da192d5a7fb6c23741769924d71ae11f82c585c986061f33359d27be001f2bd07c99fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700799, "uuid": "3e1b2afa-713f-4719-9e8b-a3b89b3ae35d", "value": "F2330188C6C9E331D8F97431BC798B02D478AAAB441BC96581F787E37A06DD0578ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700799, "uuid": "cf599a0e-599d-41c9-ab8e-16096caf5f77", "value": "768:6wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2F:nFugXVpoD8ZxhrLAuNS07MrxrKsYUJ/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700799, "uuid": "0a7727d1-9fbf-4efd-a92b-b8efc07baff0", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700799, "uuid": "c640adf0-fcba-4288-b508-6621db8764c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700799, "uuid": "804cd1a0-5220-4c43-b96c-62355df0b092", "value": "catalog-1833866392.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e34a49-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700506, "uuid": "d9084ee0-bf24-4c58-95f7-592a6968e22d", "comment": "Malware payload", "value": "09677a3bd25c47c4667029db6908e84d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700506, "uuid": "c018547b-0be7-47bb-83b2-560c8e3015f4", "comment": "Malware payload", "value": "031de7fe3bf6f498dfe38d6a82f7412781dda52b7e2ea988f5ab8ac561adc806", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700506, "uuid": "6dfafea1-3de5-4bbf-80a6-97b89dc81e35", "comment": "Malware payload", "value": "5f215556d84cd2cf63145512ab97ecb834879492", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700506, "uuid": "73192f8a-1e56-4164-9857-1cb6bea93842", "comment": "Malware payload", "value": "d7454c50f218a10575b94040df0d76113a760c10a65ea129fc3b9202f7e7fff3dc15b148c15144782707a158ea132680", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700506, "uuid": "afbf87cb-501f-4a36-aa4c-5199206f360f", "value": "C133F188C688E37698F13831AC78CB01D5786ABB4416C56391F74AE77C07DD11B4ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700506, "uuid": "b9dbbeab-c24f-4398-95cd-f674b3a66d3a", "value": "1536:PFugXVpoD8ZxhrLAuNS07MrxrKsY75PbW:Hq41rLZNkZLYdPbW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700506, "uuid": "7f6c10a8-9138-4abc-971c-f8b941407fdd", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700506, "uuid": "bd66e9f8-19b1-4cbb-8750-b88607ceb644", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700506, "uuid": "75ef2049-b746-4807-bd22-5a6bc985f8ca", "value": "catalog-1580137893.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b833101-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658890, "uuid": "e5434985-3e23-47c3-9060-0152a3ccaf94", "comment": "Malware payload (Quakbot)", "value": "88c925abd7ed59ef6ad2bd5e918c7f79", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658890, "uuid": "8f2928d4-119a-4364-94cd-dc95557cb8ab", "comment": "Malware payload (Quakbot)", "value": "03267019e5d537cd04d9ac87ae3f36550500f5b47c45a26cff9d36828919c8da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658890, "uuid": "a08cf9d6-5f04-427d-a21a-6c26a64854ac", "comment": "Malware payload (Quakbot)", "value": "5127ed0381a15074645bf0b109ecb20caf5e88ca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658890, "uuid": "7e7bb84e-e75b-4e4a-bb35-1049aa8cedba", "comment": "Malware payload (Quakbot)", "value": "c11d2c5b4d5fdc10f491b1627ec0da951e7ab9fc5f76e513856e575e2d4acf7f79d1b208975ab085c43a78a9d48464ff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658890, "uuid": "2754204d-8db3-4eef-ac91-72c559980486", "value": "25549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658890, "uuid": "82fe0e11-1600-4685-b684-8b5ef1b3cc6f", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658890, "uuid": "58c3f9bb-eef4-4e01-bbba-6239f5553371", "value": "3072:43FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ9b:Mvv9sMoXBaRmr/dukbvuZ/7fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658890, "uuid": "6865843b-97da-4027-b0d8-70b7b42e8602", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658890, "uuid": "ddec657a-fab5-49bc-82a8-088513ca6c2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658890, "uuid": "0a4898af-1997-441e-9e9b-1c908a365420", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcedaf67-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700365, "uuid": "ed2fc1ac-e01d-4248-92f1-05aa419ab290", "comment": "Malware payload", "value": "721ceb2ea81d0e244bbcc31d4abc21e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700365, "uuid": "6f872f2a-b11c-42c9-8729-4f7a7288126a", "comment": "Malware payload", "value": "0327c2ea61bd6c167ff87a0cc4b86ef4db1ce105945582d609afda37e7250361", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700365, "uuid": "ed041a89-094b-4ee9-9a4f-f9d87b78ce16", "comment": "Malware payload", "value": "7c4cf9ae307ad6b64e65cc5e0131ebab67a5b535", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700365, "uuid": "3255f5ab-c145-4953-b9a1-b48543efda2e", "comment": "Malware payload", "value": "cedb6faacd4ea5b75ce028b536d9e840070af13cdb6bde866ebaa21d6cc062d027777f506f2bdbe2bac4e00c86041a13", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700365, "uuid": "1d5cbaa5-28e9-4367-95ee-f2d55b1e8051", "value": "B1330288C6C8D2B1D4F57830AC7AC701D57CAA6B441BC59181F74AE77907D901B8EECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700365, "uuid": "76eef79d-77f2-4fe2-b126-69257fa7798b", "value": "1536:kFugXVpoD8ZxhrLAuNS07MrxrKsYya6uRc:uq41rLZNkZLYyCRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700365, "uuid": "c9b1798f-334d-4515-9bbd-e1b9a9ad67f8", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700365, "uuid": "f7683f06-5c49-499a-994e-661e077a4397", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700365, "uuid": "e260bce9-fe11-48a9-91d1-84e8f0f95b1b", "value": "catalog-148705156.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a869b29a-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706720, "uuid": "497ec921-8393-47ce-a9ea-02bae118dd10", "comment": "Malware payload", "value": "7b0cc9870afa80198e07ddd80e625845", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706720, "uuid": "29ead534-6c5b-4d2a-86d3-b4ceb25fe253", "comment": "Malware payload", "value": "0333eeb894eeaf6eb8471ada550a363c9f803213f0a1cc38a8eff0d29ca11c90", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706720, "uuid": "4d55c9c4-ca42-41c8-89c1-e02d92200bed", "comment": "Malware payload", "value": "1e3ca453a78547493f8d7351ab34c9067d089f9d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706720, "uuid": "9207d583-a81d-4705-b363-b15d2e06d937", "comment": "Malware payload", "value": "68f816900d504e6fef2efaf030ee1f4228f886a626f005321204e35e2971a59fe586d4adec00cb7cb08942494acb0710", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706720, "uuid": "ae664e70-86bd-4cde-be5c-833c4e965a79", "value": "F333022A48AE7A39573D10B084499B4EE667189D386EC2821CDCF5B6DC017EC163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706720, "uuid": "6448688b-3e2b-49ce-8160-ec996dd59385", "value": "1536:iP6z4+ADViS8CWoD94pUnQ64x11RiCFDPvS:cPZBiS8jopkUQ64xDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706720, "uuid": "5df60971-69de-4199-ae02-b227b9ba2a19", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706720, "uuid": "bdae6a96-2a9d-429f-829f-5dbf40167557", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706720, "uuid": "9a53b071-a44e-4a7e-bf42-37e693d9e72a", "value": "statistic-545253493.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfc7dc7-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707105, "uuid": "1a75ec05-0387-439b-be17-bc3da39c3605", "comment": "Malware payload", "value": "b744089ae0cf39c1f98cc03c3a0b132f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707105, "uuid": "f8025d55-430c-4fa9-9eef-d70f3eb2ce3b", "comment": "Malware payload", "value": "03492d151368e85c5e1b299c3fa083fd80c33d84c801a42c8433a320e6b9d5e5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707105, "uuid": "37d9b03a-2546-4544-b1e4-adfa0c2335ec", "comment": "Malware payload", "value": "f44da86b77c56f1dc27262804e1fb6b75fa04e13", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707105, "uuid": "c4b614ae-45e8-44b0-bf59-07e133b59759", "comment": "Malware payload", "value": "61742b3bb5a0570d6976d43f134e6f52e9bac9a1c9896d1b7b07a1be6d6e25a2f1f77b7751201c8e944cd696503e678a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707105, "uuid": "82a8307b-1fad-4120-a0db-22fb9088ba5c", "value": "FF33022A886EBA29473D20B08549DB0EE657189D386EC6821CDCF1B6DC017EC113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707105, "uuid": "1a2f1de3-d1d9-4334-bb71-f473eb4c84d4", "value": "1536:oP6z4+ADViS8CWoD94pUnQ64x11RiCFhPvx:ePZBiS8jopkUQ64xNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707105, "uuid": "f74ec45a-33b7-4f59-a62e-a80cddcd22a5", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707105, "uuid": "68836141-f895-4583-845c-e11f6c46a3c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707105, "uuid": "22d7dbaa-3486-464b-a50c-8c1d762d43bd", "value": "statistic-757765059.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89068ea5-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702801, "uuid": "53f699d6-5161-4e0e-addc-04587024f2ae", "comment": "Malware payload", "value": "4abb5b2cb67c0c1c2602c5a9db6d16ec", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702801, "uuid": "21b22232-d349-4691-a4fe-e2329418f762", "comment": "Malware payload", "value": "036347f143d28425429704d6fa495e70b7224c82d6142f674033f3998def715e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702801, "uuid": "04b572a4-b3fc-487d-82bb-d33835a12caa", "comment": "Malware payload", "value": "4854ab9794722b28e3370265dacdf753a9a4cd7d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702801, "uuid": "114dc288-fac5-4b3f-b383-aa10bd6749bc", "comment": "Malware payload", "value": "22be3f73a8faa37dafe49a1382e7e70c457b7da286bc37fd05541ba9b11efcf03f3ec8d4351340b568cef377756bfa0f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702801, "uuid": "86c3da6b-2c06-4c80-80e4-23081714b294", "value": "AB33021A896D762D273D10F04689DB4EE15768EE385DC6811CCCF4AAEC026B9163FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702801, "uuid": "90a983dc-acff-410d-98ac-04951b45e1bd", "value": "1536:JP6z4+ADViS8CWoD94pUnQ64x11RiCCsqedb4Q:tPZBiS8jopkUQ64xldb4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702801, "uuid": "b1c5c8dd-a338-4705-ab82-94dd3e6ccfb7", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702801, "uuid": "7a8ed043-8be6-48b1-ad14-88dc9b9f23c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702801, "uuid": "270ffcc9-e9b8-480d-90f0-dc1c32cba49e", "value": "diagram-1463517717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb43861-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701385, "uuid": "ea1cdc22-8a29-498a-b9f2-6ba7e4b1c19e", "comment": "Malware payload", "value": "eb8811cb7882ea4b4a4a547bd4200e1b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701385, "uuid": "2b37438d-d1f2-4d3b-a8e1-22c853ca0c63", "comment": "Malware payload", "value": "036496cc7701f65dc241c94acf9890a165a3517c1d062bfc7433cf04d7eb3d5b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701385, "uuid": "f4d27968-214f-4fd2-b8b8-963d242a4e74", "comment": "Malware payload", "value": "10cc0187f8f74e919720b04017c77e96449b00d7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701385, "uuid": "afe21999-d7f0-45f8-91e8-1dcc339025c4", "comment": "Malware payload", "value": "2d30a79d390c06c094298a4e597b099b05f15fe7b95c37a509ba87c73d181d0bd2bcba9adb45c395236d731a87df63ad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701385, "uuid": "9f93995b-6deb-48b1-a457-fe67af59822b", "value": "A0330184C68CD331A8F57932D839CB02ED78A96B481A8591C2F78AEB7C03D981709DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701385, "uuid": "ba50c175-40e5-42f0-86e2-8df3006ab3cd", "value": "768:MwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2s:hFugXVpoD8ZxhrLAuNS07MrxrKsYxpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701385, "uuid": "6842b8ca-fad4-4ca3-99f6-28341fec6f21", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701385, "uuid": "313494b4-5717-4f4f-b1d7-26d3e724fe7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701385, "uuid": "6266d774-8f25-41ca-8c74-614b8b648a4b", "value": "catalog-347170117.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f56268-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703998, "uuid": "639c5bc4-c930-40e9-a2f8-4ee7502ba27d", "comment": "Malware payload", "value": "d4d0c403e39eebca3cde6c28f4b7e77e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703998, "uuid": "ac80545e-e705-4e6c-88bc-28d8c7cca9c5", "comment": "Malware payload", "value": "036ceca3647bd4a5e517f45f19e675d1cd416fa1d95ab977dbc11a28b7461d6b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703998, "uuid": "d1b97e1e-dd5d-4db5-9f06-1596c9972344", "comment": "Malware payload", "value": "b2bd8642301696d6e2851e6030ab67d2716f1407", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703998, "uuid": "231b5f94-b5c3-43ef-a730-3d6e743b19c7", "comment": "Malware payload", "value": "e6695f90d8881657d6722196700056c40615ca15d223fa985b7833cb41843716246fad2e1d7c79043e6c2b37de9cee63", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703998, "uuid": "c8313c87-8df0-447f-878d-71fa80a79af5", "value": "DA33022A486EB639172E50F08549D72EE21769E9385DC9812CDCF4A7DC066B8013F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703998, "uuid": "fc80b946-6a19-4297-9165-c2c4f6712f0d", "value": "1536:DP6z4+ADViS8CWoD94pUnQ64x11RiC5ei:zPZBiS8jopkUQ64xCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703998, "uuid": "677700aa-02b1-4fdc-a7a1-90ed819b0843", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703998, "uuid": "fcb686e4-9727-4077-a9b6-cef52c7e5344", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703998, "uuid": "ec36bccd-62fe-495b-88f5-ba8bd2ec065e", "value": "diagram-416573235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874e8400-a8da-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1619694209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694209, "uuid": "1563eb54-bcc0-46f1-972b-3e7927d04f66", "comment": "Malware payload (Gozi)", "value": "270b50483d86098a04ea5be9549f3dd0", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694209, "uuid": "fa127cb7-bb13-442f-b167-517c18fbc041", "comment": "Malware payload (Gozi)", "value": "03828dc891a39a7706021812f8ada3ff0c5e79844b6cd03228f57c3506f517c2", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694209, "uuid": "e83c8e4b-d016-4b83-a786-fc46ae694dcb", "comment": "Malware payload (Gozi)", "value": "74704fd015cc1f8026c3beb9711261618ef6349d", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694209, "uuid": "68e07ec3-a898-4fa7-a059-26ed29806684", "comment": "Malware payload (Gozi)", "value": "6c821a077f6e63dedb362cbe56b52cea209e51a338b6ac9de7c81b0cae8cce6798b211f96966ccef2de2492d2534f575", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694209, "uuid": "e29316fa-602b-4331-b07f-3b56a35d822b", "value": "E9244B6AA2E40695E9BBDAB5CD97C62BE7F334041B24D70F03B0CA656F57321F218352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694209, "uuid": "a313cc83-8812-465d-afa7-1915534d43a7", "value": "3072:5WLHqJ4VtWYQUVpsPHQqdPFQ6l7Bz9DHzcUvNfxYAr9fGWg+Bm5kqWDLm:6qO/rsPHN7Q6l7Bz9zhvNJYArg14L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619694209, "uuid": "e09d2479-c075-45fc-8b7a-4afa87999422", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619694209, "uuid": "775201d1-f330-4c82-84b7-8df1d222a37c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694209, "uuid": "09353844-88a9-46a0-97ff-040c3b540e32", "value": "6510000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ad9279-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619734006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734006, "uuid": "79337b6a-7a57-462f-8687-ec60733ae2fe", "comment": "Malware payload", "value": "fb7267fc8dee4dfd2d1d93c84582c6ef", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734006, "uuid": "be6b5c45-d42d-4641-b689-6de8d0bec3ea", "comment": "Malware payload", "value": "03aac919e4cefc8157cf9842047997e717eb2537ee3748f16ad79efe70087b5f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734006, "uuid": "ff40cc5c-a15d-499b-b5a7-377d66d077a8", "comment": "Malware payload", "value": "55c5245bbaf2df016e785d5e52212ce5f34da39c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734006, "uuid": "d9f49b32-5536-4635-a3e5-3898fd4f6b1d", "comment": "Malware payload", "value": "1a119a2203781eaed918493fb6a0a63795af7fce41a4544f1b2080870d6daf9d81b93232ff53303ee79e26f09a8f2ee0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734006, "uuid": "51712906-a51d-4f70-91c6-575bf9e49a13", "value": "11F3CF82D702C1ADFE212C7A28E677753D5837905E54CA69E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734006, "uuid": "0b905e3b-4672-46b3-a848-12c97902da51", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734006, "uuid": "97f90547-f72a-4b4a-abd7-bc1ca88790d1", "value": "3072:GJ5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh89H6:o52j4pk5zMbVO6/HUIXU8KgMy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619734006, "uuid": "d8ff50e1-3a07-4450-8035-3c165fa288e9", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619734006, "uuid": "a2b450eb-7633-4755-8392-30f220166b43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734006, "uuid": "4537fc0e-182b-43d8-b757-307fb5708145", "value": "fb7267fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e46211f-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658894, "uuid": "6bebef77-3185-4725-a6a4-9377e2e9d519", "comment": "Malware payload (QuakBot)", "value": "a1153274a5cf3bea3000374830ea7d58", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658894, "uuid": "c1e76440-bb5d-4633-b995-10d2c1eb6e34", "comment": "Malware payload (QuakBot)", "value": "03ac5c08244fe6334249c5ecf3d2ac191d00909596e0b6b28e84c629bb389148", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658894, "uuid": "79b2ff48-5ce2-4611-b272-11f12a59ba97", "comment": "Malware payload (QuakBot)", "value": "e2846436a663882040baea2a14d5563bc6670858", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658894, "uuid": "448b87dd-7555-46a1-8818-e908c217721a", "comment": "Malware payload (QuakBot)", "value": "f78fd896fdd0fc6d28ae8b251033473459ca5bd731154b094d43847cbc2235a9494baed1910d5621015f43ef0a3f08e5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658894, "uuid": "ca630d52-910d-46bd-9734-9c52c4230608", "value": "D9549E7AFA12DC02E7A82BF023C36F581A579AD53120251B55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658894, "uuid": "e2af5aaa-0481-405f-8c72-49428953c437", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658894, "uuid": "2626f7a5-9fef-4f4a-9533-d6bc5606d22d", "value": "3072:o3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZmC:cvv9sMoXBaRmr/dukbvuZ/7fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658894, "uuid": "19205aff-b2b8-4a6e-a28c-cf821f79dbf1", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658894, "uuid": "242b8aae-9448-4d39-8d7d-fff5fe712cf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658894, "uuid": "e16a3541-549e-4826-a5c3-89ed350be9de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510a1f53-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658899, "uuid": "2a78ddf1-586f-4ced-81d6-746e1caa0eb9", "comment": "Malware payload (QuakBot)", "value": "ef16ccecdeddb77e2c8141108ec6a84a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658899, "uuid": "d4fa972b-edd9-4e83-9f52-461075475374", "comment": "Malware payload (QuakBot)", "value": "03adacacf625cf4470895e68679d99f72eb95ce3bbeb4861140c14b8c3437264", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658899, "uuid": "912679a4-cb33-49b1-a300-7ae141999278", "comment": "Malware payload (QuakBot)", "value": "c003acf52a5cf3851a8460061c43c1d7c2f07ea7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658899, "uuid": "cc4dffdc-658f-4664-a586-282e80a8f05b", "comment": "Malware payload (QuakBot)", "value": "590ee5f21935302812948b00d1c0de2aa9c5575531ddecced37134b961de4ccafae158b4266e2eb253daaece641793bc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658899, "uuid": "959205a3-d10d-4f63-a540-3c3b123cb3a8", "value": "53549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251A55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658899, "uuid": "0ff36192-c9ff-4590-83cd-dbda9b031d0f", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658899, "uuid": "c59a9cbe-ab58-4bf9-a823-f7db7541ff2c", "value": "3072:c3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZl9:gvv9sMoXBaRmr/dukbvuZ/7ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658899, "uuid": "80a8c6ec-b293-412b-9d84-5ee25669fd3d", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658899, "uuid": "04e55941-12c7-4360-a34a-d94ec5b824eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658899, "uuid": "5222bbd6-e98c-42c1-9db4-65be6c7ffeb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fc156b-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705613, "uuid": "c54e8b97-3060-4611-95b0-249e65c14372", "comment": "Malware payload", "value": "d5996d8b5c9f70fdebe62ae7158bc249", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705613, "uuid": "db3c2a3b-a2e5-4d24-907b-9c515c55bf90", "comment": "Malware payload", "value": "03b3a554e8b8639b853627f091313f078a607703d37bdb4b0a3191916dc54ba9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705613, "uuid": "243d901e-f21a-4961-9946-f4cb87a02a89", "comment": "Malware payload", "value": "7fc9e7152077992bbffc6e2c74a843cc7766fabc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705613, "uuid": "18778e6d-5b8a-4189-bdf1-debd76023630", "comment": "Malware payload", "value": "329f213789354d10b972f0a2ec0cfec63ce6aa0e7ebaeb148289fa4fe5e689ea31bd866d5cd6be97057e5fa5ac8b5d2b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705613, "uuid": "1b1d8b86-10ee-422d-abfe-eda816654a6e", "value": "6033022A98AEB629473D10B08449DB4EE657189D386EC2821CDCF5B6DC017EC163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705613, "uuid": "6ff7dc50-7542-4dfa-8186-6545f619ab57", "value": "1536:xP6z4+ADViS8CWoD94pUnQ64x11RiCF0Pvf:1PZBiS8jopkUQ64xsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705613, "uuid": "4aecb8c0-20e9-4cdd-b556-a6c5525a6ac7", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705613, "uuid": "15b7ca37-5e8a-4876-b4b7-34c34d12a228", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705613, "uuid": "09319ceb-c79c-4454-acb2-02114e54801f", "value": "statistic-1632356698.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54243f2b-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658904, "uuid": "c55f96bf-0750-4029-a9d1-9166993d702e", "comment": "Malware payload (Quakbot)", "value": "aa7108750fbb9346a104eeed47ecc7ec", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658904, "uuid": "992dbaee-7958-4391-a1a8-7b81d558d3f8", "comment": "Malware payload (Quakbot)", "value": "03bb136446097ff6f97fd58abe598f28f95b7cd2f341405d74d55e81c468fd15", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658904, "uuid": "39aced91-9db0-4f8c-bdc8-3182891ef1e3", "comment": "Malware payload (Quakbot)", "value": "65ce9f629241a61031fdbb2d2b054f14096a60bd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658904, "uuid": "2c161db0-9dba-45d9-9b8b-37eec7677484", "comment": "Malware payload (Quakbot)", "value": "dcbed12a692b777b5eed4108bbbf7c451adf55f4e690cba5c9d2f1346fd00cefdf2115db3c9cbb1bf5819bf71c5e9cc7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658904, "uuid": "606c337b-97ea-4c50-bcc3-8d541db3e69e", "value": "D874C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658904, "uuid": "eb5f6f42-4b11-4761-bf3b-ccf13b73d081", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658904, "uuid": "84d27274-4457-42a4-b2c6-6359575297ee", "value": "6144:pTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRub:pbi7/xZrkNK11G9AQyOi6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658904, "uuid": "5199b6fa-5f5a-4c66-a26e-164c32cb0a4c", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658904, "uuid": "3a647e9a-051a-4200-9c4e-e9d99989ff36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658904, "uuid": "75943710-2854-4523-8ebb-9ca05980607c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d157d7-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707039, "uuid": "3260c271-da26-4355-bed7-22d0f50613bd", "comment": "Malware payload", "value": "d0ce74a322aa8bd26de2e2e0814821a5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707039, "uuid": "dd28fabb-905f-4228-b0d3-22fbc6655e2d", "comment": "Malware payload", "value": "03c98c328d7bd7d89abfdf2c9af9ec334d5613698829fa13cc501f6324712538", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707039, "uuid": "dba9430c-4192-45ee-b92a-03b1b64cde5b", "comment": "Malware payload", "value": "705cbfdf6ce5dcd77dc396f2b130c84c008b0d05", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707039, "uuid": "7aefd4ab-b1f0-49b5-a4fc-9813cc3a71a5", "comment": "Malware payload", "value": "c1c5b61ffc73a9c824e3626e87e8d108cb1e4c3b72cd8c001d3fe01b8c77a89b061fd45893f90e5804e7d2b1be1b0f4b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707039, "uuid": "aed599f4-a595-4289-806b-9ac13a4b61f5", "value": "49330116886E762E673D10F04686870ED55398DD386DC6051CDCF466EC02AE6267FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707039, "uuid": "457943f4-a9c5-4a7a-a2c2-6b54e215e31a", "value": "1536:KP6z4+ADViS8CWoD94pUnQ64x11RiCilOe:EPZBiS8jopkUQ64x4lOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707039, "uuid": "be4f2c3f-f286-43c2-b944-92227388950f", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707039, "uuid": "d714916a-4205-415c-b291-1b243c1b4a4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707039, "uuid": "09be842c-24b7-4a39-88d2-8aa22216e8ae", "value": "statistic-699773391.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56eb41b6-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658909, "uuid": "79727afb-9860-4b28-9dde-e9124becf5c0", "comment": "Malware payload (QuakBot)", "value": "b011337a4c948c0e442bcea6e1f514db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658909, "uuid": "c5f3bfe2-f6ad-48c1-9c9f-d8806ca6eef2", "comment": "Malware payload (QuakBot)", "value": "03cc9dc66976a67c2ec65d92f0e77ac0d2490c73e382851c9edf7121af094fe8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658909, "uuid": "7a95ce2c-8dbd-4d97-abfd-3a821b20beb0", "comment": "Malware payload (QuakBot)", "value": "759cac8bbfcfe4644a8ef62295eb97a3094baec1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658909, "uuid": "cba46ab6-54eb-47a7-ba5d-08da027a5a89", "comment": "Malware payload (QuakBot)", "value": "529e67e0e3a722fe6d970233c6527d6ddb5e8e2591866f17819d5dba4e57d96ed7444b67ee474522ab781765a7b35c39", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658909, "uuid": "b71144f6-f1d7-4a67-9b8c-786ffe75f315", "value": "D874BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658909, "uuid": "6cc54dc8-6a5f-459a-a2df-f97fe3ac6cc8", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658909, "uuid": "ef4f038f-f300-4852-b9f0-53a5e740ea58", "value": "6144:7Tfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRu+:7bi7/xZrkNK11G9AQyOi6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658909, "uuid": "17164547-00a8-4bcb-9dc7-2d94154b6456", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658909, "uuid": "4633f4fb-19ef-48bb-8885-cd811a43b63c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658909, "uuid": "7c33abf2-8a91-4c01-b03c-9b461a3bbe6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584d5f74-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701861, "uuid": "e65ff204-5204-4c1d-8595-779260f10708", "comment": "Malware payload", "value": "b99b861c483d82e2b2ca93645a9e782c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701861, "uuid": "d4c643c2-41f6-4fc7-bb20-33f87b9deb70", "comment": "Malware payload", "value": "03d010ac02d26cd626eb974bf63328effe7972fdeb428d9e6221f0fdc4d94e73", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701861, "uuid": "c714dc63-5e03-44cf-8f61-4ed23178b858", "comment": "Malware payload", "value": "af81aabb8e90f1043da077483393e85b942fd6d4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701861, "uuid": "f0d163be-ada5-444d-b630-7da304f179c7", "comment": "Malware payload", "value": "2423fb35081e50e5ea091e5316e5ca5459dc8f08be7b04fd94794ec82bba811792aa6c86ce111479b1af1fdbbefa5051", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701861, "uuid": "0496fdba-def7-4470-ad96-72a1fe9f8339", "value": "7333F288C68CD271D4F574349C798B02EA78ED6F4816C9A281F78AA77D07DD12B4A9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701861, "uuid": "5a20c001-5973-4cd6-9384-0365a41abd26", "value": "768:+wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2E:zFugXVpoD8ZxhrLAuNS07MrxrKsYFt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701861, "uuid": "194fef36-e092-465c-8d16-6dc5e5e37df0", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701861, "uuid": "81d8ee09-6cdc-4fec-baed-4ac0a76fe2be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701861, "uuid": "2af231a5-185e-40fd-8ec9-c98042196483", "value": "catalog-727830216.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b58b29e-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700228, "uuid": "8e2e475f-fda8-445a-aa32-b215a79ce268", "comment": "Malware payload", "value": "62142f5409f7082e6a9ff5d8d6527251", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700228, "uuid": "089fabe1-2213-4d8b-abd3-0a2d2b16aa3d", "comment": "Malware payload", "value": "03d497471f7aba5f21aadb5af14799c2c6c3edc8de5b9a106e5392ca4f6e3e70", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700228, "uuid": "9ef06d69-d8d2-45ba-bab8-c8218f9e16e7", "comment": "Malware payload", "value": "d96f20fef6387d0ed5e0f3a5bee40198de860861", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700228, "uuid": "afdaad3f-37aa-4f98-93c7-ec050613daac", "comment": "Malware payload", "value": "8181668f2dbf642012262de4ac890251724fa0958b5eec2b4a46f4743fa052887843bf3bde0c04cbf6629d97d714e298", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700228, "uuid": "52597ab8-0abf-4c57-88c0-7141e2eb5ee7", "value": "22330184C68CD371E8F579329839CB01ED78A96B481B8591C2F78AEB7D03E981709DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700228, "uuid": "5045467c-7a79-4fb7-89e1-b983d7c02f68", "value": "768:wwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2b:NFugXVpoD8ZxhrLAuNS07MrxrKsYx+l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700228, "uuid": "a48aacda-e12e-4a69-a52f-7ae3fdce8064", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700228, "uuid": "169ba928-0ace-4c5f-b0af-f9bed554f0ea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700228, "uuid": "f02c60f5-02c0-4abb-964b-d439b92068a6", "value": "catalog-1376472932.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501249c0-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704853, "uuid": "b89ca841-1a86-4893-823e-983f141080a0", "comment": "Malware payload", "value": "855e6adadd1e6aa568f247489418591e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704853, "uuid": "d6154b67-5096-493e-9649-56722fac3b10", "comment": "Malware payload", "value": "03db054b55a4f222e59a2bf34ffa2fef5c0238edac44daa6b7838ec175d7daf4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704853, "uuid": "cb658479-1574-441c-8626-021b8a2bd13d", "comment": "Malware payload", "value": "1e1be81ffe3b24290a20aa379b03387afce8164e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704853, "uuid": "82697070-934b-44cf-9697-d8494150d348", "comment": "Malware payload", "value": "75a19bbdded319ca310bc11777f51c93b927f98de5109e53f69d901f7d63010258e7249413c3e6ca95ceb3dd3a98a0f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704853, "uuid": "2fb9cb36-84b6-4faa-80d6-a131b14e338a", "value": "F933F116486E762D673D10F08689870ED653A8DD386DC6011CDCF876EC02AE6267FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704853, "uuid": "bbce720e-0c0e-463a-85ac-4e657564435e", "value": "1536:qP6z4+ADViS8CWoD94pUnQ64x11RiCi6mv:kPZBiS8jopkUQ64x46mv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704853, "uuid": "b42019fc-df87-492d-98c4-b333da96d235", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704853, "uuid": "08d474ab-ef0e-4175-a0a1-ac5b7e1ba0b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704853, "uuid": "f8ff008d-92ae-4ba0-b81a-449293e24702", "value": "statistic-100276861.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52735299-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619701851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701851, "uuid": "e916ac54-56a9-4280-81bb-a0e99de5566c", "comment": "Malware payload (Loki)", "value": "6293b2f51ac52c926cfc5f87775a21fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701851, "uuid": "11966789-7617-43f1-a63a-832f5f3c6a5e", "comment": "Malware payload (Loki)", "value": "03ddd7fbc456dfe2408a00727347e029a2b2ad6bd870ff10c324d94baf57dcfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701851, "uuid": "a2a7572f-6606-4e0c-9aaf-60b21f2e18c3", "comment": "Malware payload (Loki)", "value": "bc52e54bd48c04ddba2174b4130e035bd6068b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701851, "uuid": "542755b4-9bce-40ec-a704-bcad4eff074f", "comment": "Malware payload (Loki)", "value": "4b97545363fe14efbac16f8dcd605951bedc37b08b361097d96ec8046d0b53f1f21f5767f647028c40d8aa3a00057dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701851, "uuid": "62aac0c2-5480-4b43-b869-d8b083818ac5", "value": "E3F46A00A3ECA626D5EE3BB4B9702B0147F5FC06B576D74F99C8B5A99873B404C50BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701851, "uuid": "cd9fe2dc-6bc5-4647-9b2b-57269d025bf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701851, "uuid": "1b573e51-5274-45b1-8901-cdecf77d87fc", "value": "6144:ripTbO2NEi6x2+tSm2Tt05oAj6PNsp0RhXYh6vAHXLsHsDKNdRtqP0WXq+aLlBuU:rl2wxDtD2BAjrarTo7skY2XqzB3jn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701851, "uuid": "f4df35a4-2c49-4a20-8d9b-9f513dbcf4d7", "value": 731960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701851, "uuid": "3b7e8dd6-a719-4aef-bc5d-36ee333ccce1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701851, "uuid": "b48645a0-7bcc-408f-ae06-d60acb03ca23", "value": "IMG10365070501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c255dc3-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701813, "uuid": "145616b4-194e-4578-a7ac-5fe132c3e4bd", "comment": "Malware payload", "value": "c0305b6e77ca37a9455e545b20eb7228", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701813, "uuid": "8a266493-962d-419c-ac84-ba02e45b8ba9", "comment": "Malware payload", "value": "03e04c151e8622e2d72b79d00037d4553ce958acdf181cd567e88736aa678b9d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701813, "uuid": "971a5fb6-715e-494d-b1b8-1071b195823d", "comment": "Malware payload", "value": "72a07e808a17d4bd2701a462e55f6b77aa9e5e06", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701813, "uuid": "ff29615b-a9fc-410c-b8a3-d5c7edd31429", "comment": "Malware payload", "value": "a10df3321a09e281e6ae828a524e11f5239e5318f550a52f3223d4218172cb0dd1d62fb9fa023c373dc455449a65a135", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701813, "uuid": "7fa71924-9602-4806-867b-3d9cf0bb71cc", "value": "D233F188C6C8D332E4F57535AC79CB01D97869AF081B85A280F78ADB7D07E85574ACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701813, "uuid": "6e4c3c68-51cb-4902-b551-e22649442b9d", "value": "768:LwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2J:KFugXVpoD8ZxhrLAuNS07MrxrKsYfI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701813, "uuid": "7797e9d3-020e-48ad-ba4c-76cc1d6c2181", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701813, "uuid": "15af5b2d-8c2b-4e17-a4a0-19ee3c543308", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701813, "uuid": "5ec81049-bccd-4836-b9de-0a25fc15f0b7", "value": "catalog-686947101.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274b3a31-a8cc-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619688035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619688035, "uuid": "ca9509d1-8e4a-4a9b-aa8b-6903a73fc877", "comment": "Malware payload", "value": "aafef02a2b272d2f2125d1852c2e4354", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619688035, "uuid": "765b189f-a8f1-42e9-8911-69b8426c687a", "comment": "Malware payload", "value": "03e0cb615ac1634c84a2aa5c8d00db6e96877d40b38f915bb0fe2ccda854e77b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619688035, "uuid": "1fb584fd-7a23-4958-8e57-5101808b75c1", "comment": "Malware payload", "value": "a404e8dbc61a9ac66e3696e38ee52f978e59a828", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619688035, "uuid": "72ae559f-30cb-405d-a153-bfd1ddcbdeb1", "comment": "Malware payload", "value": "1ef8a83f9f3680be659998851a788853f886ce4f8d517c82f831025cb1a24f4ca87a9aae4a40889fadfe7d473051001d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619688035, "uuid": "433947ef-052d-488d-b629-944e243b4738", "value": "A9530227CEBDBD454398F63C5612D2714AA55322E2F480629D6E3C478383E26BF424DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619688035, "uuid": "1e3c8c07-f32b-47e3-a000-adca6c591416", "value": "1536:y7fKBZQBdBJVf/dC0ZaZas++WUE6570Aggn052BH5Z:yQZQtFhZa8s++3L065Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619688035, "uuid": "f20d75f2-0f4e-4610-b1c1-09e6dfb45756", "value": 63155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619688035, "uuid": "0faca968-4164-445d-9ada-b5fd803368a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619688035, "uuid": "63761920-38f1-45c1-844e-6d6069b0e5d4", "value": "aafef02a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602511e9-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705739, "uuid": "32fae6f2-6011-45b9-b238-62bcae65cb36", "comment": "Malware payload", "value": "ef5ba98bf42970dd84c3861d4b64b51e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705739, "uuid": "ec46f648-7002-412d-85e8-61b62e7e2824", "comment": "Malware payload", "value": "03eb5263e11139390a6be7b6503b41a9b59cd91d316d69cc5ec81adaae891b8f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705739, "uuid": "b0874b86-3b52-41a6-9c37-7947fbc55816", "comment": "Malware payload", "value": "66e5a3f73bad3c4951a2dd8881fa8b6d14ee6c5e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705739, "uuid": "a94882c6-489e-4da6-9ef2-8bf8f3558732", "comment": "Malware payload", "value": "dfa8a4d4a3df441b362020b36b3eb52e7a51252f5b71e7666421db580a59456fdcb0d165f6fdc7467209892f0226d2b3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705739, "uuid": "03c70608-c756-4019-8879-3d9d1a78f5f3", "value": "0433122D896E7A29177D10F88588DB4EE55768A93C2DC6821CDCF428EC05BE9513FB3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705739, "uuid": "f1bfc6cd-b70b-4212-908a-74e8640a5307", "value": "768:49cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCo:5P6z4+ADViS8CWoD94pUnQ64x11RiCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705739, "uuid": "119f5fc3-28ec-4710-97f5-857d2480265b", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705739, "uuid": "54761d10-bac3-4cf6-89a1-ee30b5996d37", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705739, "uuid": "fb91ed02-a1eb-4cbe-a531-dfe263aad34d", "value": "statistic-1738845948.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b301e4-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658913, "uuid": "6fd1b2dd-16ed-427f-9784-8bc9349d11ef", "comment": "Malware payload (Quakbot)", "value": "d06601fbd5dd1b38a6c135eab3c01462", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658913, "uuid": "83da02c7-843f-4cdd-9b5f-c389115e5dab", "comment": "Malware payload (Quakbot)", "value": "03eedeaced4c8d9a72efd1320869a7f1539e0a36fa20c888a089cc77197e60ec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658913, "uuid": "21b91f53-8b1a-4395-8b90-d22f41c83519", "comment": "Malware payload (Quakbot)", "value": "c01b9c089e4b49bcf26f99fd70df306bb5523eaa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658913, "uuid": "90930fc7-520b-4c7a-8ff8-3dfb050227f6", "comment": "Malware payload (Quakbot)", "value": "ad3f2a2a21503e812f1a60412fbaa0f52e868a623b7639368bd370855720ec228b95b35b580460cba0043fd9979c0fe2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658913, "uuid": "d53b18f0-2afc-42c9-a2c3-2a5361438fc3", "value": "0C74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658913, "uuid": "6a412ab3-e113-4ffc-b06f-6906eebf9f1d", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658913, "uuid": "404c267b-0e14-4faa-a8f4-b7cab7a21a72", "value": "6144:unQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuo:RFrkNK11G9AEtMxQyOi6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658913, "uuid": "988ba363-ce10-4b79-8d71-f7b74866615e", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658913, "uuid": "c2f36c42-c061-468d-b1c6-3053be379225", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658913, "uuid": "8ad7facb-2efb-4339-8854-6679b421d843", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51085954-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700131, "uuid": "983a9d12-cf13-49c8-a2e2-f4b96e07646e", "comment": "Malware payload", "value": "31a24e6866f07190479cc83a119ffc83", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700131, "uuid": "481408ff-ca10-4087-9016-e961293c40fc", "comment": "Malware payload", "value": "03f0cfeb2ebd07d26f79d41f13d0ab35b7917ccb4487efa7889911d6e82b772d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700131, "uuid": "1fded1df-4b34-4edd-8a59-bb652faeb627", "comment": "Malware payload", "value": "dc77bb00f4dbc0659f708a30572c1cf59b240fdc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700131, "uuid": "54e9fd42-2d9e-498f-a568-72975be9f523", "comment": "Malware payload", "value": "74eda0676b365fb36e932960cb94b5ab010ee75e0526bcf0c261750f3617c835fa6a17c95fadf71d4a10c8d80b295f76", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700131, "uuid": "a9149a1a-bf22-46ac-b2da-81aa22fe41f9", "value": "53330188D688D332A0F67531AC78CB02C578AAAB0416C576C2F386DBB907DE5570A9CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700131, "uuid": "7ec17bcf-45e6-4f3a-9337-135acbfb2553", "value": "768:+wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV22:zFugXVpoD8ZxhrLAuNS07MrxrKsY59xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700131, "uuid": "dddc0134-655d-4689-9baf-96108e1bc7fe", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700131, "uuid": "542df7b5-43c8-4766-ac46-4a84b8512325", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700131, "uuid": "6cc80072-7f14-4673-a37c-227cdb4b0baf", "value": "catalog-1300107068.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ec45ed-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699812, "uuid": "77afd605-a263-460b-acc2-1b212a05add6", "comment": "Malware payload", "value": "336bd1ff5bccd7165e25abdde7bdfa59", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699812, "uuid": "356f5efc-19e7-4252-bd22-7a99119fd891", "comment": "Malware payload", "value": "03f3613061d647103bd50c5908f0becedf850fbd62641c414683ee49d78ba56a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699812, "uuid": "dfc42740-03ad-4bee-9902-e5f228186628", "comment": "Malware payload", "value": "896a32e607e51b5ea0de07404d5984503f7a5a11", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699812, "uuid": "06b190aa-6834-4c8f-8f4c-d49e0cc687c3", "comment": "Malware payload", "value": "93cd46668a2fddd743d2994d4f1448f59a14b7e4e556d425b868c67c4258cdd704905a3d9b67d501e3dc5f29029a17a6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699812, "uuid": "f24911bf-e793-4dd7-8397-e43ca7ac3261", "value": "72330288C6CDE271E4F634716C79CA01DA68B56B541BD46182F38BEB7C03E95174ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699812, "uuid": "6b39ed41-ed4a-4cb4-b838-c5254beeae6b", "value": "768:rwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2n:qFugXVpoD8ZxhrLAuNS07MrxrKsY+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699812, "uuid": "6605da24-b39e-4e37-a0ce-919db627f741", "value": 51498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699812, "uuid": "1d6e8b91-fe6c-44a2-bd20-437214468728", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699812, "uuid": "6f2d6753-63ac-4210-9e88-fa5921b4fbd3", "value": "catalog-1051219531.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7b294e-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658918, "uuid": "a98b041e-3a72-43de-b116-9cafebb4a28f", "comment": "Malware payload (QuakBot)", "value": "34ce64c5cc4cab628fd9ac094001d12e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658918, "uuid": "e3fc3b32-73c4-49c3-aec4-cc1447a6b7d1", "comment": "Malware payload (QuakBot)", "value": "0400e0755ae77103e6064e2739de1bd36f8217c478f9e046ebd6b1c3b89aa4bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658918, "uuid": "4c80c47a-fa39-4fe7-8105-731f5a5de68c", "comment": "Malware payload (QuakBot)", "value": "c037288ca75eca4c2944bc67637b174171ca1f9b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658918, "uuid": "b8de31ac-818e-4ccc-8611-4fc86454a0f0", "comment": "Malware payload (QuakBot)", "value": "818611dd97361330d0252ef92f69444a563406e0d89a3d63542d342be7e8a9fcdfc7bfc22ad1cfd6168250a88b505e8f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658918, "uuid": "109482db-24c2-493f-93d2-0756b8a0d043", "value": "CA549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251A55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658918, "uuid": "5317468a-a36d-4c43-b3a8-f332f390e662", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658918, "uuid": "6d3c97d7-bdce-463c-8137-7b708e530e08", "value": "3072:R3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZTq:hvv9sMoXBaRmr/dukbvuZ/7f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658918, "uuid": "f10abb45-3ea2-4365-9ae5-018552c61562", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658918, "uuid": "d899e3ac-e7a2-45f0-94d3-ea1c51d9ad69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658918, "uuid": "3b53a667-de40-4f0a-94f0-54b81e0c65d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5295fa-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658923, "uuid": "5e3f0f6e-8b3c-4376-a4b2-8aad55db8505", "comment": "Malware payload (QuakBot)", "value": "d7b00bb0882e079b52eb074a50aff04d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658923, "uuid": "34c11b57-082f-4768-981b-a3f115cbc7ec", "comment": "Malware payload (QuakBot)", "value": "041bd1a4009331471a264d95ebb755448abc764d53ba3dd361775bd55d5f0c80", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658923, "uuid": "0aac439b-2079-41e0-85e6-28d1d549fb78", "comment": "Malware payload (QuakBot)", "value": "34249f3574fafb7103a8f9fa9fb3c3910a96bbc7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658923, "uuid": "bafefc59-e3e0-4c49-8a63-450afdcaff4d", "comment": "Malware payload (QuakBot)", "value": "7da571b83c5bb9b8a71d2f9d7aa3612dfa6c45d3dda4f96a334a6080cef27ef59ddf0f95743d18d239461aff7bf9d10e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658923, "uuid": "e4e2343e-eab8-44ed-a4cd-0d932d57b8d2", "value": "FE549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658923, "uuid": "0a89b353-5b00-44a4-ab2d-eb0ae1075fd4", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658923, "uuid": "64210417-6a0f-4ef1-9ba0-14bd5653370e", "value": "3072:k3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZU/:Ivv9sMoXBaRmr/dukbvuZ/7fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658923, "uuid": "a0b3821b-e60f-4f81-8c24-963a545ee1e0", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658923, "uuid": "18e01bf6-58cc-4e21-ab3f-bd5941b3ee26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658923, "uuid": "e8b78881-f224-4d06-a823-1467ff8388aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d8325b-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703947, "uuid": "f5c7bdc6-a7d7-4752-ad85-f38399635a19", "comment": "Malware payload", "value": "fecab681c6b299cf7b15007704e4a5c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703947, "uuid": "0dd3c0fb-13a5-4a86-82e5-d6db1d0c9c88", "comment": "Malware payload", "value": "041fe5a153cfbcbaf04123a065ee36dfce9528cabd1415d428a4f036b9ab16f3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703947, "uuid": "38d759b6-7b07-4b67-8e38-f8aab21d0e42", "comment": "Malware payload", "value": "ac10fcbe2b009645142564f03683a1840459bce1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703947, "uuid": "95b62eb0-4454-4f62-b8d0-6909c6a0709b", "comment": "Malware payload", "value": "b7fd4b3e3b44829fd4a0344252fd204769d496b917b30a0f21893d10763f72559c47c92fd18ae286729aff7bf84da5da", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703947, "uuid": "1c549a2d-a5f0-47ea-88cf-e3363caaa224", "value": "833302199C9E7F2E173E10E085899B1EE507589E3C6DC5C92C8CF4A6EC046A9127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703947, "uuid": "bc713da4-283b-4645-909a-f6de04574f18", "value": "768:a9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCQuv:DP6z4+ADViS8CWoD94pUnQ64x11RiCvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703947, "uuid": "97b537c5-b266-4a81-a61a-f65223918f2b", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703947, "uuid": "1874a842-c2b4-4cca-9954-793b5edee151", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703947, "uuid": "e80d2c05-314c-4c4f-ad46-d789c3b02598", "value": "diagram-360475135.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a6a962-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704410, "uuid": "ecddccf5-a951-4a1a-a060-cad97ca6f636", "comment": "Malware payload", "value": "a60446ff01a840b6d5cc503aa24b9869", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704410, "uuid": "e72f45ab-5312-466b-ad72-d5dd2bb611de", "comment": "Malware payload", "value": "0425cb1884746df42c901873c16fe2e4817bcc75b26efc1dfb16bce79fd668d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704410, "uuid": "c9f4e694-add5-4570-8082-3eb4ee8ddf39", "comment": "Malware payload", "value": "2fddacbc992c37ddf89a3064ed3ea948d6c0f8eb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704410, "uuid": "21b2d73f-2020-4531-ae6c-4ce2b5ac6ee0", "comment": "Malware payload", "value": "dfe0245741ceaa5610a20b64edff9a51fa22f4326fc6984d87bec02f1c26c552efd23a6134bb02e826774419c41317b7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704410, "uuid": "d7727b4e-57ee-458f-9393-a6d404770f26", "value": "6D33022A8C7E7A2C532E10F14986DB5DDA0B6C99382DC545689CF0ADEC067E9013FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704410, "uuid": "5926ca0f-c8c3-4c4b-88f3-034e659dfc0c", "value": "1536:oP6z4+ADViS8CWoD94pUnQ64x11RiCq29:ePZBiS8jopkUQ64xP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704410, "uuid": "65fb4bd3-421e-44df-a5e1-e2398a07c8e9", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704410, "uuid": "9abdcf80-0952-47dd-a079-d86082243f18", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704410, "uuid": "0f7ac3fc-80e3-4f11-b791-11d59c466bce", "value": "diagram-731248675.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d83116-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704969, "uuid": "19ee782d-1d51-41ef-a67a-50b833914bed", "comment": "Malware payload", "value": "4a55d9f39a6045442a1d4c77673438ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704969, "uuid": "c97e38da-0fd8-454b-8b1a-14874d853d82", "comment": "Malware payload", "value": "04340743dd98f1fc3cd73a325f1dc36a566137fe633ee9506d9121a080e2a299", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704969, "uuid": "35366d01-bcf7-4fa4-8fe0-ddd07e62eea4", "comment": "Malware payload", "value": "3d206400e75722ea57288c92d09188bf1f0bca40", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704969, "uuid": "d38d85ed-c0d1-42ec-8c51-06ef197afd95", "comment": "Malware payload", "value": "e9f274c5fd1c26e769a9d37b954a6bf78785e49626341daeefc4919f6f108d4ced6a4cb361e833845dbc10926b6a5116", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704969, "uuid": "9260a402-8661-40c4-8bcf-905727692d32", "value": "D433023A597E7A25133D20F085489B5EE25375E9386DC9C2189CB462FC0A7E9113F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704969, "uuid": "d0bd1d3f-4110-4c1e-9636-76aa88ccbf29", "value": "768:P9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCIFr:6P6z4+ADViS8CWoD94pUnQ64x11RiCIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704969, "uuid": "01d2aca6-51eb-4be8-a37a-6b70b6d1af02", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704969, "uuid": "5ae9ab75-1b06-49ce-9986-eb107372af8a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704969, "uuid": "0b71df58-4817-4a45-98aa-0c6e7777c2f2", "value": "statistic-1095181383.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623df8c3-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658928, "uuid": "3594561b-120d-4bce-a852-cf60119cd020", "comment": "Malware payload (QuakBot)", "value": "e8f5bd047536644aa275dbc1eafdb4e5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658928, "uuid": "bf19f8d1-d3e4-4adb-b3fa-fa0678fdc9f8", "comment": "Malware payload (QuakBot)", "value": "04351628d7abcf843899ca94167d9e39194a599759ee22adaa1735b3d1cab504", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658928, "uuid": "a76c4eec-4e16-4002-bea6-a0c6cd83ddea", "comment": "Malware payload (QuakBot)", "value": "6138ff375587674de81284b6feefb9f3689dab17", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658928, "uuid": "b9ed843b-50ea-4d54-b9d0-8624ea7bb023", "comment": "Malware payload (QuakBot)", "value": "d37f7e95be0cf1e4946b82601cd4d7c04eaa28483dce95ea53e36fb3b8d18127dc76e715c87151febe00bd1f2d096d0e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658928, "uuid": "e6619ea8-8994-4013-b097-75a6d5532c73", "value": "2E74C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658928, "uuid": "c1bafc86-489e-4c74-9e26-de7c1dcbf873", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658928, "uuid": "04b6be79-3482-4032-8b79-7c709fd15be9", "value": "6144:UTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuW:Ubi7/xZrkNK11G9AQyOi6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658928, "uuid": "5e74bb90-7b08-4551-b72f-5e392364f8c4", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658928, "uuid": "37a2da9f-c0ce-47f2-8438-8c235e162a0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658928, "uuid": "f065efa8-77b2-40db-a06e-384793c36662", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9b06a7-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700100, "uuid": "8a8ad818-4f3b-4337-bb16-cc7c29064492", "comment": "Malware payload", "value": "f4a237cd2bdc8026f35403bd99adb7cb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700100, "uuid": "884add9c-3837-40f2-b423-88d9e9ad0964", "comment": "Malware payload", "value": "043b86a9a79a12a9caf7f9bc942224d928ebc2259611a437bfe7f30484b13617", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700100, "uuid": "e4d47e7c-e08c-49bf-9e39-235e0b3ccbda", "comment": "Malware payload", "value": "2aa3d6121593a1b751e69e5354a138c9f2800462", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700100, "uuid": "ea7eea4a-83e2-4287-9eab-ad74fa106275", "comment": "Malware payload", "value": "1bf0bfa4ae22a249366fbb4bb1967b8e0fc3e16cbfb052cb7ae2ded538076a852b5665bfde93bc79b5d9bfbaef760ca1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700100, "uuid": "092000e7-5d02-407f-b435-0a4d03438390", "value": "D2330289C5C8D336A8F579319C79C702C578AAAF480BC4A281F34AABBD07D95174EDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700100, "uuid": "cc49bdf5-44b2-4135-be7b-4138ad2c35b7", "value": "768:vwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2M:mFugXVpoD8ZxhrLAuNS07MrxrKsYTb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700100, "uuid": "a6de692a-5ffd-4fb3-8b61-d7aa1fccc246", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700100, "uuid": "cac2f1f5-33f6-41f6-8ee4-55dba9edec65", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700100, "uuid": "86126fd0-6144-45e2-aba7-532cac770b40", "value": "catalog-1279923776.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee678f41-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704260, "uuid": "6a786927-a6e5-4cef-8bcb-7c617740eaeb", "comment": "Malware payload", "value": "7cac6250819d47a652a409c889c18c9a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704260, "uuid": "e99b0947-b5ab-4226-9ac0-cd071681025a", "comment": "Malware payload", "value": "043be7f27bf25a7a477c1f221d1390ec96627a7ec1bbc36dd897fa2ca758662d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704260, "uuid": "c6a84689-a2b5-44f1-a53c-cfd0dd6a7766", "comment": "Malware payload", "value": "896589628f62eb7064328529b92b9b706a7425c9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704260, "uuid": "ed968992-abec-4814-8f0f-53a420c08cea", "comment": "Malware payload", "value": "d542b99781255053724e3ddf302690b15a32745e8862f09dea9a435f25abb1b9610fdb2ff3c002e56628a20848f21972", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704260, "uuid": "0c3de0c0-3aef-4b56-b9d8-c6ac07f344bf", "value": "3233021E5CAE3A29573E10F485469B5EE51718DE386DCAC21C8CF4AADC052A5027FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704260, "uuid": "69a5f64f-6357-4143-a748-44482619ca8c", "value": "768:U9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCPZC:NP6z4+ADViS8CWoD94pUnQ64x11RiCRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704260, "uuid": "ae166d70-ee9a-42ae-a431-0f7f14f6da95", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704260, "uuid": "1ec4f738-3742-4d24-9c51-2d1886a13799", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704260, "uuid": "e61b9a32-8619-444f-81bb-9bba08393bcb", "value": "diagram-637307419.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aed6a3-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705237, "uuid": "b4f07fc7-0089-48ef-8109-bb53e3ef7d76", "comment": "Malware payload", "value": "ad16098c33e3df3bfa21c6ccbd0824e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705237, "uuid": "6cbb91f1-dbac-4eb5-ad0b-e35bc92cfafd", "comment": "Malware payload", "value": "043d4b91906edbf15f1c853845fb88734278d0ccf5da336576f5c4a9a9d7f265", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705237, "uuid": "b47361d3-9d38-4475-b2a8-41f276e77039", "comment": "Malware payload", "value": "6c1d755e7308e73ad2d36eff8c5ce34ce40c1f8a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705237, "uuid": "257fdfaf-e93b-4195-bc36-734469c91653", "comment": "Malware payload", "value": "ed141d8467ab7f2b984eb77f1af827abc7eba8d9e76fa692096d7d35df3730142d9fa26889721694701fc55913a38dee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705237, "uuid": "6f5c2bb5-74cb-4634-b49f-8770b2bd5a57", "value": "8C3302195CAEB72D632D24B886858B5EE5036DE9341DCA450CDCF066EC066DD223FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705237, "uuid": "b4f2bef5-d3c4-4f9c-94be-fb3e1c9ef351", "value": "768:o9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiC8X:pP6z4+ADViS8CWoD94pUnQ64x11RiC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705237, "uuid": "f820e213-cd7e-406f-bf7a-38332467b307", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705237, "uuid": "3b4bab65-7cb2-43bb-8c6c-6d668a883859", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705237, "uuid": "32ed7e2d-4081-4b50-a632-19ae9809ced2", "value": "statistic-1302770715.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28b7337-a8d0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619690013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619690013, "uuid": "7115cd3f-3b3c-4716-8943-a3256132caab", "comment": "Malware payload (Dridex)", "value": "6c3918f69235c7fef8e48d04106c93a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619690013, "uuid": "6a66aae8-7def-4d7d-a5b9-e1143fb038fe", "comment": "Malware payload (Dridex)", "value": "04470492cdf836e1573c96a08b5a77975e3154eae50090932aa3b6405eeb4765", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619690013, "uuid": "de525dd0-662d-4a2e-9b10-32956229eb77", "comment": "Malware payload (Dridex)", "value": "5d1807e6ddf88e1ccea39230c8ad7e8c10cc689e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619690013, "uuid": "85077a1b-6e65-42f1-9d68-49f977338072", "comment": "Malware payload (Dridex)", "value": "8d6af5ae7ab759854c650dee622ecc63e26700eb9964e8662fd475c60c08a2eaf8dffce6b65a33dc9631a0d25377c329", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619690013, "uuid": "26b2b2c4-c928-459d-9282-abd5d7a59ab6", "value": "C8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619690013, "uuid": "2c1da005-621f-4b4c-8f01-567a92f8547d", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619690013, "uuid": "1c6e15b3-1b11-41e3-99bc-86c13c434850", "value": "3072:0A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:03J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619690013, "uuid": "aa9c580d-54f1-44ef-b12a-75bea956c5db", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619690013, "uuid": "e71cec4f-ce46-4880-b21a-d01fbf4ac66c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619690013, "uuid": "42026dbf-dfae-4eab-b975-66133f5c2445", "value": "6c3918f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65240cb1-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658933, "uuid": "17cbf2f4-3de6-4869-8050-c18d8dbb18ae", "comment": "Malware payload (QuakBot)", "value": "9ab7daa0771502798b2415e7d68e21bf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658933, "uuid": "9134ccdf-2bfb-4091-bcc6-bc754ebd162a", "comment": "Malware payload (QuakBot)", "value": "04525b76a51620761d0154af74d2e8c7bd695a549ecae3821cc67bef343b5e8d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658933, "uuid": "21581c81-c063-495e-a263-6713a9f1c3ff", "comment": "Malware payload (QuakBot)", "value": "330d31f97bfec5d53baaeb361c91a195c91ed096", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658933, "uuid": "8a784ebe-1126-45e7-8586-b674547bea8f", "comment": "Malware payload (QuakBot)", "value": "54f3778c2d8c8e6f7f6907c8004720c9ba1784b71478735dcdcdd5010bbe8a0566f03674838a75692dd9e2f12f3937f7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658933, "uuid": "2797dddd-3b0f-416c-bea4-261a43c18474", "value": "63549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658933, "uuid": "a5bab13f-d57e-47af-90d7-c2b37d6ff675", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658933, "uuid": "bb54b9d2-9a22-452f-988e-e9d87768df63", "value": "3072:Z3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ7z:pvv9sMoXBaRmr/dukbvuZ/7fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658933, "uuid": "078f15b5-35cf-46c9-9fa8-9ba20ab4673a", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658933, "uuid": "5ce838fb-8fc7-4bb0-a0bf-012f3e77477a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658933, "uuid": "cd9d2c96-a756-4625-b329-8953f51f3b5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f8ba08-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658937, "uuid": "173ada0e-486c-49c9-8edb-7000bb580a31", "comment": "Malware payload (QuakBot)", "value": "6ddf8f812997a88a02d4f41e52b45026", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658937, "uuid": "9c42d19e-8426-48f1-870c-5a6cc43c286c", "comment": "Malware payload (QuakBot)", "value": "04579a440a4ab0bcd743c210660586feb641c86317ccb90642ac6c6cb3c88cf5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658937, "uuid": "d95e579e-51e9-4ef8-bd79-86f246802ffc", "comment": "Malware payload (QuakBot)", "value": "1c66b75aff3cfabe39ecfbf10e0f9767d100679c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658937, "uuid": "cf7c58c8-eb0d-44fb-bd54-8a75c7ec9e92", "comment": "Malware payload (QuakBot)", "value": "6726406493aa97db91b7c85047e2413ca7cb4054321bb648715ff0d13bdba133dd98619ad09c568986e875458144e455", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658937, "uuid": "0371e2ea-4e36-484b-b0fc-12a5dd9fc68b", "value": "9274BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658937, "uuid": "ec0a6a11-c693-465f-ac80-14db62694d0e", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658937, "uuid": "7a628d09-dd14-4df7-9247-5802b5636562", "value": "6144:BnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuF:eFrkNK11G9AEtMxQyOi6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658937, "uuid": "0d1bc0f0-880a-4333-a229-b8f4c2869038", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658937, "uuid": "c91d5f26-9398-4e0e-a270-8a7ad2458eba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658937, "uuid": "d972e3a5-dff8-445d-8a72-9336598e079b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b7fc1e-a8ce-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1619689002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619689002, "uuid": "f3d8ab9d-3fd3-4038-8f57-4e9f5fa726e1", "comment": "Malware payload (AZORult)", "value": "0a1c0441a4b383a7c91bb3a0b2036b20", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619689002, "uuid": "6126f464-bd92-494b-a05b-b854e2104dba", "comment": "Malware payload (AZORult)", "value": "04721bfde5ece7d75ce90d7d09ddcc71028b26f2290382ffb78efcb2c436b2b6", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619689002, "uuid": "fd149248-6580-4212-a851-ae2c87f7c744", "comment": "Malware payload (AZORult)", "value": "cc32f97cdd7389e4857ca508a4b598831f6c7fd3", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619689002, "uuid": "0c4c98a4-d8ad-4552-b8dd-6868dfe6bca4", "comment": "Malware payload (AZORult)", "value": "3f0471323be57615b9a17f7a9d1563cc79867ed2715b565d8a5f8e1a88f4689ab7c4b1dc27b2c3cbcfb276662d29ae4a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619689002, "uuid": "4baedeae-40c5-4698-9c08-9204a6144f2f", "value": "0D34F15D5B7E5181C26B78300B13E6C58E1CCA68AC068AA776943BBDF770065CAC373E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619689002, "uuid": "a4f1fd31-1af8-4f33-87aa-c0daef733287", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619689002, "uuid": "867eea18-dcfa-4ae1-b0d8-4cbeaf034c2e", "value": "6144:S0mlPiFClT9Uv9aux/HASTF198iIB6MdoAV1wgMG:khiFClWj/gAFcHdoi1wfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619689002, "uuid": "0b7f0685-05c0-4f24-8267-98f14fa0f6b7", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619689002, "uuid": "25374d9a-9229-498b-bd90-82613b99b4e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619689002, "uuid": "d60a7930-368e-4f4b-94bb-ee3b722f3fcc", "value": "04721BFDE5ECE7D75CE90D7D09DDCC71028B26F229038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f956bf52-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702560, "uuid": "0f3fa45a-2583-44d9-823d-d84bcd825fed", "comment": "Malware payload", "value": "c9cc3e8d75567651d2030e774ae136e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702560, "uuid": "91f31d28-cd7e-4a72-a676-f97a3d4f534a", "comment": "Malware payload", "value": "04865f8253d2241e89c29ac0efabd34d109be8cdf4e840ce8c65cfb59181f649", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702560, "uuid": "dcbe82f1-e242-4110-919c-93a42a4fea7e", "comment": "Malware payload", "value": "678927cb0e250977ddf0ef0e9afb2c5772a72cc6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702560, "uuid": "e8542845-0f9c-4e57-a770-eea6006858cd", "comment": "Malware payload", "value": "498aa28f76cb9b06e1461efb5981a4067c2d24548265f30d0ce8627c12e82599004a170ad1d0d50050525473adc18a2c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702560, "uuid": "0ed86b2a-203e-4220-9f94-dbf434be04b3", "value": "2C33122A8DAE7A2A172D10E04945CB4FE61718CE3C6DC6864CCCF4B6EC066D5063EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702560, "uuid": "2dc3007b-4a89-46b6-84d8-8e8e9df4871f", "value": "1536:7P6z4+ADViS8CWoD94pUnQ64x11RiCFbOr:rPZBiS8jopkUQ64xjyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702560, "uuid": "743e7e84-d288-46ae-b4c1-e6ecf42c4f4e", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702560, "uuid": "e2c700b0-3d30-4608-874f-f0970e6b5e9b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702560, "uuid": "cc4345bb-13df-411e-ad5b-67a8c800455f", "value": "diagram-129274859.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd223d90-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704714, "uuid": "0288cde7-1d37-43b2-85a5-3e22e8d7b1d5", "comment": "Malware payload", "value": "24f3d39b99cbfc8a34f1517f955edb7a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704714, "uuid": "eb608fc7-9b2f-41a8-bc2f-d65fe54e92b0", "comment": "Malware payload", "value": "04b91732014f7826699f8d05a2b2d1ab3190d414614c88a6387624204faf3e63", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704714, "uuid": "dddfe69f-1e44-4568-8745-f51c0ae972e9", "comment": "Malware payload", "value": "6f45c54b51b16963f1e94ed10c2519a879b6baba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704714, "uuid": "bc5f87df-8a15-4e99-9200-dced1bc17d8e", "comment": "Malware payload", "value": "10f01696790d58f05c919d1deb518546b92e2ba967c5fb917129b8a71dc925432110383e3a0fc1dde5561cd9751061ec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704714, "uuid": "30f108b7-0825-4b27-8dfa-b9760a279de0", "value": "333302398D6D762D172C50B08988975FE21758DD385DCAC26C8CF4B6FC056A9063EBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704714, "uuid": "4b51a9a3-1a4a-4ae5-aeb9-0703e987c706", "value": "1536:kP6z4+ADViS8CWoD94pUnQ64x11RiCWOW4Mg:CPZBiS8jopkUQ64xULdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704714, "uuid": "70722608-616f-4c71-8ff4-1ec990b9524c", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704714, "uuid": "f1a2b108-7964-47a1-98c2-2a8e1e28bb6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704714, "uuid": "b45fe339-3d3d-44ce-a88f-c327694ec860", "value": "diagram-927611076.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2646ca4-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703408, "uuid": "91d9030b-fdbe-44bc-8507-76a043acf11e", "comment": "Malware payload", "value": "af16ae05936a7c105af6833c53a8bc81", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703408, "uuid": "b8e173c4-cc65-4927-86f3-1d398ffa2993", "comment": "Malware payload", "value": "04c4b5f4efe76c71556f538353d002dec92b4d402f2acfcc5f4fbfac23da1d1d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703408, "uuid": "46b99738-49ba-4227-976d-5ae5a2e0fd6b", "comment": "Malware payload", "value": "3ea7d6b2dc8f6c5ab87bb613162662ec0931e5e8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703408, "uuid": "497ccdc3-682d-4f77-9d76-5aaf1801d1f1", "comment": "Malware payload", "value": "71d07601961f2af1ca51ce859ef9db4bd69abe79a986b938db14f1001a38d35f9787278cbf7ff3480f954c86d293b5a0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703408, "uuid": "82efe952-d20d-4a80-8e27-d52b54247eb0", "value": "8F3301194C6E763D636E10F08649DB8EE6136499382EC5821C8CB4BAFC052A9127FF7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703408, "uuid": "464aa982-213e-4bd1-92bf-d7159dbb02be", "value": "1536:HP6z4+ADViS8CWoD94pUnQ64x11RiCAHY:vPZBiS8jopkUQ64xiHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703408, "uuid": "edd27a79-042d-4855-84b8-948cb7f5c416", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703408, "uuid": "1811c816-4fd0-49f2-90df-3fd0c7b2b6ad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703408, "uuid": "8441e7de-8416-4669-a800-a0c4a0c36ad8", "value": "diagram-1861696749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adddb287-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700716, "uuid": "7e7b6273-6ad4-4db1-a383-543db3935356", "comment": "Malware payload", "value": "2d43640090ceaf4c2ccfd442b422d262", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700716, "uuid": "4a4ab122-3b46-469e-a158-615a70a57439", "comment": "Malware payload", "value": "04d7e99e9e74c81ee5a1eac7ee9c15ed8723a31d616f9c9ffb7e9c23a9d60ffc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700716, "uuid": "d1ed8337-0656-47ce-81f4-6c76446c0996", "comment": "Malware payload", "value": "b1a072b45eaa707a91deb19428e81d35646efea2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700716, "uuid": "50a6d3b6-43ae-41f1-a3b7-ac1e79edf8c9", "comment": "Malware payload", "value": "7348f3bde0063f2d242fcf0ce9fb833ca695d65c007b29dbf016227f147a6ae1c2fa189b8ac633b6251562a9e5990f24", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700716, "uuid": "5371545e-64a8-44a5-beaa-eeb3b854bc79", "value": "93330188CAC8E335D8F57431BC788B02D478AAAB441BC96581F786A37A06DD0174BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700716, "uuid": "01bf576a-1a4c-41f9-a95a-85a978180846", "value": "768:yRwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasVI:9FugXVpoD8ZxhrLAuNS07MrxrKsYUJo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700716, "uuid": "24725dd0-a10e-47f6-80a1-88aee7d85868", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700716, "uuid": "f92a1d7a-0f68-4b5a-9217-5cbf28593f62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700716, "uuid": "a54b3ad0-377f-4e56-ae52-bd6606f97e82", "value": "catalog-1759816761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac7a839-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658942, "uuid": "553a589d-6bff-465a-9308-a504bf93e474", "comment": "Malware payload (QuakBot)", "value": "cb3e50e66d8db452b65e8589a84eff65", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658942, "uuid": "63547587-68ef-478e-8dfd-f75876cf1153", "comment": "Malware payload (QuakBot)", "value": "04f514aed3c09447be335600599a17254ed8a4f6b0825f5be40ace9c03571ebc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658942, "uuid": "06b23ea7-04f4-49b2-83b4-d1ff276cc256", "comment": "Malware payload (QuakBot)", "value": "77f3dcabf419fe106948ced7aad79a588516ab42", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658942, "uuid": "e0b435d8-2082-48ac-90a2-c906b11c1e26", "comment": "Malware payload (QuakBot)", "value": "951408c810cdacb08136d7d26912333646d91aa9ed21777c2527d78615ecd7a0f3d5752b4c15eb7cc5f637b7501a8032", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658942, "uuid": "5ad600b6-29c7-4a44-aa35-b6daa074c8ad", "value": "B5549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658942, "uuid": "e39950bd-0345-45d1-9e49-fd22c6eb6a45", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658942, "uuid": "5067603c-1286-4d2a-9a44-ccb472954c97", "value": "3072:Z3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZc8:pvv9sMoXBaRmr/dukbvuZ/7fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658942, "uuid": "7337d315-9fe8-4780-b40d-a458b7ddcc68", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658942, "uuid": "515c7354-0376-42a1-8655-28ac8c9f4463", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658942, "uuid": "da10a729-6a9f-4fd4-9bfd-f09f6e004c4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a07c4f-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704547, "uuid": "3ced31d0-6b41-4016-811b-e6e839200039", "comment": "Malware payload", "value": "6b227006d762edf4714a2b8974984332", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704547, "uuid": "147a1ae0-1627-4a13-9dbe-c7a70958810f", "comment": "Malware payload", "value": "04ffe920dcc69382990be787ae9ca3ed5d4038a2e4fa707dff9ceb177d2ca3ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704547, "uuid": "b267385b-bafa-4b52-9ba5-8ce3c9b24036", "comment": "Malware payload", "value": "8cb66cc8cdec6946bb3865a56c31437149cf9114", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704547, "uuid": "fc534dd3-310e-421a-91ce-13f3c6762ae9", "comment": "Malware payload", "value": "11461a5ba9e4b5fe69e650b89592b18df7b045cafec214f340a7c082bf19d179813aeb0a5c8e73339419d82463888afb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704547, "uuid": "1670b9d2-588d-429a-8238-a94ec05c7133", "value": "0A33022988AE763D532D10F08585CB0EE61B38DE385DC9C66C9CF4AADC06569127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704547, "uuid": "9dceaf91-4482-46a8-9f16-e67fd33c82da", "value": "768:w9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCx0P:RP6z4+ADViS8CWoD94pUnQ64x11RiCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704547, "uuid": "cccd0fe5-ff2d-4ad9-aae8-f60ae8e13d78", "value": 51476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704547, "uuid": "e96fdafc-eb17-405e-8d6f-386dde520ddd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704547, "uuid": "6dcaf590-4a1e-43ba-9c09-b61ca792674e", "value": "diagram-826907370.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d881dae-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658947, "uuid": "45231f92-9428-4f14-ac25-7318398ee18b", "comment": "Malware payload (QuakBot)", "value": "341d789d4f1062890c7cc76b22762340", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658947, "uuid": "ead9b2bb-d6cd-47c7-91c6-c36d12868c8f", "comment": "Malware payload (QuakBot)", "value": "050217e22fd0b3d02479efbaa534ffd22e4ca62053b93b27b08d9949c08c9122", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658947, "uuid": "d857a181-993b-4e47-8dd8-4267943ede36", "comment": "Malware payload (QuakBot)", "value": "2fd6c461cb3a1a13776cc6448b1a91836c24fa52", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658947, "uuid": "cc2fdfe1-c3a3-427d-8e5f-f83e0a2646fe", "comment": "Malware payload (QuakBot)", "value": "e0b1f602b6eab9b63fa67d9aa2f2fb145cc16fdcca23e8a8cf00e89bbaeb66c6c72213c9985ba9fb24fe1907a1aae543", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658947, "uuid": "6f2e13b6-f74e-435d-8c13-f979fedaa967", "value": "7F549E7AFA12DC02E7A82BF023C36F581A579AD53120251B55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658947, "uuid": "97e54703-65fe-488b-816e-7aaa8ff7c47f", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658947, "uuid": "e11b3b70-f564-4c15-ae47-851769463846", "value": "3072:t3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZvx:dvv9sMoXBaRmr/dukbvuZ/7fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658947, "uuid": "f85bea2e-2547-4602-bdc1-9d281c2dab58", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658947, "uuid": "7c683bc8-5373-4cd4-beb9-1426d3526acb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658947, "uuid": "05ab5420-a089-4380-bde3-2dc830b36ea1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3dff71-a8bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619681176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681176, "uuid": "ff8b649e-daa4-49d8-b932-991266aafb18", "comment": "Malware payload (Dridex)", "value": "f33fe60e8a0cd864488ca02ac47a5d68", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681176, "uuid": "042d0a21-0a9f-4de9-816d-b6559e55c48b", "comment": "Malware payload (Dridex)", "value": "0510758d370beb7e1f4b7735bbdb2d2893b8a051662e91ccf7afee55582c0271", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681176, "uuid": "336518ad-a8e5-4782-a68c-262ff1c6994a", "comment": "Malware payload (Dridex)", "value": "b5f36fb19142ec2b0f15312b868d56dc9bd19479", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681176, "uuid": "77ec508c-4095-477d-9546-f919d1cb2723", "comment": "Malware payload (Dridex)", "value": "82d3f4e8d02c43cf5b0bffce6bdd4d8188e6638c6d68fdf5193befa736c65899c62f6c7a6f502812e18dddedc69d4179", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681176, "uuid": "bb5008e3-4990-47f5-bff6-ebca9e9eff5a", "value": "D3F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681176, "uuid": "cfda8a95-9e7d-4a22-ab4a-52cc18b2a2a3", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681176, "uuid": "9e08af63-a651-45ce-86f2-675e432f3c2e", "value": "3072:4nT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:Ty5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619681176, "uuid": "b4129d2c-6ab9-4d74-a141-535c798862ff", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619681176, "uuid": "786a9485-b86d-4b0c-8ff6-f326f9587442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681176, "uuid": "af9214f5-f7eb-4b72-a885-735686ee9919", "value": "f33fe60e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9949b556-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704117, "uuid": "b62d720a-270a-46df-8bb7-dd9757cd54ce", "comment": "Malware payload", "value": "3283187eaf2919a1992facac6d08f3a9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704117, "uuid": "8deaf902-7d02-423c-8454-84325134c6a9", "comment": "Malware payload", "value": "051ca36878006023bd97f056d7859ed189d7feafd2c2e5819314b19e66cb755f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704117, "uuid": "32116b55-18ac-4d2f-b8f6-6221c9786ae8", "comment": "Malware payload", "value": "741a5ef2a51c283e0edc85baaabf0316f39fa890", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704117, "uuid": "c46ed474-975a-4600-b008-93489992699e", "comment": "Malware payload", "value": "7a98d48581ac5a6ede2e2c3764a92400476de6c5a2aab10433f1a0f26d0daa30171dbb94aefee07a236484a4bf566550", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704117, "uuid": "2fb11157-ec69-46db-9cf7-f9bf307b599f", "value": "7F33021A486EBA29133D20F40449DB5EDA0768DD3CADCAC21CDCB469EC056A5163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704117, "uuid": "94188c51-0d53-4a10-89d7-b1324e93dbdf", "value": "1536:zP6z4+ADViS8CWoD94pUnQ64x11RiC8+w:DPZBiS8jopkUQ64xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704117, "uuid": "8145bdcd-b68e-47d2-b834-d2805567e641", "value": 51475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704117, "uuid": "43a49a09-afb8-422f-85ab-36e2dc8bd074", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704117, "uuid": "6bbf2807-cfdc-4fa2-9e63-7d30c93868e2", "value": "diagram-51337406.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22324692-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703488, "uuid": "f5053171-97ae-4174-9ead-1ba5820506af", "comment": "Malware payload", "value": "5029101c704374858ac289aa62baf602", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703488, "uuid": "361ee930-5c98-4c05-afee-276a40eb5bcd", "comment": "Malware payload", "value": "0521a50bd401f4f6de232c0d00863da41cb822ccf8940a2b98e2391dca46dd05", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703488, "uuid": "fca15d97-6984-41d2-a75f-46ae9ed74254", "comment": "Malware payload", "value": "f83aef67df8847e293df85dfdd5f7716f7bb11f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703488, "uuid": "de104e27-4716-4a40-a125-ab2b6fc32f31", "comment": "Malware payload", "value": "e2ecaf37d5d9fe67ceb9ef854c41994905708b39268b1c513667f48af0ddafbeab98992cc333b12b9cc9f6e7b14503f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703488, "uuid": "88239f10-a37d-495a-bbf8-d0ef52da72cf", "value": "D733023A49BD7B29572D10F08684CB5EE657589E3C2DC5412C8CF4A6EC056AD027E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703488, "uuid": "1db82fec-7f57-4dd4-bdc1-7d529f6edf0d", "value": "1536:TMP6z4+ADViS8CWoD94pUnQ64x11RiCEYwNw:+PZBiS8jopkUQ64xXwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703488, "uuid": "79ad3b89-aadf-4e0c-a067-e5207099c953", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703488, "uuid": "520bcc95-b5c5-411d-b8d1-1a9b0beaed6a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703488, "uuid": "3c4e43c7-c4d1-4225-89c5-d5bc97591c48", "value": "diagram-1952121196.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8e2757-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700610, "uuid": "518249a2-27b6-4f41-8e66-79e03744c482", "comment": "Malware payload", "value": "51e249f9429cc59032212ffe085f262b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700610, "uuid": "c2e9abdd-009d-4a50-8ae5-eecf299b0a8f", "comment": "Malware payload", "value": "0525523bc2adf7a0e27c7cbf67ca628100aa6b4d28a414c5633d148346c6b4b3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700610, "uuid": "473ef906-9fa6-41f8-a7d2-f68b9420e6df", "comment": "Malware payload", "value": "c5c0325972c7a266233bba6edc2855ddade63291", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700610, "uuid": "1182fdad-62fb-4af8-98a1-74b9108c2a41", "comment": "Malware payload", "value": "b12d660fc7ce0e1f67773deea9c60b1825238bd5409e7564a070c0357b55908b229dfbae3eb3a5603ebc22f708dba9a9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700610, "uuid": "0fa5b11b-f9ea-4cbb-b441-08113429d36b", "value": "01330188D9C9E332E8F535306C39CB01E5B8B9AB0417856181F38BE7AD07D955B0ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700610, "uuid": "9b005472-8e68-44c2-aa7f-0a0f9b0cdd60", "value": "768:5wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2s:AFugXVpoD8ZxhrLAuNS07MrxrKsY0MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700610, "uuid": "bf59d64e-cedd-465c-83b6-71e2738580ea", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700610, "uuid": "3cb8fe95-914c-4b94-9a65-026a39836328", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700610, "uuid": "e9feb8b9-4212-4557-9b70-d075ba34bbde", "value": "catalog-1669555573.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70505426-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658951, "uuid": "4dca2467-c35b-4de3-a940-23faad7cc88e", "comment": "Malware payload (Quakbot)", "value": "a49c512fecd065f0afc0a8bbe4c12f2e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658951, "uuid": "12021540-9510-4340-a8e9-8dc0bc75eb60", "comment": "Malware payload (Quakbot)", "value": "052f30af2368b935fed5b5f02a9c2bb38f2b1be1054a4f6d7008f6d1caa25199", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658951, "uuid": "c42b1559-ca45-4a0d-b31b-6c3001141974", "comment": "Malware payload (Quakbot)", "value": "b201e49102036b5db5fd0c25143582d68c544fa8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658951, "uuid": "f653d3cd-719a-4dcc-a73a-444f73491dc7", "comment": "Malware payload (Quakbot)", "value": "4e1637e30ca016ee6cee3930fe6a0e474b42b666bb51809b0afabfbf40e8a23badfa888aaed70519781fe9ec0524e108", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658951, "uuid": "45842f40-d457-4a4e-b518-3b8ad2daba82", "value": "9774BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658951, "uuid": "8cc097d2-6a75-4d0d-b72b-415cc1f38308", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658951, "uuid": "cefda189-543f-4f20-8cf4-e4541b9c1f0f", "value": "6144:9nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu3:iFrkNK11G9AEtMxQyOi64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658951, "uuid": "3116efb1-0e9f-485b-bf1d-d83c982983d6", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658951, "uuid": "b38034fe-d0ee-4f56-b31d-17519b8af451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658951, "uuid": "a99b1af1-e970-40cd-9585-dca0f583a20b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed3d9c3-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706247, "uuid": "578af8a8-59bd-4529-805d-f28db24dcea5", "comment": "Malware payload", "value": "4ec0a2f73d63384d21ab4b3a6d1bcc8a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706247, "uuid": "8013d7dd-0c6d-4e1b-af3b-fec91bfae8eb", "comment": "Malware payload", "value": "053f0f7a2bbb5d3df856c7480034e8a2c9e3a9b822de84e535609c0e27900e13", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706247, "uuid": "752c89ab-bafe-4f0a-9e6d-0d4cf959de42", "comment": "Malware payload", "value": "595d65c50a9659c3bedac15bc238a516fe433f2b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706247, "uuid": "88d2111c-c456-49b4-9ce2-d5c909fbfd17", "comment": "Malware payload", "value": "c5eb0643ffd5bf90c130545a68ef9a8640913b276e2fc76f46d8af265f20504d0168457e06c34d15e5c75cefb70ab6a9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706247, "uuid": "e8dc5415-2f67-450c-a01b-abe3e0f6e68b", "value": "843301194CAEB729532D24B886848B5EE513ADE9341ECA450CDCF066EC066ED123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706247, "uuid": "d9ff614b-c1d6-4b28-855f-665a56108109", "value": "1536:4P6z4+ADViS8CWoD94pUnQ64x11RiCBkd:OPZBiS8jopkUQ64xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706247, "uuid": "18816863-f39d-43ca-8dba-b3e09498f70f", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706247, "uuid": "8b17ca5c-9e79-4d30-8a5f-3fac7fa2069a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706247, "uuid": "55934a8c-1bf5-4b85-b75a-2f0adb10eea4", "value": "statistic-221309487.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3628d6de-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705239, "uuid": "ff3d9e7b-103b-42ab-92d3-aedac6d9b0b2", "comment": "Malware payload", "value": "f74c45eaea6972a219d9b6d8b4fa4558", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705239, "uuid": "37f772f1-c146-4afe-8c3b-0b061a6714c7", "comment": "Malware payload", "value": "0546d98dd01e8094477f142380cc55bdebe1dbcf3300b6fdc1acf71ea28567d5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705239, "uuid": "b63ac096-5ce7-4ba5-a758-97bf40de1fb7", "comment": "Malware payload", "value": "48ead325837abd25a7527a57eae77b8a248bc1ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705239, "uuid": "26d5ca43-6ac3-46c7-b57b-794a636a36b6", "comment": "Malware payload", "value": "45a3d039792c17de04d502452ceed553738bf83dfa1e07fa8fea793b9a09a5d9af374b4c466cab0ea9ae776e3a5b8275", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705239, "uuid": "0a4edce3-d2f5-4102-b686-3a3cfa04948d", "value": "E733012A88AE7639473D10B084499B4EE667189D386EC2921CDCF5B6EC057EC153F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705239, "uuid": "a71b0fd8-da95-4ea9-a6b6-82c4bdbab61d", "value": "1536:RP6z4+ADViS8CWoD94pUnQ64x11RiCFjPvo:VPZBiS8jopkUQ64xjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705239, "uuid": "3816baa6-57f2-4cc6-b515-33e40959a12f", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705239, "uuid": "2d452214-b9f0-444f-9ea5-b3b32a2135af", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705239, "uuid": "f3447195-2d3d-4162-a8a7-530d81ad9d0f", "value": "statistic-1303626917.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7af9a1-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706027, "uuid": "ce6e935d-388a-4e43-b295-07dfc9628436", "comment": "Malware payload", "value": "137a7b9aa0ebf3a5e821f97afffab8e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706027, "uuid": "3d86e1f8-b37e-4e9f-89c9-a6744fcbbba9", "comment": "Malware payload", "value": "054cc5e25106841b55c082634c91486e67ce7d21efe34434c60a37c5ddda58c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706027, "uuid": "80c9bc92-d6aa-42ba-b282-28a3a07af2d8", "comment": "Malware payload", "value": "d96dddc57bb7cce5179096ce95d02694c61d8501", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706027, "uuid": "a6441753-1f50-4825-8b51-14ee800eea78", "comment": "Malware payload", "value": "3073d1be4893ae7de7041fff0407c6cc8982dc41f462d1732bed61a93fd30116d4a2b1a4e92b9b206913193c5575794e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706027, "uuid": "1ec64fc5-325d-4e23-9990-51ab7b3f7a2c", "value": "AA33122A4C6E762E1B2E00F8C0458B4EEA1728CD3C6DC5821D9CF4A9EC01A9D113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706027, "uuid": "9d6c7d4f-3069-4117-b846-e7a9f56678cf", "value": "1536:3P6z4+ADViS8CWoD94pUnQ64x11RiCfp7at:/PZBiS8jopkUQ64xXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706027, "uuid": "b06f73e7-ac39-47e6-a226-860a924d05ca", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706027, "uuid": "0565e9bd-b7d2-422c-8b70-8003ba0f9568", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706027, "uuid": "2fc136b9-8ad9-415f-ba2d-2c7acecfac93", "value": "statistic-1969017046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73156125-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658956, "uuid": "83d9b448-874c-4276-80b2-a4f1610a8507", "comment": "Malware payload (QuakBot)", "value": "5cada3e935848603e1ee2f515a9d0b67", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658956, "uuid": "42cd6f79-879f-408a-b51a-ce1d20821401", "comment": "Malware payload (QuakBot)", "value": "055154ccd91b98a35829ad6c3c5c61dea3ec7120894b1e4b7f456d4013c4c6ba", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658956, "uuid": "8dee9fda-e243-42e0-92a3-7ea223d64f14", "comment": "Malware payload (QuakBot)", "value": "2b1a970c78f002a89d70605676470b2233ab82d5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658956, "uuid": "4f38c550-856f-4e93-bfee-c3c58e2daf0d", "comment": "Malware payload (QuakBot)", "value": "e547680b6c386fa3d304e1be3807be489a2813ba21ee64a67dd6e3bdeb8f44157be2a00fc519c4e2eb74da740092f428", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658956, "uuid": "613daf51-1f38-42b2-bc5f-a50b1dee0279", "value": "4D74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658956, "uuid": "0db95a3e-c078-4313-8a8b-036cb557c414", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658956, "uuid": "5f8c3120-3bdd-45ea-aa49-9e3d89848b24", "value": "6144:mnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuYI:JFrkNK11G9AEtMxQyOi6pI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658956, "uuid": "a0b44ea2-b4f4-4e73-900c-d77656092579", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658956, "uuid": "17666073-c325-4263-a569-b142381b9e54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658956, "uuid": "5883c377-05c2-475e-bad9-688899801443", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea572c7-a8cf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619689658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619689658, "uuid": "29a2d490-2f88-4911-8edd-a0d9c4b5ef17", "comment": "Malware payload", "value": "341b79b48d379e0e8eb1a359bd8b6047", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619689658, "uuid": "331b6cec-6ab4-4bdc-9ea6-c800e4efb2d2", "comment": "Malware payload", "value": "059d435782610185ccf15a881b8ecc5934559eca687ede651ff6ae06492ab008", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619689658, "uuid": "aa71b2a6-4c5f-4f7c-83e2-65d11fd679fb", "comment": "Malware payload", "value": "7bbb82435debc40088a2096cff88156651b2ca6e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619689658, "uuid": "24587954-bc1a-40e1-b495-7f2b818ef890", "comment": "Malware payload", "value": "86c2ba933d74f674850812d1e85e03ced1c62816f8f9f84196c89523470c8aa8f480d608d552ed474d064d8cef7ec002", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619689658, "uuid": "378bb53e-0408-402f-bc9c-4b2fc6aedc77", "value": "8FA3122638F57B14C3E6A8E2C0306176A5A9F85EA41624B331C7F87524E8CAC64D5DBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619689658, "uuid": "ebb9e24c-b0ed-4ff5-8805-cdde40ac7aa3", "value": "1536:E3HwAJ4MF6CYNI0MOMWe6eHlQg3ofHYrmr10dix/frZzjQIMx1ER:V410TMj6Of3CTpSUzzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619689658, "uuid": "1dc1127d-9740-4966-b81a-e7461f45084c", "value": 97680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619689658, "uuid": "e502c568-f345-4650-9b7b-72c7114b00b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619689658, "uuid": "3f2e35e9-d5ef-4f94-ac64-500feda8c435", "value": "341b79b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac368ede-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702001, "uuid": "09e848de-d89d-42a7-8efa-faba9673fe33", "comment": "Malware payload", "value": "3a341babd61a69aa721ec3f6cac8a0f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702001, "uuid": "abfe7855-1688-4270-911c-b2d3a8abe4ac", "comment": "Malware payload", "value": "05b390b6ce8645cd015f7dffaccd09b0165bac11dfe6e29a53ec502dd0f265f6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702001, "uuid": "dc6f07b2-47f3-417b-8483-9f0e930681a2", "comment": "Malware payload", "value": "b1f0e22871b9e01136e7d21069b924950807d150", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702001, "uuid": "e6aa38cf-8e6c-43e4-89bf-985576b82aba", "comment": "Malware payload", "value": "cb1c83a5e04260b929541b93ced1da8b01d23c5f60ab3b841dc8f2a204c9b81c97968c766ac3e4e436b66aa52517b45c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702001, "uuid": "e76bc200-4b75-4bca-9aee-4d4c50ce9bea", "value": "0A330188C689E335D8F97431BC788F02D478AAAB441BC96581F787A37A06DD0574BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702001, "uuid": "9cd38fd6-4a76-45d0-9f03-4d3784be9e5c", "value": "768:YwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2f:1FugXVpoD8ZxhrLAuNS07MrxrKsYUJcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702001, "uuid": "a7f9591c-062a-4896-bd59-54675d829ca6", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702001, "uuid": "dfdbc765-b163-45bd-b73a-5a1fc0547f42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702001, "uuid": "dc8cc4c1-2cb7-48c5-9dc6-fa6c068f77a3", "value": "catalog-82609633.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7523148-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705483, "uuid": "1bf2adb2-736d-417e-836d-1676bac0c1f6", "comment": "Malware payload", "value": "bb7b6ffba2b0edec28c764cf60370898", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705483, "uuid": "e8bbafbb-ad2d-4d36-a81b-e626f833fbec", "comment": "Malware payload", "value": "05bbefb8fc4895e638e58f782692857ccc2938c574446f647ff2e139658130d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705483, "uuid": "5f25fdbd-a003-4748-9ac2-ed4b5d6f661b", "comment": "Malware payload", "value": "796ee64d9a3b534c608bd5807429b1720d4842f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705483, "uuid": "009b8fed-d034-4350-b569-ec456b54d255", "comment": "Malware payload", "value": "cf39a33dd0cef7668a800a35b7060bc4dce3704b277f562b65f4fa86f3473638541a4b38a33c9ff0f0cd35cc5e7ed144", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705483, "uuid": "38b63259-0c8d-4ed5-af96-b2ff2e6eb127", "value": "C033021A886DB725273F10F08586971ED62368AD3C7CC6421D9CF475FC0A699163E77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705483, "uuid": "e7d73db7-537e-4121-987b-6cce33267e92", "value": "1536:IP6z4+ADViS8CWoD94pUnQ64x11RiCVonH:+PZBiS8jopkUQ64xz+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705483, "uuid": "3d071711-4dd6-4ea6-9f75-22e122d9801d", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705483, "uuid": "e2b81f30-946a-4eb3-bfa8-aeafb1613411", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705483, "uuid": "bc04c203-6dbc-47ac-81c3-b20a95def70f", "value": "statistic-1527417660.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fdb4ff-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700817, "uuid": "177244fb-6a12-4685-8948-e303c1e5a5ad", "comment": "Malware payload", "value": "7aa4ed14de7195ce34784b0006106022", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700817, "uuid": "06540ea9-fdca-4836-b4e3-2ace77ab9605", "comment": "Malware payload", "value": "05bf03b479dacedda9407e6c03f3765df1050a0348c55ae19c158c28e9c826d4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700817, "uuid": "e79c76ad-74e9-4ee8-9ed8-1de2c33b7104", "comment": "Malware payload", "value": "b1087d815facac66aaa55e80f9f072c984b6c5a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700817, "uuid": "e8b37acf-9de4-4dea-b60e-cf156f969a6f", "comment": "Malware payload", "value": "a874b5de98f8ca170306395a1a5c6b46a39aad9e4f3284128db485aff4942ce23a77941db8e9aa761340abab0583339a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700817, "uuid": "496bde45-2ccf-4fde-b233-9044bbac59bc", "value": "B833F2CCC6CDD332A8F578315C79CB02D578AAAF0816855181F74A9BBC07AE56B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700817, "uuid": "c09694af-ccde-43bd-8096-48f0a55ae155", "value": "768:1wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2k:UFugXVpoD8ZxhrLAuNS07MrxrKsYVOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700817, "uuid": "9ce23d51-77ac-44eb-a060-40cb68d7a9b9", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700817, "uuid": "5d276f79-83c2-4e4b-93d4-ab68683537f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700817, "uuid": "719bcfb3-fe3e-4489-9db0-26ad62dd5bdc", "value": "catalog-1850558638.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364729fa-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703522, "uuid": "df0e1cda-fe8d-4478-b2c4-106b6ae83a4c", "comment": "Malware payload", "value": "e68c8217c2fae34062e23f36b2626edb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703522, "uuid": "f979b459-46d7-4a62-9c9b-9649c1b2a5f2", "comment": "Malware payload", "value": "05bfff279ac891aeaa056aaef21057c68caacc0cfe0fae94261c971be6e88070", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703522, "uuid": "460db069-514f-4c5d-aa65-2b93258d566c", "comment": "Malware payload", "value": "603a6454ef0e3ba702b0163bc54a792136d46dfc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703522, "uuid": "3f0cd5e2-6b70-4cbf-94d8-7441e3034056", "comment": "Malware payload", "value": "dd97e3eb631a0c899d47e5cbf70be09c389418ca6f32cd59ebab5770a2e7dcd6174c484b7b30d8457b9a98f216fbdf67", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703522, "uuid": "6c51dc6d-d4f7-4028-81dd-9440e4566566", "value": "8633022A4C9E7A29577D10E04985CB1ED507A9EE386DC5812C4CB4B6EC06BE9123E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703522, "uuid": "84924fa8-0d29-4b1c-9710-57bd4ed0679a", "value": "1536:7P6z4+ADViS8CWoD94pUnQ64x11RiCBK5M/:rPZBiS8jopkUQ64xu5M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703522, "uuid": "ed21ca62-81fc-4d21-8e76-1457b0e91bc6", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703522, "uuid": "6c61b158-4e3d-40cb-94a6-0bbbbd28e0bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703522, "uuid": "5456c9c7-9975-403a-b9cd-2501d511100d", "value": "diagram-1968891157.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc312503-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705894, "uuid": "69c167ca-98d6-43d2-af13-d4d6372ee739", "comment": "Malware payload", "value": "0b8737bac241a6689fbe47597935f5aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705894, "uuid": "8c9043f7-2607-4556-8326-ae5568065f83", "comment": "Malware payload", "value": "05e4ac51975401cbf5f35320c5ac220ecdd68e1834935abb1327a585a26224d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705894, "uuid": "25ecea67-c7e8-40a8-ba65-4888a330289a", "comment": "Malware payload", "value": "b62c3914d0540bc1761975f29c6a9e0795392512", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705894, "uuid": "734b50f1-45af-4fd7-8436-6a4790d4029c", "comment": "Malware payload", "value": "3a2a07efd2dadd014a924c6c6f8aea3f9a9f8f90d32640e0c06062b7c83c50e57ff0b3913f61341f41e6eb905ba807b9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705894, "uuid": "6c59dd22-eaf8-410b-ad75-c11c151bd8c1", "value": "503312298D9E7A29977C20F04089DB5DE55729DD382DC7421CCCB8B9EC066A8027F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705894, "uuid": "a896b7de-faaa-44ba-89b7-71466b86dc1d", "value": "768:X9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCIgQ:iP6z4+ADViS8CWoD94pUnQ64x11RiC7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705894, "uuid": "a86137ef-ebbc-430a-8ba1-157765dcdd01", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705894, "uuid": "102ae460-c85d-4ee8-8178-e59dae79fba4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705894, "uuid": "bb6eebf4-048b-4038-ad0f-a1c26a4c1c22", "value": "statistic-1853943302.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dc2d3a-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658961, "uuid": "ef132a10-16a7-46c6-bb93-159ce3c62837", "comment": "Malware payload (QuakBot)", "value": "c7d9f2b800eddf55056393673e92dc46", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658961, "uuid": "eeba0cd9-ca0d-41ee-adaf-8afc97fa8b3d", "comment": "Malware payload (QuakBot)", "value": "05f0d00512a54e281c448a7d91b4a01e2615cd126b9adf6d829ae627de5b4104", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658961, "uuid": "8eeec513-7104-45b4-af43-9d4246c720cc", "comment": "Malware payload (QuakBot)", "value": "abafe811be9e57ed621be22dff0cb7cf79acaa70", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658961, "uuid": "35e85679-658a-4ae6-877e-beef3e2e3956", "comment": "Malware payload (QuakBot)", "value": "3aa3c1fe3b07b290a07bb9d8a7e7afb1ecb50c65a9f263b2e1ae763f7ce6d9c0f54bd16d28472872a80fa35d9e418c82", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658961, "uuid": "6d975cbd-c853-4f2a-8bd2-ad1d0c27ce3c", "value": "DE74BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658961, "uuid": "c46e5707-bc1c-4c54-b0a8-3f46aa7c477c", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658961, "uuid": "9bcad8f0-5cec-4385-9017-ff5d42544ffb", "value": "6144:5Tfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuL:5bi7/xZrkNK11G9AQyOi6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658961, "uuid": "7f8be781-ca26-4a34-a4e6-ae2536da5591", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658961, "uuid": "0bb07821-b40e-4eb3-b6c1-ca2ff9a893fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658961, "uuid": "16418ba0-7b9a-476e-8b8a-bf84136a40ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cb3a7a-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619733938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733938, "uuid": "07f16c45-b50f-48b4-80f8-83024a87de64", "comment": "Malware payload", "value": "f6867fc9b7b561a1f99770beba9c66a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733938, "uuid": "0686c67b-37e1-44d8-b066-9b49342b5dee", "comment": "Malware payload", "value": "05f5b20d8befffb40292f9141ad3e2fa26b426e40387726d3831693b116984eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733938, "uuid": "8422f1d6-94b8-4039-a9d4-13ef16343331", "comment": "Malware payload", "value": "5dd0e535a3d290399275759ac42c9baa23ed004e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733938, "uuid": "0fd53cd6-2eef-4eb0-9cd8-39aca80a3a74", "comment": "Malware payload", "value": "5d03f32ebd1fbab867fe255d1e65ea2ed06ba4126c421e8d41df2a43d1cd12153e468c06f2efcf675a5c37afcb9e34be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733938, "uuid": "59df78db-ffdc-41e7-90cd-f2aa21ed61fb", "value": "49F3CF82D702C1ADFE212C7A28E677753D9833905E54CA68E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733938, "uuid": "a76b1443-a719-41c5-86da-a919fadfd654", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733938, "uuid": "dfbdba34-f605-48e4-9b98-1aad1603e79d", "value": "3072:2O5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh8gH6:L52j4pk5zMbVO6/HUIXU8KgMyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619733938, "uuid": "d25d80cf-5100-4e76-aa81-2bb6d2e6f3a4", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619733938, "uuid": "4bfff8a1-69a2-469f-a5d5-ad297657f42d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733938, "uuid": "3b12eaeb-b9fc-4d8a-bf21-c82b15a632f3", "value": "f6867fc9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b43ab9c-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702644, "uuid": "147026f2-6e4e-455a-a8ac-99c23dcf16bd", "comment": "Malware payload", "value": "1645feb4982a94ba061e136dd74d44f1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702644, "uuid": "e5218766-ed1b-4799-a671-cd6aa0572cc4", "comment": "Malware payload", "value": "05facc66d21fc81481f607e65e66d3f81a13f90862efbd76943fab22ab131108", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702644, "uuid": "995ca378-a9e7-474d-a604-0a9add0fd702", "comment": "Malware payload", "value": "028e7596ff2d61fdfe494fb02bf83618e6e99111", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702644, "uuid": "af5b2b4b-e4a2-409c-a091-b4284ae7f91e", "comment": "Malware payload", "value": "dda9cd3b757be72fc2fac49b9ebce0e0ad93936d8290222afb21d6e97b21420d7298d8025d537926017c197f6627b1c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702644, "uuid": "4fced741-27d2-463f-8a32-af6b6a39fae8", "value": "BC330229887D772D572D10E08585876EE51B28AA3C7DC5425CDCF4AAEC013AE163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702644, "uuid": "dde91484-32ad-49a5-aec3-0b2b500a2e07", "value": "1536:hP6z4+ADViS8CWoD94pUnQ64x11RiCiYq:FPZBiS8jopkUQ64xrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702644, "uuid": "9486d1a3-7189-4bd6-b7ea-c46e9a7d30d4", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702644, "uuid": "8eb050f8-8b5f-4d45-9bf4-b897252281fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702644, "uuid": "58dfbbbf-3da9-4738-a9d5-185dae1c20b7", "value": "diagram-1350911981.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab59883-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699851, "uuid": "18fec633-9809-42eb-8fef-726b88ff32e3", "comment": "Malware payload", "value": "4196fed14af999667e7ee9241cd08ed1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699851, "uuid": "533c55b8-79f2-4935-a10d-3fee72fc7816", "comment": "Malware payload", "value": "06079df7605967e90a26bc4448dfb28b9ec2605154d73c2ee104a77078cf0a78", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699851, "uuid": "0d90d8ba-8d73-4cef-9dd5-f2b564339263", "comment": "Malware payload", "value": "6106cc967e3da2464b87e0b6e339bfab73a4e6d4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699851, "uuid": "8f280da8-0f09-4672-bd26-8983869bd11d", "comment": "Malware payload", "value": "f47350a3cca5e42c0bf4b195286f8c73c95e06860340cab69dd769627de8f0ec6e798dcda05f3466f0dbdcf211c13fa1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699851, "uuid": "e6d62c4a-21bf-4b19-941c-115957e0441b", "value": "103302C8C689D37698F17835AC79C701D978AA6E4817C46583F34AE7BC07E902B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699851, "uuid": "54321403-6912-4ab1-8d0c-8ef78247cd84", "value": "1536:IFugXVpoD8ZxhrLAuNS07MrxrKsYUh+WTB:Sq41rLZNkZLY6+W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699851, "uuid": "258e259e-760c-4ed7-a5c5-e36ed0d7b79e", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699851, "uuid": "15035c75-3db6-409b-98a2-40c9d0b3c3ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699851, "uuid": "9c610498-3592-4c51-aaff-c4fbce1d8515", "value": "catalog-1091424277.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a59e37-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658965, "uuid": "3218de63-7cc8-4de9-9797-c43621fc3574", "comment": "Malware payload (Quakbot)", "value": "8da89c6b8c6682d3f6d1dae190117f87", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658965, "uuid": "7a81aa47-f8a6-4f3a-a23a-0e1eac4d6def", "comment": "Malware payload (Quakbot)", "value": "061611a83d3fd10b88351c011313030cb2e2fd213b156ddc99b5d6480a0fe9f7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658965, "uuid": "4799a0e9-7adc-4150-9946-be1857c74cfe", "comment": "Malware payload (Quakbot)", "value": "4419408b5ef844a31d78035151f7f7fa5833b886", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658965, "uuid": "3b4d4ab5-834f-48f0-9185-94184119f8b8", "comment": "Malware payload (Quakbot)", "value": "111abf5bf30023487ca1ef4ac69a0187c1185acd4a89d1dd9105eb74e30eb7804b758908d961347aedcf14092f42c46c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658965, "uuid": "28952d85-bcf6-409e-9706-1e001bb958dc", "value": "2974BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE7394BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658965, "uuid": "4434999c-ec15-4fab-b098-1b4d79d8ea51", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658965, "uuid": "5db38298-1f82-4f89-a809-773e0ffdcb73", "value": "6144:XnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuS:AFrkNK11G9AEtMxQyOi61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658965, "uuid": "ef75d7f9-f9e3-4f8f-8ef4-ce810bf51319", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658965, "uuid": "02118ae8-d022-4283-bd6b-4ad3da55b189", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658965, "uuid": "14af00db-9b30-44ef-aca3-b6a1fb0c0601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f494a0a-a93f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619737440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737440, "uuid": "150ce5e0-3cef-440c-b678-63568ef0d029", "comment": "Malware payload", "value": "1a99e0181b9dc8a36e67d597e95270a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737440, "uuid": "a145b6fe-92ee-4667-be20-754ce17c7fdd", "comment": "Malware payload", "value": "061926814472b2ff94e017767d37f7ad174db70d3c5a3f24e86cfe0928c85b58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737440, "uuid": "396fb7e2-3aaf-45b8-a958-b2a57c6a1220", "comment": "Malware payload", "value": "81666f06075f65bb53114d3cd456b7b90fb94d48", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737440, "uuid": "f47b016d-5e71-45d4-ba8d-b51c3be3dbd5", "comment": "Malware payload", "value": "90c1e68de44516e064ffedb97e62baa0e937d5da3d9e5765f972eb4c5ee8af50db65de821ac1ef05cf2ed46880ddc030", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737440, "uuid": "d564dcf5-e3e7-4f9e-b4a2-24f4522a7200", "value": "70F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737440, "uuid": "10dffd3e-5b0e-4056-adef-24639b6b8741", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737440, "uuid": "a1b2b788-526f-4332-b101-e31ee96f7110", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619737440, "uuid": "08e55834-d455-4829-8927-e1ec0e004b56", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619737440, "uuid": "3a1575b3-e5eb-47b2-8f57-4ee70611dc1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737440, "uuid": "a9bc955a-97b0-492d-85e6-b376dd9aaa1c", "value": "1a99e018_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c12703-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704405, "uuid": "c1fa8762-89c3-4319-9d81-4d644f803744", "comment": "Malware payload", "value": "1b85908115805936e73a4aad02b8ca89", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704405, "uuid": "c9dd42ee-86d2-43c0-8953-216cedf23c12", "comment": "Malware payload", "value": "0621db1c6863aec0ab6d90d9c723df2213f13b7aacfbd5932e7eeb239bce3b01", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704405, "uuid": "6865b376-72b8-439e-a3cd-74203d593c97", "comment": "Malware payload", "value": "959ad155f510ff43f92883e68e986a3d0b50e537", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704405, "uuid": "1bea50a3-27f4-4aec-b05b-ce0f49812737", "comment": "Malware payload", "value": "3399e9ec3bbef67000889693b984fa1c37c7a44b035766ebe0c1e45194bf0216c65ae33d7e94d4b6f8d197fd73d367ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704405, "uuid": "c7458d3c-fba1-4ed7-b9d5-f77fdf644600", "value": "9733022A4C9E7B29577D10A04985CB1ED107A9EE3C6EC5412C4CF4B6EC05BA9163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704405, "uuid": "62660dfa-642f-41bb-b081-406458b552f8", "value": "1536:XP6z4+ADViS8CWoD94pUnQ64x11RiCBKGmy:fPZBiS8jopkUQ64xuGmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704405, "uuid": "bcd52f8a-d807-4ad7-9fa2-cb3fe4c9c4d8", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704405, "uuid": "4103f0bc-5731-4ca6-9717-44a170ab2241", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704405, "uuid": "250e58bd-d9ab-4f45-889f-c0b3248ba287", "value": "diagram-727405494.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4737c8-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703966, "uuid": "b4305d2f-dd06-4359-8eb6-6e0e40bce770", "comment": "Malware payload", "value": "cf9fedd7df94e6c6d99e2978cffa6880", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703966, "uuid": "c5c2139c-5a99-4851-ae1f-10d5c506ade1", "comment": "Malware payload", "value": "062909722b72b962e3d6f7b992830c47ac5e7452da7c5aff9c57d4072c18cdc0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703966, "uuid": "52a627db-d90d-42eb-bb99-ccbd2f61fd28", "comment": "Malware payload", "value": "6d185d47e72eb4767499d3a3795fb75ed5c1c2b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703966, "uuid": "06e85bde-c8c0-4e68-9c85-98ec619feb72", "comment": "Malware payload", "value": "d1233cdf3a67f9c3758f48c3ab58e5d8fe5c3df137a08fa2183d7834d3dd4d8e2a3f57e7e2a58752f9a240ad5dd62c4f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703966, "uuid": "6097eaa6-abe0-40f0-a53b-e1011f771ff7", "value": "1E33021A88AD7639537D10F05984DB5ED213789B381D86822CDCF4AAEC056AD163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703966, "uuid": "72bb494e-4ae5-4adb-a3d4-7e1c3914b0a0", "value": "1536:OP6z4+ADViS8CWoD94pUnQ64x11RiCBKygT:QPZBiS8jopkUQ64xutT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703966, "uuid": "3bddac23-06ee-4a22-afc0-95de411a7eff", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703966, "uuid": "49aad05d-1515-445f-af19-9e56d351c852", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703966, "uuid": "463a728d-64f4-4ea5-b03b-5b12e5bfed43", "value": "diagram-380014467.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69250a3-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706314, "uuid": "3a4aa11f-8fa9-455c-9698-9a39a314ca20", "comment": "Malware payload", "value": "0583828266aea701ee838461e295cce4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706314, "uuid": "53b9e1c4-75cf-4839-b228-1c90649d2310", "comment": "Malware payload", "value": "062a72ae37cf59906ef01328cf008c8bb0f0d7ff4273a8c11fb7cbeefd3ecb50", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706314, "uuid": "026a461f-4de8-4b18-9102-2bea3bb11924", "comment": "Malware payload", "value": "c71f9c4fc117865f061a49a2b02966c34b96cf3c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706314, "uuid": "0750cb0a-0c61-45dd-a02e-e7b12fac0fb7", "comment": "Malware payload", "value": "a40f42e4b5db1b9b72891ed2154664272afdba3f8ccd3f5c73e9347a6baa68f86adbd6a81a07328ad42f2a44fb9c449f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706314, "uuid": "7ad10d82-a899-4ea1-9c87-658518734b2f", "value": "793302194C7DBB2A577D00E48585DB4DE643289C3C6EC64228ACB476EC0A3E5167F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706314, "uuid": "f8fe6097-532d-46a4-8f77-02f59bfc694b", "value": "1536:1P6z4+ADViS8CWoD94pUnQ64x11RiC92S:BPZBiS8jopkUQ64xuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706314, "uuid": "3c890e30-bda1-4012-a387-434e4602fb69", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706314, "uuid": "1df5349e-f479-464b-ad98-6c3bb774670a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706314, "uuid": "168f79e4-0f23-481e-a4b7-c8d17bc15853", "value": "statistic-270607789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a04a0e73-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705847, "uuid": "8ada80b3-e36a-4bf6-bb41-dbd0b07f91fd", "comment": "Malware payload", "value": "01f62524d4d12b84182562a82eb39efd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705847, "uuid": "cabfb9c7-127c-4e01-97b2-31f81263e068", "comment": "Malware payload", "value": "062c814e92421222b6a832da124ef327c537cdddd361a709c6a41cb9c536b063", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705847, "uuid": "beaa5451-f705-48de-9acb-919a8986c3d5", "comment": "Malware payload", "value": "7f5c3f5e881c6ba44522d86c2622261f933c5b8b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705847, "uuid": "71f93620-49a8-4f87-9abb-10c317d813aa", "comment": "Malware payload", "value": "24877f04f7b01381108e650760f9f9ec029c0b85d595bacf82c776f8ce707648d1a6cd789e64e6a98f99aceb8cf27d77", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705847, "uuid": "09c5de15-d3b7-4e42-9a96-a7afc2cc570e", "value": "0C3302299C6EBA2D277E10F08185DB1EE553689E386DC5811DDCF469EC0A2E8113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705847, "uuid": "2d82ff4a-2672-438d-9be7-40e53580be16", "value": "1536:9P6z4+ADViS8CWoD94pUnQ64x11RiClGIz:JPZBiS8jopkUQ64xb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705847, "uuid": "ea062fb6-dd01-4c47-bafa-9d4929c64d0d", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705847, "uuid": "612dc051-1b9c-4ba6-9cc5-ec0508a6af05", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705847, "uuid": "df407a39-dab6-4e54-9be0-eec68f5e6a8b", "value": "statistic-1824468717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e2ca61-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699837, "uuid": "8946c630-0d74-43b6-b7da-c75798727252", "comment": "Malware payload", "value": "fb8edea0748eea6cf060167aa3daf3f0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699837, "uuid": "ce7d0fc3-a618-40ae-b019-7650af34a4a3", "comment": "Malware payload", "value": "063f3d30e90017fb6ffe77d3b1688899b6dc98460c94a5177c82a4e01643677c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699837, "uuid": "d040848a-f824-449e-b84f-4e13aa7dc597", "comment": "Malware payload", "value": "87323d0de633fd1f2e4f78209ffb36c6021cbd8f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699837, "uuid": "1fcd7971-0c71-4ce7-8a5d-775bdb235487", "comment": "Malware payload", "value": "e0dddc3481ee86da956cdfa8019bd32557d3ea3d65c86262ab6a0e2ce5ba725e866fe64b52642725a83618f502b7e8e0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699837, "uuid": "3cdae443-30c9-4382-b9b1-f2d5457ca346", "value": "7E33F188D68CD332A4FA34355C3ECA01E9B8AA9B0416C56281F78ADB7C07D941B4BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699837, "uuid": "5d958d84-4359-45d3-a372-b20c70e64bd3", "value": "768:nwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2v:+FugXVpoD8ZxhrLAuNS07MrxrKsYM+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699837, "uuid": "f1bd6fd5-8557-4d72-ad40-b4b507027cda", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699837, "uuid": "634266cf-8ff0-4992-ba80-aaf3b6d1ae56", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699837, "uuid": "e3aa71ec-67ba-4225-865a-e07e32c2a5b0", "value": "catalog-1073551151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf24001c-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702892, "uuid": "d7028476-d1d5-4c1e-be8f-d23f805bc607", "comment": "Malware payload", "value": "751b0af5097539eda0486bb84b93ad8e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702892, "uuid": "320af314-94d0-45ce-90da-8763ee7e83a4", "comment": "Malware payload", "value": "064b92120af0a830929e581d42af2a24a2a76411aa8ffc031851b01746ed417f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702892, "uuid": "2a35f468-19bb-4c4e-a080-4d537eee95c7", "comment": "Malware payload", "value": "b0cdde127cac333a8ef207c24389b3aa8f9da04a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702892, "uuid": "19ac5f83-7963-42e5-a5cc-b60eb2cb5ce7", "comment": "Malware payload", "value": "e92cec699f65730ae48f0b89dc54754b72f77935b5bde50e376c80df25d54279736f4e0c7b1fc3641dd67ec575dbe9cb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702892, "uuid": "4e24136c-1a3b-43ab-9126-e73b1efacfdf", "value": "AD3312299C6E761E572C14F08885D74EDA1328DD386DCAC31C9CF46AEC056A9123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702892, "uuid": "e5e1685f-0220-45e3-80bf-ebbf911350b4", "value": "768:C9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCDhU:LP6z4+ADViS8CWoD94pUnQ64x11RiCDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702892, "uuid": "9dddccd0-f91d-4635-8e61-64e32e21a6fa", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702892, "uuid": "a6509b30-042a-4804-a8af-ef679c1699e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702892, "uuid": "b137efa1-9e93-4590-9c50-18c0adc26091", "value": "diagram-1535273299.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b696878-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658970, "uuid": "50bd1ad3-72fb-4786-8ddd-b1ad98374042", "comment": "Malware payload (QuakBot)", "value": "12f88b556548e177ce04e98fb0aff845", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658970, "uuid": "89650960-0278-43c7-a213-e6daf5919822", "comment": "Malware payload (QuakBot)", "value": "0651a510d3d281086a05fb478516c6a442f609c9b4ac38eab7906e2a6e53c53b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658970, "uuid": "e39b832b-eb43-4fb0-8806-de5ec6da7225", "comment": "Malware payload (QuakBot)", "value": "67c0996ab2093cd4d923b995a5693168a56d6bea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658970, "uuid": "fb1d0676-b051-4188-8e3f-a5ef0e0df14d", "comment": "Malware payload (QuakBot)", "value": "946cd223cfa52fccecc404bf72583fc36cb0abc8f740047fbd49744a07eb046b979cf8339e981888e3d957757cd21fbf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658970, "uuid": "10fe0706-d004-4e7b-bf05-b00eb8881b2a", "value": "6A74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658970, "uuid": "4a92dd52-1191-4127-b0d6-128fd4cbc99b", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658970, "uuid": "96071b82-90ce-4d04-9de5-c8273103783c", "value": "6144:GnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuN:pFrkNK11G9AEtMxQyOi62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658970, "uuid": "b852920c-ef55-43ce-87f3-5c2b409ea720", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658970, "uuid": "5dea4bb8-9e7b-46cd-a285-84b1c22fd32f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658970, "uuid": "8ecb8642-d19a-4e9c-83c1-820f4efa3739", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b141233-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707019, "uuid": "7e47c44d-9923-417a-83df-7353466ec220", "comment": "Malware payload", "value": "c9ed0064596b4828070a6b190900dec4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707019, "uuid": "d0420165-1784-49f1-90da-3e6ca479eae4", "comment": "Malware payload", "value": "0661c165a6e6c5779189b0ba8e7f50b48fef4853d9dd69c4dcc8ff4436511a99", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707019, "uuid": "7ef01999-23c0-45f2-943e-3d092b8746d3", "comment": "Malware payload", "value": "9db90303a9baa517446b4e63b81a0db3ecb4abfb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707019, "uuid": "a9b2dacd-f499-4900-bd01-c7e2ab065fda", "comment": "Malware payload", "value": "3e20cd4357343d674b5b5667d78c2aa1ecfb9b6050c98e015e5ff1e1849dd1710583b5bb655a2eb7d16f5de5f55025e3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707019, "uuid": "863098a4-d63c-49b7-8b76-f0b52cee2986", "value": "D233021D586DBB29632E20B48685DB1EE21728DD346DC6821CDCF466FC052A9023E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707019, "uuid": "3683e937-58fb-40ae-83a7-32721ebbd250", "value": "1536:jEP6z4+ADViS8CWoD94pUnQ64x11RiCo5:+PZBiS8jopkUQ64xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707019, "uuid": "01fe90fb-0972-4943-bb11-6dcb7da81b21", "value": 51484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707019, "uuid": "c67b09fe-a990-473a-a74b-9014476f089b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707019, "uuid": "a76de616-4d98-4437-bbd7-467f0384cbee", "value": "statistic-68570073.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef74fdc5-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703403, "uuid": "8456e9af-c232-486a-add9-271eea4dc134", "comment": "Malware payload", "value": "2b02db7dae47522faae8bdd6f1ee721a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703403, "uuid": "3c5923e1-b995-4225-8534-713c0ff85f68", "comment": "Malware payload", "value": "06844005c10bab5887dca90064d852dffe718b01963afe6295e0d690a208ee04", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703403, "uuid": "6f03d790-332d-4519-9194-eb32cb137d42", "comment": "Malware payload", "value": "5085c5abc6c61ffdaea37b70e6426df1bf2794f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703403, "uuid": "4e81c50b-03b7-4995-9f4b-ea3997c4baa7", "comment": "Malware payload", "value": "443e24db5699973bb226b52414869c1e589973a48e52eba843a2fc56723e512393a310826e3f97f1a3f7a14503ece5ba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703403, "uuid": "0cd15a66-7b5b-4eb9-b6f3-9fbb71f68438", "value": "7933021A8CAD7639533D10F049849B5ED617789A3C1D86812CDCF46AEC0565D163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703403, "uuid": "a4d8661b-da82-4dee-8d08-4570982c86ea", "value": "1536:iP6z4+ADViS8CWoD94pUnQ64x11RiCBK4ly:cPZBiS8jopkUQ64xuqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703403, "uuid": "3406373a-47d0-4a68-863e-6cba0851ce17", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703403, "uuid": "8d6852a5-a0d2-4b2f-97a4-a81b7840bbeb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703403, "uuid": "93e9887a-d56f-47e1-9c97-3e5613085e87", "value": "diagram-1856689492.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c169919-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704337, "uuid": "26fecfb6-bf1d-4408-9380-d72db6c5ac4c", "comment": "Malware payload", "value": "14f382216b10859cc0741e05f5d60d57", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704337, "uuid": "d6d300d8-ccbb-45f4-957c-f4e65fbedabf", "comment": "Malware payload", "value": "068b5451649bcb5c3d86bbc16b5e49e6dbcec6406801f1da6562171223c3dd79", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704337, "uuid": "868520a4-22ab-442a-89e5-7ec62213ecfa", "comment": "Malware payload", "value": "b681168910199b72ebcdfc196344eba3d362ca32", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704337, "uuid": "d8bbdc0c-a333-4a44-8dfb-c3a545fe0bfc", "comment": "Malware payload", "value": "dc97156cce5fac850868412ed2cb38f26389e727b1868ab794d92637a7320828d6f132bcbcbe5eee0ba6219f1d921b57", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704337, "uuid": "0ce48b14-64a8-4a5b-a3ef-9cd4b73f866a", "value": "2C330225889E753E537D00A68545DB1EE51B78AE782CC5812CCCF4B9EC062B9123F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704337, "uuid": "339f5c42-685b-4b06-b804-626c3e606887", "value": "1536:BP6z4+ADViS8CWoD94pUnQ64x11RiCj1T2:lPZBiS8jopkUQ64xzT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704337, "uuid": "d2867d3b-6b36-4fbc-911b-732c455f83ef", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704337, "uuid": "227b5323-169f-4e45-aa35-db6f3348c021", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704337, "uuid": "cd0c4fa6-8d96-452f-9f4b-8dae0e4f74e1", "value": "diagram-691650062.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5304cf8-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701560, "uuid": "d7063df1-dc38-4408-b3b2-54f3f5581e63", "comment": "Malware payload", "value": "8a2b5fc1f01d36de742b9924ea078810", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701560, "uuid": "0c42b3e0-b138-44e8-9e6f-ebc259a11061", "comment": "Malware payload", "value": "0692222f7b80c4f53d92f49461165af93a90929c5fe8d91544f0d73738c8adac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701560, "uuid": "04cb2786-2ecd-4074-b4c4-b70756255a7c", "comment": "Malware payload", "value": "45b5fd6cf07d35d0e3bad00ccc298ac52c07b865", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701560, "uuid": "10624b41-eaea-4e76-8b41-db0e3ced6aa6", "comment": "Malware payload", "value": "ed3104b387e64b923f816185f1078704b4684a90ffd0e42b25d68082d485fdb8781efb87ce328eabcd21fc5405848b2c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701560, "uuid": "57d1dd22-6a86-4f66-890e-948e3e34f123", "value": "773301CCC689D37698F17835EC79CB01D968AA6E0817846183F34AA7BC07D901B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701560, "uuid": "6b5f972f-d4c9-4b41-a8fe-4f88f2a27a0a", "value": "1536:BFugXVpoD8ZxhrLAuNS07MrxrKsY4h+WTs:hq41rLZNkZLYu+Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701560, "uuid": "32da9b94-8dc2-415c-87e9-a446374650ac", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701560, "uuid": "58250c40-c25b-4b5e-bad7-d4dac3e7dc98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701560, "uuid": "dc8c1118-a803-4c18-a8a9-1abe6e52b10e", "value": "catalog-478484820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e50e5e3-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658975, "uuid": "8a555454-459c-4e1a-9d99-739cc7c5c17c", "comment": "Malware payload (Quakbot)", "value": "c4e506aada22abb46a69e989d2273a2a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658975, "uuid": "886dd1f2-6eb1-4ce5-bf54-7a311c7335dd", "comment": "Malware payload (Quakbot)", "value": "0695cd35445dc2f5b9bd2028e09db9449d61be3e1aab0a3047d822634afd2df1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658975, "uuid": "37a3e8ae-9bd8-4cfa-843e-ccd1a21920a1", "comment": "Malware payload (Quakbot)", "value": "a55bcb89fe4d8df899065d9afbde01f324f507b7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658975, "uuid": "ab46342b-a89c-4690-897f-07b7580b4053", "comment": "Malware payload (Quakbot)", "value": "8756b62765e7a54bd7551e84e7f6ee70759d0b53d2df54112008be24906595393435187780b26f5fa2deae7d15525bd9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658975, "uuid": "903b079a-c343-43e7-bf82-394655ab87c2", "value": "6874BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658975, "uuid": "20b12678-8058-495d-83a7-438013aae804", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658975, "uuid": "7194b3cd-6f29-4a75-b5b4-37a58eceda8b", "value": "6144:2nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRui:ZFrkNK11G9AEtMxQyOi6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658975, "uuid": "b5a94c39-7529-42f8-b8a2-27763c5d69d0", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658975, "uuid": "bbbd7f97-2828-4525-a8ed-b8401649e973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658975, "uuid": "42a3cb66-36c4-4e08-a52d-bf33247807df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62111a92-a8e1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619697153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619697153, "uuid": "e26cd213-5077-4a87-96c3-ac0b8410d8a6", "comment": "Malware payload (Dridex)", "value": "f13ed91d624b33f6643f68e8740b195f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619697153, "uuid": "764836bb-1714-4ee4-9839-e02eb4ba2f28", "comment": "Malware payload (Dridex)", "value": "069e8128408552cfb9729536e93213b3c2fc4fc98e351e8b624b0b6f76fb2418", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619697153, "uuid": "7e3f8e52-a08d-454e-aa59-4aa80e63a55d", "comment": "Malware payload (Dridex)", "value": "f1c25d3935de68e3e7f8454f42c065f2ed164591", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619697153, "uuid": "9eee3516-1bc0-45f9-829a-71a07e1ae6ad", "comment": "Malware payload (Dridex)", "value": "b5dedcb0d8bc45fd9e6218acc8bee5d271b8d30edf620454de7db5080aa46872b6de0142589521669320006e1728fe41", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619697153, "uuid": "4a999b2e-f0d5-4cb0-81f2-11f714c3f40d", "value": "C8F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619697153, "uuid": "879cad1d-fdc1-4223-805c-f174060fb690", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619697153, "uuid": "e4e0b655-89a6-492b-8574-c3892fa8e0cb", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619697153, "uuid": "97d005a8-6ce8-427b-b7eb-4e49d51541df", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619697153, "uuid": "62a74ac1-2365-4ffa-bb04-75412a9fe6d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619697153, "uuid": "44c08e19-8ca5-4360-b01d-703022c26174", "value": "f13ed91d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf0af2c-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705813, "uuid": "c8857756-9268-4278-859c-8d656028dd14", "comment": "Malware payload", "value": "8e570404016963721d421f0fdca0a452", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705813, "uuid": "89f1438b-dc5e-4647-be81-8dd269766d06", "comment": "Malware payload", "value": "06b751cc18e7d7146d425e74d11fa56c35d0c49835406773c9e3cef7f584a480", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705813, "uuid": "41631aae-764c-47bb-9435-6bd3a72b738a", "comment": "Malware payload", "value": "0698e0881c5ed9d77fa05edb600a6c962bc77aa4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705813, "uuid": "db8c0a35-d844-4a3b-b884-d8459e2c6fa7", "comment": "Malware payload", "value": "3cb35bd93e15f004dd779739377eaa0cbc9f93282533ce1466af9cce31fbbe01dceb0f9bc6ce239ef45662c1911b4551", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705813, "uuid": "bc96a5a9-7474-4efe-a64a-74d5c4d93c97", "value": "C033022A8C5E722D576D10B4498A9B5FE61718DD386CCA8218DCB8E6FC416E4073FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705813, "uuid": "a9e9cb5a-166f-4421-92ac-71313d408f79", "value": "1536:fP6z4+ADViS8CWoD94pUnQ64x11RiC48B5y:HPZBiS8jopkUQ64xBBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705813, "uuid": "9956142c-e8a0-48f4-aeab-3140ae97218e", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705813, "uuid": "f110e60b-3ea5-4e95-8ce8-bbefc402329d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705813, "uuid": "ec27d197-1b94-461e-bb0e-0b628eb4bdcd", "value": "statistic-1797656281.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813263a2-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658980, "uuid": "3b760be7-2162-4294-a9a5-388e7b4fa284", "comment": "Malware payload (QuakBot)", "value": "8c68d0576db099a39c3fb45483192b03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658980, "uuid": "147c1478-0605-4b5d-9032-6c61aef00505", "comment": "Malware payload (QuakBot)", "value": "06b8573f93c9d130323228ceb80c92f153e3fa885010152e7de8e85ca4ca35d9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658980, "uuid": "11271cd9-0f03-4b37-8106-f6fcbdd7243c", "comment": "Malware payload (QuakBot)", "value": "84fdaef68ff9154bf3e2f8b9a5bfe8a85662470e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658980, "uuid": "ec379cf1-2632-4ebd-8042-3e6a8f78c78f", "comment": "Malware payload (QuakBot)", "value": "a3cd4d8fa28be3ed7ee66894b72498dcdfbb05bcc156dcd3cf7586e8ef6239a88dd6c950eac1e9eba38cfd99626b34b3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658980, "uuid": "ecde5bf7-1fd8-4b08-90b7-cd768049738f", "value": "A974B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658980, "uuid": "546b4fd1-061d-4926-a7d3-4ea0fc64938f", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658980, "uuid": "f8950c53-db7b-47bc-a4e6-e88efb7db663", "value": "6144:1Tfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuC:1bi7/xZrkNK11G9AQyOi61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658980, "uuid": "f205d4cd-59b5-4a09-afde-7805ccfa32fd", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658980, "uuid": "ad6c8294-687d-4e86-9dc5-4c1161ca911f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658980, "uuid": "15b08e2a-5730-4f33-9d5b-7fb46e3b32c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f5acb9-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658984, "uuid": "472a5bdc-636f-44c1-ae38-0fa73b39807b", "comment": "Malware payload (Quakbot)", "value": "1caa54386ccabe65cec567660b6971b1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658984, "uuid": "aad4ff44-5c90-4067-a4c1-b43d83756ea7", "comment": "Malware payload (Quakbot)", "value": "06c5c182f4498c30da54362ae3d04610b4e402459d89ae6c1b125fec5d5f3471", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658984, "uuid": "d810673b-3783-4f3c-a8de-b5b9ebaaf560", "comment": "Malware payload (Quakbot)", "value": "ed5f7e529e51d13aff71772db79e4849cd3f6364", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658984, "uuid": "ad930646-62ca-4d58-9fd6-1fb14cbe98cf", "comment": "Malware payload (Quakbot)", "value": "a643a1ce816bf13fb055a85e463d235f1fb850d10bcf4ead0621fb56f7bc238fbf7f9a630c388fc7bf323437e2ba97cd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658984, "uuid": "07ac2c01-30a5-4b01-9e1f-bd3557deb251", "value": "8274BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658984, "uuid": "bbe44ccf-a601-4704-afd3-3ca132af8e51", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658984, "uuid": "655e41b4-6bc2-4d66-a152-55a12f735fe7", "value": "6144:MnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuP:bFrkNK11G9AEtMxQyOi6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658984, "uuid": "5a589fc7-621f-4e49-a945-63663ae7c242", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658984, "uuid": "a694af95-d63b-41a4-b5f2-13e58def5638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658984, "uuid": "c9f43110-52bd-455b-a858-d0ec9e46ad7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27526fe2-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705215, "uuid": "6593d8a3-fc94-41d1-a39b-db328abce0a3", "comment": "Malware payload", "value": "3a2a4facfc2e95a1202c9b0e4b3631d4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705215, "uuid": "72196329-cf00-411a-a7e9-12c862d4095f", "comment": "Malware payload", "value": "06ce9611509cc7d987d5d3f623aaf10775cd194fa17b6b77aff730e60f86d61b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705215, "uuid": "77d637ce-f784-4744-866a-bab04d466f57", "comment": "Malware payload", "value": "56a0842f7ca3325c8a2bdc82bfbd590584765068", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705215, "uuid": "10191a6e-f719-4987-8fe8-f16d3e781fd0", "comment": "Malware payload", "value": "63420a2029fb6c74cc6d4b2aed23ac682e9254207fc9342545167b651beb89a735588aebb0f247872af9f3ed8ed3d9eb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705215, "uuid": "c5226eb0-cb63-4c15-a660-b60d2ca7a02c", "value": "D13302298C6EBA1D577E10F08185DB1EE653689E386DC5811CDCF869EC0A6D8113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705215, "uuid": "f60738d0-e3e7-44fc-bb2b-bbaae893abb3", "value": "1536:ZP6z4+ADViS8CWoD94pUnQ64x11RiClGZH:dPZBiS8jopkUQ64xbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705215, "uuid": "9b7baa01-da3a-405a-a684-729a9e55d764", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705215, "uuid": "5ebc8357-e96d-4f8a-88c1-a36a2b640c34", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705215, "uuid": "f82e587b-307b-4238-8725-b9d50c1143ff", "value": "statistic-1282352601.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6648575-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704998, "uuid": "9d04ed2c-d8b4-4c3e-9f80-7f66c2c6180e", "comment": "Malware payload", "value": "7a334a4fab071295b0b7f2eacbbac762", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704998, "uuid": "e89f3b10-db3d-4f36-9d1e-ac6fdcc34df2", "comment": "Malware payload", "value": "06d2bfcf127d119ab122675534a3fadacaf24832262ac2fd6ef93c5261db5be5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704998, "uuid": "02b69bae-5d89-4b8f-a1f8-629078ca298c", "comment": "Malware payload", "value": "c0ac17852b1cec08b7fa38db098316d083096ba7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704998, "uuid": "220be69d-a6f0-4201-aee9-5f67268e5ccf", "comment": "Malware payload", "value": "9030a23514f9034ccbf2a4883ad08f25ef20afc1d4a23048d16280cd77f92d0aba89bca26337b934d95ae052750c3e17", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704998, "uuid": "7f151351-21a9-4519-98f7-7bad6c200daf", "value": "3433023A997E7A25133D20F086449B5EE65375E9386DC9820C9CB462FC0A7E9123F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704998, "uuid": "b218948a-bbec-4f58-a405-891c59dbca00", "value": "768:u9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCIPu:fP6z4+ADViS8CWoD94pUnQ64x11RiCq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704998, "uuid": "2f65be07-e44d-4d5d-9044-5d4c33a57c61", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704998, "uuid": "4cfb7ab6-fd00-4b97-bfc4-027e79a5534a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704998, "uuid": "760616ba-6484-401a-9c21-0a2b747caa60", "value": "statistic-112744056.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b71841-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658989, "uuid": "75822597-d427-4e68-926e-e748a802c178", "comment": "Malware payload (Quakbot)", "value": "e8be3630eb3b563613ffeb676a92fb14", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658989, "uuid": "d1cc4798-1e5c-4f57-b8a7-63c7be72d7fd", "comment": "Malware payload (Quakbot)", "value": "06d59105fcf2b1d5d5b27bd75b9f8e14987c25be58f03098beb2e174dbd38e10", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658989, "uuid": "4cf8b73f-da19-4187-b414-d5946b32db6c", "comment": "Malware payload (Quakbot)", "value": "f456df68bf6101a427fa4d0f5dfc5af64f7279c4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658989, "uuid": "6c7269a4-84bd-4d30-a9b6-3a448b8aeeac", "comment": "Malware payload (Quakbot)", "value": "496a8e652e5f666c2d002eee13fcb3e8e2970e953a99507bc49adec2de961eaab76dd8a61b248ea2d97f68e04d461133", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658989, "uuid": "5c9280cc-0a2a-4ec5-b85a-1695f9850c65", "value": "F774BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658989, "uuid": "442250d4-9586-4a4c-99c8-e9e97fb6b020", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658989, "uuid": "1551e72f-9ded-4a29-ae80-0cb95714384a", "value": "6144:znQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuI:EFrkNK11G9AEtMxQyOi6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658989, "uuid": "2cf6fcee-23cf-4f45-a474-fbd2816905e7", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658989, "uuid": "3e0794f9-3ffb-447b-bba6-e605d11b6e56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658989, "uuid": "3ca450ea-0633-488b-96db-b7f2b2a911d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f5cb62-a87e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619654552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654552, "uuid": "eba366ef-066a-4f53-a811-b6cc47e6ed7a", "comment": "Malware payload (Dridex)", "value": "686f84422c3484f5009995a8dc869b09", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654552, "uuid": "de7e3f93-540c-4f97-b39a-2c4727047e61", "comment": "Malware payload (Dridex)", "value": "06f0e4203ff3d9b87437bd8ee73e6b58f63988e2457a15720394b792a480cefd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654552, "uuid": "f00521d4-5518-4d3d-b753-312525bff7a1", "comment": "Malware payload (Dridex)", "value": "1827246a963467a66a2789f7ae1437eea2fae866", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654552, "uuid": "98fd7af1-c72f-4883-a946-81a341aa8b41", "comment": "Malware payload (Dridex)", "value": "d4d06ca00bbf1d48d538cf9207e956b2fb54dd03f43a1343f131486be29847820579fb7fed1c15642a6410471ca768b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654552, "uuid": "14be2cc0-41e7-45e8-b49c-ac6be471a3c6", "value": "83F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654552, "uuid": "b9e37380-fcd0-4d1e-8b84-dbf2ba84c61d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654552, "uuid": "fbaa41bc-1ed6-4a4f-a86c-07c356586b70", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619654552, "uuid": "8e50539f-b3f5-4e26-b242-4923e911e1b0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619654552, "uuid": "e9416f4f-2a9a-4101-bb34-44a65f8759ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654552, "uuid": "9cc06ec5-845a-441a-a2f3-76a35afd91ac", "value": "686f8442_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1dd5d2b-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702924, "uuid": "050ee3cd-f1f8-4144-b271-9d8747c82055", "comment": "Malware payload", "value": "16402c005334227d156925c3d649b9c2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702924, "uuid": "b715ca64-705c-4e99-8162-b1116767e83b", "comment": "Malware payload", "value": "07071dfedf5bae21a13d9f30584c471a3519053530cd98009909f93d2067e147", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702924, "uuid": "72a4712e-a76b-4554-87ae-72f23c65f02e", "comment": "Malware payload", "value": "94f1f0f2026b95b2a126dbb1f6897a6baae970ad", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702924, "uuid": "a86aedbe-fd75-4d21-9dbc-436d6807e747", "comment": "Malware payload", "value": "03f153fecf7e41c897c06bb32168976c8a6e611498b782126dc0b8ad6c3913eeac1f692f6fe54743158c41af40d39b6b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702924, "uuid": "d75a723f-f360-45b8-89f6-05453e06c250", "value": "2333022D5CAF762D277D10F48485DB1EE64768EE386DC9821C8CF4AAEC01295163EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702924, "uuid": "56925e52-ec95-48ef-a087-ec23ea91d530", "value": "1536:ZP6z4+ADViS8CWoD94pUnQ64x11RiCRCvt:dPZBiS8jopkUQ64xnCvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702924, "uuid": "cbe40b77-352e-482c-88b6-3f662805efda", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702924, "uuid": "56b7675b-3fbc-47c7-9bd0-6dc15b80ff33", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702924, "uuid": "243f7da6-aa26-49cd-83bf-9d1c839d853b", "value": "diagram-1570795078.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897bb436-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619658994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658994, "uuid": "3892f35e-d6ce-43ba-a615-2dde1dad8483", "comment": "Malware payload (QuakBot)", "value": "c51545aea6eae730a0f2dda8bf5962e4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658994, "uuid": "c18b5e06-87d4-44a9-81d8-1ae099015d95", "comment": "Malware payload (QuakBot)", "value": "07262f4172988d3b896924de8f170f448b66c087b18e589bc4b36646716ba571", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658994, "uuid": "327da689-5423-4ceb-ab12-4810ea028101", "comment": "Malware payload (QuakBot)", "value": "0bbd8930f7f95edcab205ad7edc269f1613c44a6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658994, "uuid": "8517ab63-1e2b-4894-b8ca-01095fab5980", "comment": "Malware payload (QuakBot)", "value": "5138e224460c0b776635d90d9334a5e3d83a5eaf49a56fdb47fb95d45969a38791cb5eceaf2f82354be2de4729b6cc78", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658994, "uuid": "deb529a9-ff4d-40e7-8c16-681f48c5030d", "value": "CB549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658994, "uuid": "04441c5c-e2c2-4766-87b2-2856925028b1", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658994, "uuid": "065167c4-4e41-4451-8d5d-dfa89caacd13", "value": "3072:q3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZp3:Gvv9sMoXBaRmr/dukbvuZ/7fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658994, "uuid": "7ec86a5d-cc85-40d9-864a-4f6d6b8c0f97", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658994, "uuid": "de2632bf-96e5-48ea-9341-d53839b5fe62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658994, "uuid": "7f17cf3c-114d-4ead-a77b-6956376a2ca5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbd5092-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701920, "uuid": "eb3fdd32-bc13-4fc3-8272-942b08b9abc2", "comment": "Malware payload", "value": "f306ce5cd4ee90ed327beeb447d66b5c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701920, "uuid": "f29fda91-3c7e-44c3-aa92-4956bb284205", "comment": "Malware payload", "value": "073d7ab9808a5593d7324b7c10605c1ab1d9bb3c10af8d92154dc015243b5cfc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701920, "uuid": "e38f3166-253a-4485-ae15-7992f9dbd54e", "comment": "Malware payload", "value": "79a8ec675eaf4e9e05b897ee5e202788af66fe31", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701920, "uuid": "776fd6df-3905-452a-8e0e-a6c7a142fd0a", "comment": "Malware payload", "value": "0e665879ec20fbea4786d637c6e61a8ec97904fffd4d68fb44e19420b46ec496fc1c70717b9d262e6bc9cce7089b8e53", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701920, "uuid": "dfd70d8c-6227-41d0-98df-021fa706a464", "value": "62330148D68CD33298FA34355C3ECA01E9BCAAAB4416C56281F78ADB7C07D941B4BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701920, "uuid": "caf8551a-f82f-49b3-84e1-f94db1cf14f9", "value": "768:JwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV24:QFugXVpoD8ZxhrLAuNS07MrxrKsYMPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701920, "uuid": "80bd0e61-29f5-46ac-b403-e2acc4e9ac03", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701920, "uuid": "5cdddb23-fe9c-4bac-bade-171041256a51", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701920, "uuid": "8cfdb17f-35f4-4363-8362-0702eaed190f", "value": "catalog-755639412.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5dac6d-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619658998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658998, "uuid": "cdc8b899-f719-4cfa-82e3-1bf5af9c819c", "comment": "Malware payload (Quakbot)", "value": "52b981f64188ded44b76e12ff3b53927", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658998, "uuid": "cb87acdb-ffaf-40fc-9759-69250c0e343e", "comment": "Malware payload (Quakbot)", "value": "0746f653480780c1bade65e4bbda696bf2a013be180ce845ca9d3330a9df0adc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658998, "uuid": "6d6d1804-ea2f-462e-828b-68f26e7632e7", "comment": "Malware payload (Quakbot)", "value": "46996d3128b07a26bfb9b80b5e96c2adb601c20e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619658998, "uuid": "6ab36bf7-8296-461d-a07a-4ceb04a9200f", "comment": "Malware payload (Quakbot)", "value": "3a9a1d175f2a3c1c7d39708dcaa53b6dcbf70807567536d94c948dd9327eabca16ed3960ed616f0a0d1a31dc34a118c0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658998, "uuid": "2ddef959-3771-4f11-83fb-2db2818ed03a", "value": "25549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658998, "uuid": "6d3a4194-2f67-492c-969c-83c490e99d38", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658998, "uuid": "14cb8bb0-1510-4e2c-a626-155864f1b68f", "value": "3072:H3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZBE:Xvv9sMoXBaRmr/dukbvuZ/7fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619658998, "uuid": "3c064e82-1f9e-4e2a-a4c5-0faf605c4991", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619658998, "uuid": "79aea67d-4161-40f2-9c3e-4de95bef2f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619658998, "uuid": "d4a5131c-41b1-4622-a43a-62c3eba2221e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2296cc-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659003, "uuid": "3249f070-1dbb-4c3a-86ac-0de0d3bd163e", "comment": "Malware payload (Quakbot)", "value": "28f08e7d246b5e345630cc7e6db85b3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659003, "uuid": "8dcd7e04-b689-4f4e-9900-7bc36ab069dd", "comment": "Malware payload (Quakbot)", "value": "0754eedb2ad48a7e9bc9c3f3bd8b501c6df95ac348397111841a2c67c4d50933", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659003, "uuid": "8aaa4250-8e78-4b5b-9f1b-87843e737a5e", "comment": "Malware payload (Quakbot)", "value": "6ead0d7d2327757995c0bb5568e523587d8c9207", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659003, "uuid": "cff82eaf-4909-4d93-9c3a-7c75c30c962d", "comment": "Malware payload (Quakbot)", "value": "f6b59f630c83ac3b82a8c4cb11e799f111a283d01412df9bacbe4377a99f357fc2edfbdd5c44a76180bb9f4db79f2fbc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659003, "uuid": "fb55dcd6-15f9-4bfd-970d-89f18b595346", "value": "2274C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659003, "uuid": "7a6eec06-11d6-4d65-acb9-7a12b182456a", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659003, "uuid": "bee28e00-f88f-412b-887d-aaa751147840", "value": "6144:kTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuB:kbi7/xZrkNK11G9AQyOi6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659003, "uuid": "16c7f218-08a0-4489-b697-87746b816826", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659003, "uuid": "edb07245-7f50-4f03-bff0-2c9551936904", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659003, "uuid": "840dc8b8-b6d0-4fe1-9424-44b4c116c3c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caee9f7-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702673, "uuid": "496e9e26-80e2-46ec-b093-a4b64ee77160", "comment": "Malware payload", "value": "375440e4985a381803ba2184482cb82b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702673, "uuid": "c23619fb-8e6f-4f89-8024-145940863d63", "comment": "Malware payload", "value": "075f81c8aa50af25337046d1946696d70fee97d4df10207a7f3a47712078edc3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702673, "uuid": "14d64ae4-3e61-4c36-b4ef-bbb6ff84e37e", "comment": "Malware payload", "value": "4c3d5cb1775dc8fc8946d57376ff63ea52a028e9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702673, "uuid": "9e529819-4de4-4b3b-b57c-d7e5e45815ad", "comment": "Malware payload", "value": "b40477f4c11469c012de7f037b730ecd50b84a4c505eccb8dc3a970467e8248eecdfa27e9173a65b287ff6bec4ed1cd7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702673, "uuid": "41e0a462-6278-4f5a-a5cc-fa07d5fe216b", "value": "F733021E5CBE3A29572E10F085459B5EE51718DE386DCEC21C8CF4AADC052A5027FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702673, "uuid": "bff8bdba-75b6-4414-ac11-adffdac2be97", "value": "768:o9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCPQc:pP6z4+ADViS8CWoD94pUnQ64x11RiCoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702673, "uuid": "33ceceda-9f9f-4cd6-a501-c833361d0187", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702673, "uuid": "f04975e9-5508-4647-9b0c-69a1465218a6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702673, "uuid": "06c560f4-2375-4ff6-b8af-21e5bfe076c8", "value": "diagram-1379219526.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ec8d23-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659008, "uuid": "cf9a9d53-0b81-4aa8-abef-590ebdef7e43", "comment": "Malware payload (Quakbot)", "value": "f8e79383bc29551a307d7fef2d688a4d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659008, "uuid": "49089623-0e9c-489e-925a-58c9467538a4", "comment": "Malware payload (Quakbot)", "value": "076c66b22f63309e4592e7302aae3e391e38b16c905cb147fe89e451fb5c3479", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659008, "uuid": "33f469aa-e81a-4ae0-802e-63f3ff816cbe", "comment": "Malware payload (Quakbot)", "value": "1d2a65b0ddf85288256a2247fb25eca3f278482a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659008, "uuid": "1c18cf1d-f653-4c8c-913b-a53ae38bc4db", "comment": "Malware payload (Quakbot)", "value": "18f58bf97b77c703ff3aa80be8f950efbb36aded4bc018be8180e4821d478b57eb994aaa197ebd0fc457a2b6287dd227", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659008, "uuid": "aa8fd1b8-48a9-44e5-8775-4fbc8d21c236", "value": "AF549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659008, "uuid": "46a7aadf-7f1e-42c5-a2dc-912a5493558d", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659008, "uuid": "f61218d0-83c2-477e-aa64-70e6136d0710", "value": "3072:U3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZBQ:Yvv9sMoXBaRmr/dukbvuZ/7fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659008, "uuid": "388768d3-05c1-4143-ba3d-c3f2e9389130", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659008, "uuid": "692de1fd-f5f9-4959-a4da-63b61d76792b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659008, "uuid": "522f4634-9e40-4e29-b76a-85634eae76ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f846278-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701846, "uuid": "ca79b259-ba1f-45f1-b7ab-1c3cba9f3cf1", "comment": "Malware payload", "value": "763592d1b736c0ea3dd54bca945b50c2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701846, "uuid": "d5770074-d053-46d6-80e9-0dee1b8a6d97", "comment": "Malware payload", "value": "07711e06b0f2879df475ff02e81eea3387e1aae1fd2ce3461234b4c2ac811edf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701846, "uuid": "e8315c92-8c0e-4047-8395-36959f92220a", "comment": "Malware payload", "value": "07c0dd4e23b74f3f5e58c221dd0b0a5fdfa292de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701846, "uuid": "299135ae-4994-4a09-a8e7-3a6ec07968f8", "comment": "Malware payload", "value": "9aa7d4df8b68a77d33bc2c536b442dee73ad36a76056a599d38c7454dcea642f387f25818354238efd6117cb68b88194", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701846, "uuid": "c8e68da6-e9cf-47aa-b849-093942e0c8a5", "value": "CF330188D589D376A8F67436AC3ACB01D5A8AA7B4817C452C1F34A977D07DE1270EDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701846, "uuid": "fb6e0acb-38ea-4fc3-b2b6-bb716d3da94a", "value": "1536:vFugXVpoD8ZxhrLAuNS07MrxrKsYhjdVi:nq41rLZNkZLYhjdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701846, "uuid": "93d7f18a-da8d-411c-8e12-962229da9294", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701846, "uuid": "fc8ffae2-dc88-4d4f-8175-27f589d1cc9a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701846, "uuid": "b6fa4b79-84ab-440a-aa25-9360f87879c6", "value": "catalog-721967446.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94414e42-a92e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619730308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619730308, "uuid": "f1d770f9-7fa7-436d-9433-9ec9f5efdc59", "comment": "Malware payload", "value": "0438e2f6c4dcd55cab4b887e451a0525", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619730308, "uuid": "5d080908-92e8-46c2-a454-9a81d5cf9233", "comment": "Malware payload", "value": "077c68b60b6d0bd682c5d3935a1e636fa64d0818c0e06c7447b7528684f07fa4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619730308, "uuid": "107048cf-a257-4355-bad1-f43adbb46e97", "comment": "Malware payload", "value": "b31f47fc415739fced5c6398896eed81609bea5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619730308, "uuid": "be004b2d-5de2-4654-a0cd-c4c4365588ff", "comment": "Malware payload", "value": "1f39f48463ed1f6755398629ae104389cffc73f6363c0d06f493480b603ad9bd5eb23dce146f63bbfbf05f8d79315de9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619730308, "uuid": "7a17274d-d6ea-4580-8d89-77cc9ce7214b", "value": "B051DBFD8E0907544F4F394ABD37E0A1BD7813122D62E415C44EDE441C92AA5DF267D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619730308, "uuid": "aafab15c-5b8c-4675-809c-f4d2a83abdb6", "value": "48:REVi/qimuV22L3Ew+zmXa7rG1kC+4RQEMIjcAW10VYt8o83cofPucC:REVi/nCmXaPgDD9jZW10VYbCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619730308, "uuid": "578b4954-379a-44c5-a2eb-8c84c9f3ef5e", "value": 3154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619730308, "uuid": "7f59b25b-4a0e-4acf-a25c-b0607321efe7", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619730308, "uuid": "9a39518b-208b-480e-bc95-31dcd85a82a0", "value": "0438e2f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d060378-a8d7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619692957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619692957, "uuid": "42c7f8d5-c0f4-4852-b087-3ca9ed74c874", "comment": "Malware payload", "value": "176df6ce5cd78189a3f554961ef226fa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619692957, "uuid": "bfadb5fa-ee5a-4427-a38b-a7fd1e1e8938", "comment": "Malware payload", "value": "0785e57d59fe9651ac7452ec9c4b04dec2185dfcefad10ce9b0fa077c4aaac02", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619692957, "uuid": "32ad2622-5dba-4ba8-91ba-692470143b06", "comment": "Malware payload", "value": "27da49adc6c40601a8cad3d0bd4a6a98f51d6f99", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619692957, "uuid": "5b5f357d-fe50-4d64-aba9-00d1dcfd8718", "comment": "Malware payload", "value": "863f7ff0310598f65505e268e3a736830e2d115d8adddc0bb9190fa667da441000f592f5e8a381e905c622b2dfbac2cf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619692957, "uuid": "9ef3ad70-95ee-4aff-815b-29ce20cb8e0e", "value": "62472397F749E89AC0F3D23787B64172A6165C508B13E647394CF2781FB79E09A09F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619692957, "uuid": "f4d81b8e-ab39-4f81-9555-44f1eda03b1a", "value": "393216:b+0ijv/RdPwP9PU27z+5NBuf5AFFKD7AoQtSGjuGjH6ysW06yyloedItSrRCiG/9:yNDiu5NBuKuAocSGCFvRO7dItu48r3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619692957, "uuid": "97ea54ac-7c78-4d56-9ffe-ee510f46557e", "value": 27032122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619692957, "uuid": "8a8aafd0-3fbd-455d-a5ec-ac95979afb42", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619692957, "uuid": "7b1bff05-63fc-42c9-b03c-eee74a8945e7", "value": "176df6ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da98b770-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702938, "uuid": "623197e9-81f6-463a-b78b-65b3e8b46cd5", "comment": "Malware payload", "value": "09be7a972e759e8028e7a336338f4fd7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702938, "uuid": "7160cdda-65fd-4a6b-8db7-9d23319cf681", "comment": "Malware payload", "value": "079c5b2834de2bc869655013f4430d9251f07346d7b42179218be6103ce5058e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702938, "uuid": "604aa941-33ce-4d21-bdc4-c6df4dc05b0a", "comment": "Malware payload", "value": "c2733d51d7df392182212c8c42ce6658e5a17d2d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702938, "uuid": "b50041e6-ceb8-459b-b9a0-801c38788bfc", "comment": "Malware payload", "value": "14c839679e52b9390cec482f66148ed6956d7aee2effb547c3a8eaa368601c29f38a5cdc1ef530e06ddf752873454a18", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702938, "uuid": "97ed52da-6cf6-4e33-83ea-cecf2d1a72a4", "value": "0633022A4D6FBA29172D20F08589C74EE64B689D387DC5D11C8CB476EC0A796063FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702938, "uuid": "00f38a23-20a4-4624-9caa-8e1aa927b263", "value": "1536:YP6z4+ADViS8CWoD94pUnQ64x11RiCN1de:uPZBiS8jopkUQ64xNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702938, "uuid": "66cee2c7-8a0c-4f78-bfa4-2eaf43927d18", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702938, "uuid": "98e5c6ef-48f9-4557-b461-f042a1ae7356", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702938, "uuid": "37413fa2-c97e-4508-b1f0-777996beabc0", "value": "diagram-1579238060.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7386ecbf-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703195, "uuid": "02932150-835c-4b3e-91b4-d2136a1d1b5b", "comment": "Malware payload", "value": "4eb73c5a86fb6ae9e640deb008a6a55a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703195, "uuid": "8a2ae5cc-eabc-4337-92c3-5c568aeeff37", "comment": "Malware payload", "value": "079d0815fc635b3df065dbfdaae7dc4350f385cb8d9fc6bbc277a5dc629458a5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703195, "uuid": "8c2b051f-2ebf-43bc-8272-42ac8a0eec2a", "comment": "Malware payload", "value": "02e7d6b0b06d7855f170ac2d46baebf6412c7f04", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703195, "uuid": "12e4628c-4df7-4356-9a6f-932a657c3219", "comment": "Malware payload", "value": "898ac5cfead2e79336c2173b2b167fa986a20eb8907b1b15a10720dc452e7964f71e0dcb64d41823e7cfc4f5a45c2df8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703195, "uuid": "28a65ae5-a4af-4804-be6b-995e8ef43df9", "value": "313302298C7D772D572D10E08585876EE51B2CA93C6DC5425CDCF4AAEC022AE163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703195, "uuid": "26e1e5dc-87bb-419c-a147-871f05a0a299", "value": "1536:GP6z4+ADViS8CWoD94pUnQ64x11RiCAJh:oPZBiS8jopkUQ64xsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703195, "uuid": "10405254-d415-495a-8e1c-946a1e2c0204", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703195, "uuid": "0b651b1e-3946-44a1-b988-90b404eaa407", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703195, "uuid": "3ee8903c-7ffb-433b-8bb1-affe434054d7", "value": "diagram-1803300707.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723df87a-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705340, "uuid": "faa16f58-3828-41d8-b8aa-490b0c1d52d2", "comment": "Malware payload", "value": "bdc92c87e155c35d60bb829496c6077b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705340, "uuid": "472d4e39-1f0c-4d73-93d0-686d39cfa156", "comment": "Malware payload", "value": "07a16267e421fdffd379085e651629bd727265310d61b253636612ac229f0614", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705340, "uuid": "fca77295-8c9f-406b-bb06-237e3e3d025b", "comment": "Malware payload", "value": "68b34c3a81b89f8a7d544653ba7a3ad6e55583e2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705340, "uuid": "126c8584-e74e-44f8-af72-615d7ef39ffa", "comment": "Malware payload", "value": "fd748804b3b112b9fbabe7772dc5a41d70192859d1e9d7ec76270c20d13bdf90de974b387cff43a7ca5119d76387da24", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705340, "uuid": "89a46f20-d264-4d96-b3b0-9d6dadd46c14", "value": "5933021958AEB72D532D24B88A848B5EE5036DE9341ECA450CDCF466EC066DD123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705340, "uuid": "5d95f709-f2d1-4c2e-b129-1f3fc7c0cdf4", "value": "768:D9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCgX:WP6z4+ADViS8CWoD94pUnQ64x11RiCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705340, "uuid": "186103e8-9442-4d84-afeb-bc6cb66173e5", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705340, "uuid": "2fe63b24-190e-4f17-9f0d-b9d4c890e300", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705340, "uuid": "74098d93-45e4-4315-b6d7-a552aba96ba9", "value": "statistic-1395377371.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6a14f5-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705869, "uuid": "b0832fe3-94c8-46d5-b888-66f02e0d55cd", "comment": "Malware payload", "value": "adac84336842456275bbcd9b85f4e6bb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705869, "uuid": "5703e677-f7e4-4aed-b02b-23540580d72f", "comment": "Malware payload", "value": "07a1d99d951c2cfba261204fe6e9ad3c0601e9b9367bd748980b7d53cfa24630", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705869, "uuid": "f1b4606c-9a30-47c7-b06a-bc37ac583478", "comment": "Malware payload", "value": "726a5540ce857a2355919c10d7b5a210d5e75eae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705869, "uuid": "6c96a914-e084-42ab-9a72-870b73512b8f", "comment": "Malware payload", "value": "e462b37f2a06d3c0a62dc8c5e177176d7c4b5e145175563f287a912ee8ddd0b9321dd762ad7af0bb96bdaaafa71788f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705869, "uuid": "ff0e961d-f541-4bff-aeef-6b0c15411eba", "value": "8A330219589E7629533D10F08581DB4EE9536CAA3C6DC9416CCCF8B9EC092A4127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705869, "uuid": "3c6f3ac5-7618-4852-94a7-41be78ff0436", "value": "1536:6P6z4+ADViS8CWoD94pUnQ64x11RiCaa+v:UPZBiS8jopkUQ64xv+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705869, "uuid": "9a63e982-740a-490f-bf4e-5341b21c688e", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705869, "uuid": "1cf64b46-cd6d-4eef-a15d-3ed43c8ea605", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705869, "uuid": "b693cba5-c85e-4b78-9d2f-9b10d9489490", "value": "statistic-183672623.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d5afd8-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659013, "uuid": "14863b2e-5538-438f-8387-928352793c8c", "comment": "Malware payload (Quakbot)", "value": "8b1967ed7d3674c2df4d3005efba4bd7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659013, "uuid": "c9591979-82ca-4eb3-8d91-355dcacf35fc", "comment": "Malware payload (Quakbot)", "value": "07a29f7149874bf73c8c8d43a07af97354cfda6979884f1f98dd56338c950bf9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659013, "uuid": "3b847b32-8c6f-4dfb-b53e-87ed566f7139", "comment": "Malware payload (Quakbot)", "value": "429b41ed2470e6c29d860d9f2661ba264d490ffd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659013, "uuid": "8033d91a-8487-4fc3-ac56-12cbb764db31", "comment": "Malware payload (Quakbot)", "value": "851a47cb54e54abaeb645c1cf959eef7a1f6d184714ac1069307104066184b9660603426d19c7c6a400190cd8a303d1d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659013, "uuid": "c0c3a979-0728-4def-80fe-65e37594ee20", "value": "0174BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659013, "uuid": "63bce6a6-4f02-4308-abee-3db3d1f6d50c", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659013, "uuid": "f90e3c83-2cb4-4f7e-ae14-9640e46f7172", "value": "6144:snQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuY:7FrkNK11G9AEtMxQyOi6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659013, "uuid": "4528364a-740f-4e8c-a928-3f7522ffc68a", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659013, "uuid": "ba87e040-f398-4d80-9d62-17343bbea082", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659013, "uuid": "ea8f4667-b82e-4bd9-91df-da481458804d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1760e580-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702181, "uuid": "e5b2cfce-837e-4b83-85b6-11583e257e8a", "comment": "Malware payload", "value": "0339a2cd051af6488f57e1dc86c2cae7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702181, "uuid": "cda30fb9-bf58-487c-802f-35b4e3799d5e", "comment": "Malware payload", "value": "07c300239180981d60ebdca40d31c247000e6b26477e323d58d4fa4e71312fe8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702181, "uuid": "5f563597-b659-4aaf-9a5c-fce2016af353", "comment": "Malware payload", "value": "6b647ad6f02cce05551a5908790c0f53b272c74d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702181, "uuid": "87f01ed2-74c4-4452-9da2-8fa4991513c3", "comment": "Malware payload", "value": "cbb59131a993f68e99b5a4182e449d4c18ebd92151779a898b3fb275deeb69eb66dc9f8691f40b76afcb0fe9db122276", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702181, "uuid": "0ab705f5-c86b-427a-a2cf-b1ca8ab17a1b", "value": "AC33F2CCC6CDD33294F578319C79C702E578AAAF481A856181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702181, "uuid": "7ac21d74-75ac-43d7-b4f0-879d4bb95408", "value": "768:HwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2y:eFugXVpoD8ZxhrLAuNS07MrxrKsYKOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702181, "uuid": "08f9a818-07e6-4d6b-b152-58b544c9529f", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702181, "uuid": "96669f5c-7003-425f-8bf0-43646a6d87bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702181, "uuid": "f9adbe4c-3a0e-4513-a8e9-094bebac4fe9", "value": "catalog-965392686.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad7b165-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702482, "uuid": "c1947d61-baaa-43a1-9697-620b714cf5ce", "comment": "Malware payload", "value": "e0f3c0b9a1e7501b0c94998ddb7e259f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702482, "uuid": "4a497d05-feec-4b60-a37e-e66e12a74fc6", "comment": "Malware payload", "value": "07cf35f30422c1c9eb220aa4a3086e4bb5707b2b06ca0eb7b78ef4c254253206", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702482, "uuid": "f7e961e3-0a98-4352-b009-2e884b078572", "comment": "Malware payload", "value": "05695d28d6456dec6b7387bf39c88a44e3b30d3b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702482, "uuid": "09c88d00-07f8-43c4-b01d-606d2e5f0c79", "comment": "Malware payload", "value": "10e1469dd8b353e558af7a562c6e9fe156485e1fb15fd9a189538c42d4da844b0c5fd151351d3a20a8dbb43a8f994bab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702482, "uuid": "3df48e4c-aa6f-41fb-be71-a4af2747ca4b", "value": "C5330229887D772D572D10E085858B6EE51B28AA3C7DC5425CDCF4BAEC012AE163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702482, "uuid": "e86200e8-f96b-4799-82cb-a8c12bb7d58c", "value": "1536:9P6z4+ADViS8CWoD94pUnQ64x11RiCi1r:JPZBiS8jopkUQ64xer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702482, "uuid": "775c211a-7198-426c-88e2-8a1e5dee5a93", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702482, "uuid": "ea6f9903-7e05-424b-bb3d-c3dd67129f70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702482, "uuid": "aee577ff-6793-4579-8069-073f94093d67", "value": "diagram-1212205594.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec881028-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705975, "uuid": "187b9698-03ea-4e28-9bbe-3c89d63829cd", "comment": "Malware payload", "value": "2aaf3e4410b128427a7856676ad914d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705975, "uuid": "e4ff1127-3d0e-46ce-9599-f7f69dfe3bca", "comment": "Malware payload", "value": "07d982dc6bc6eed5881947f07ce545f1506786c43fd63c6e39de24976e8efdd9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705975, "uuid": "13512bc7-cdfe-4920-85e4-442a686d8dac", "comment": "Malware payload", "value": "e392c9021fa283ebd35deaf3c5c98b12fd4c76b5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705975, "uuid": "d52635be-5737-481b-bc35-42d05987a297", "comment": "Malware payload", "value": "585b341fb81aee4750d98ad88457390cc5c36a2e9985256c54ddcb81d80fac2c70d971ccc000d95149c9b416380fa06a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705975, "uuid": "7028039e-5732-42af-9278-f5659034abb1", "value": "FA33022A9C9E792D573D10F086819B5ED81328CD3C2DDA816CCCF4A59C066A9167FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705975, "uuid": "2345ed2a-d0a1-49f8-bb74-9e585a5f06db", "value": "1536:UP6z4+ADViS8CWoD94pUnQ64x11RiCRg4:SPZBiS8jopkUQ64xI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705975, "uuid": "1148567f-bfbc-4bdd-9b02-461e8f3623dd", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705975, "uuid": "6de05f75-bed4-49f6-bd21-a4a4513fb251", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705975, "uuid": "11046819-5a23-4f82-8682-ebc301584def", "value": "statistic-1915316080.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9799f108-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659017, "uuid": "591ec88c-0e61-4c62-8ff8-72e6b47659db", "comment": "Malware payload (Quakbot)", "value": "94c4903fdf56be731aff6e7ad35d089a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659017, "uuid": "311d7fb6-0066-4715-9b76-e939496f0d3b", "comment": "Malware payload (Quakbot)", "value": "07db7c5f55f1a730f1db8a212360b912d52cb47ef1f99b5fc226e70f1b467091", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659017, "uuid": "b6c58f1c-4310-43f0-ac8f-6d67346074a4", "comment": "Malware payload (Quakbot)", "value": "b52bf98aba6614f535c294653bef48ea0c70a445", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659017, "uuid": "8728bac3-70ab-4af0-8d26-9675d41bf97a", "comment": "Malware payload (Quakbot)", "value": "d728216a739727f7468a227194fb22617152159914257a96c19baeae166677bcdd230367ab60d2c100de99ebb887aad2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659017, "uuid": "d9e2f6b2-4998-4aea-a581-e5e37c5b10d2", "value": "04549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251A55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659017, "uuid": "2b3e096b-ebea-40bd-bdd3-b0d6571e089e", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659017, "uuid": "03d18ba3-8222-4958-bf50-fe950c98bc50", "value": "3072:93FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZTcM:Nvv9sMoXBaRmr/dukbvuZ/7fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659017, "uuid": "704e1a94-d839-4e57-b12c-106ff8df3bfe", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659017, "uuid": "0f5e8f81-8bb0-4adb-8a23-0ab8c7da11e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659017, "uuid": "1b5ee59c-f425-45db-ad08-463cef2e3901", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a58f897-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659022, "uuid": "5d64a09e-5080-4e29-8937-204b82440e82", "comment": "Malware payload (QuakBot)", "value": "daa2a5d73a69a3f0aa827acd8025a1d6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659022, "uuid": "78a9903a-4df1-4916-b7eb-e96577154360", "comment": "Malware payload (QuakBot)", "value": "07e0bc3fc038ba914dd8de554c2f3fd9fdc6bb3f838b8d8a077ed0857554bf7e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659022, "uuid": "9466669f-c125-4694-9b71-7b76063d3ed4", "comment": "Malware payload (QuakBot)", "value": "16c48bf3fed9fe798fd1b21a66f76c1e94ba7e4c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659022, "uuid": "4e894e5c-8990-474a-aeea-2ce6492b0913", "comment": "Malware payload (QuakBot)", "value": "87d9e82b7a0d21f7674416b9b891a55f9850ee95d5a4a5bab45c71d2f90f3e907e09e72362251fc14002c52e06ab261e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659022, "uuid": "ef998d79-9f6e-491c-b49c-2db1962df405", "value": "61549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659022, "uuid": "8754b5fb-9c45-42c5-a6fc-8edb91a81d9d", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659022, "uuid": "5c1314fb-ee03-4519-b679-7de4728937f3", "value": "3072:O3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZUF:Kvv9sMoXBaRmr/dukbvuZ/7fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659022, "uuid": "12f63c59-ca2a-4536-93f3-b59922dfcba3", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659022, "uuid": "3a61e4f1-9f63-4dea-9f20-e4e478b02bb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659022, "uuid": "d21c5fba-dab3-45b3-a4ed-8954766c1c75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39003bb-a91d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619723059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619723059, "uuid": "e4515042-adf7-402b-b4d4-670d0e759fc2", "comment": "Malware payload", "value": "466dd0c9eb791e195a938363c1eb16d9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619723059, "uuid": "e3043ac4-7e14-4097-a5da-25387c432fb6", "comment": "Malware payload", "value": "07eb1de810c79416dca7fd8c198e6d39ee83734df389685815381d4a8e1660d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619723059, "uuid": "dac12dd5-ee33-4373-8cda-afccaa8a46e0", "comment": "Malware payload", "value": "98a2d653b6e72bad23f5968c6882774c4c40ed2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619723059, "uuid": "defdf175-f511-4cba-bd81-9904ec1b7986", "comment": "Malware payload", "value": "ff5f71b5b661316c4581876c50256e35d96408c928630ea1519ea8bb20d761b2e8f950e8a28ac380c2cd90273304d17d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619723059, "uuid": "2052bbcc-248a-4a68-abfb-c18618166e68", "value": "50F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619723059, "uuid": "a6e438d0-1f75-4dd0-8a99-e04b9e9e84ca", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619723059, "uuid": "cb7c4023-23a4-4d28-a9d5-8008146bff3d", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619723059, "uuid": "507a3e25-501e-4561-82f8-612be8e1ec8b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619723059, "uuid": "5e6f7912-4c81-48c6-aad0-529dc6b94dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619723059, "uuid": "36c05454-6a6e-43c3-9530-9b9a5119d3a5", "value": "466dd0c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29860623-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701353, "uuid": "c547ca4b-f579-432a-8557-7fbb66544cc0", "comment": "Malware payload", "value": "682e4a2689232c3e67c050951ee4d38e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701353, "uuid": "952ea6c2-47eb-4761-b98b-798c1362c221", "comment": "Malware payload", "value": "07ed1cd4bb1dd83c3fb0031e27a975c88dc870d0a0141041a984b30131414657", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701353, "uuid": "1d9ef1b9-d41f-4aa5-a16f-ba9d8becba02", "comment": "Malware payload", "value": "b2512010a884d10dd99eb91cc954dee25dd9bd41", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701353, "uuid": "f7f48248-b8b4-43aa-b925-313f48312178", "comment": "Malware payload", "value": "dfa5bb5082672cda24cf3d8f6ae8c971270c762dfed6664008c2efc6fea758e3f63973c6b38208080474da85443cb6a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701353, "uuid": "8d0a6bdf-53e8-4243-ad64-22cd36e0b92b", "value": "39330188C6CDD372E8F578319C39CB00D978AAAB4816C0A586F78AD7B9079D1170EDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701353, "uuid": "8ef076ee-397b-40df-a315-8f52a98a442f", "value": "768:WwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2d:rFugXVpoD8ZxhrLAuNS07MrxrKsY19j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701353, "uuid": "9e2b1b94-7f03-4480-b22f-4246be74f03c", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701353, "uuid": "ace9586a-f152-4127-bf16-d149fa416d53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701353, "uuid": "ce1b4d54-edc9-4d74-b65e-7ed129013ca9", "value": "catalog-318414059.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700ff776-a8bd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619681714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681714, "uuid": "e7ab59ed-9fad-4a95-ace5-856c40da3b16", "comment": "Malware payload (Dridex)", "value": "e617e3d2b6bfc104100e3ed335a28f35", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681714, "uuid": "c6ea4deb-ceed-4531-955b-c05637af56f7", "comment": "Malware payload (Dridex)", "value": "07f695dd980531488b7dc5f3d94b1b54388c7b02f02ae8455dc9f50ac414a041", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681714, "uuid": "288c314f-273b-42dd-9a71-c875911302f2", "comment": "Malware payload (Dridex)", "value": "eed9a6b63921f8d8135d39b1e167d59c068edb02", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681714, "uuid": "5b5d35b4-31a4-4e3e-9251-c08348cc67e0", "comment": "Malware payload (Dridex)", "value": "1fdef11657add6fab72cf1a63fbca8626a3f09bb42f0e0282c174972dc9563d682850926f3403988b4cfc2a459b95090", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681714, "uuid": "7d4fbb25-9309-45e3-8516-bd796f342e28", "value": "D8F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681714, "uuid": "1169f1f7-9b41-447f-95e3-7ddf45307560", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681714, "uuid": "155b94a8-f27f-4798-88ac-78ea778ac53a", "value": "3072:ewT2d85tleLD51fC5AHYEoefukoTFMpGmjE8D:Iy5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619681714, "uuid": "1f3562e3-5a8f-42d5-a607-cd71309b1354", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619681714, "uuid": "208ded83-d1ec-4244-9695-5d9d1b2b0b5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681714, "uuid": "a06e1f78-7208-43f7-aae7-76235fab3ccc", "value": "e617e3d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d17ebc-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702907, "uuid": "27171b8b-c065-4f59-b16c-3bc1cbfbb668", "comment": "Malware payload", "value": "aa684d15fa725aa25128c07c2642c6c1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702907, "uuid": "95d72473-a547-419f-93a5-551fa006b0fb", "comment": "Malware payload", "value": "07f8ff1e6ec18f840791c7e29a474260ef4036b07cf464d95a5780ce2435f49a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702907, "uuid": "3ac62cc6-ca67-4462-a7f8-8a3cacdfbb18", "comment": "Malware payload", "value": "66289310f6be95ed44b47ba91b9f49454478efb7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702907, "uuid": "66d12970-b83c-4949-9e14-abf881975051", "comment": "Malware payload", "value": "b148f577ace6dae0cb0be0e9f9bf1df788f047044d59d5d851b6fb63caa3afddacc6ed93da24244943161330c6f68421", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702907, "uuid": "f6d27788-cd29-4545-af79-923355f39847", "value": "1833022F485DB62A577C10F5C589CB1DE50B689E382DC9825CCCB826EC0969D153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702907, "uuid": "a776bfb6-639c-44a8-83f0-2006f7919521", "value": "1536:3P6z4+ADViS8CWoD94pUnQ64x11RiC+apH:/PZBiS8jopkUQ64xcat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702907, "uuid": "1ed36568-de87-4782-ad92-b758a2ca7de2", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702907, "uuid": "5fec612b-bcfb-4044-b7aa-b73e971d03a5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702907, "uuid": "e956dd70-7a13-45be-9594-8837c4e1a6a7", "value": "diagram-1546005862.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ce6b66-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704319, "uuid": "99124a64-9d22-48d5-93f5-badead55092b", "comment": "Malware payload", "value": "a9937ffb947b1bc383c9d8bf689815bc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704319, "uuid": "af67f97b-effe-4f18-abdd-849a1986d4d0", "comment": "Malware payload", "value": "080bf9abe45749756eb46484c4fa56d3ba05bf7232a0d191d518e56deee88cc1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704319, "uuid": "43442552-c4f1-4fd9-8d28-eceb49e4e1fa", "comment": "Malware payload", "value": "d8ea1b0088dbd7216731c94b312190657466ca1b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704319, "uuid": "974eb55a-ca63-4983-af03-d8a66c2ce76a", "comment": "Malware payload", "value": "b09d97afeb9a285944afad2f3932bba939d68674a43f66f3981d617295d63f06e1fc1caa039926e9554bf1b4a285da43", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704319, "uuid": "6ab830dc-a272-4ef0-a6c2-8dd71fe87ddf", "value": "F0330139886E3629132D10B08985EB0EE51758DE3C6DC6472CDCF46AFC057A9127EBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704319, "uuid": "50bb2230-435b-4827-aa78-ded34e154257", "value": "1536:VP6z4+ADViS8CWoD94pUnQ64x11RiCGI0d:hPZBiS8jopkUQ64xX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704319, "uuid": "19457718-9a23-457c-acf2-b370efa5e4d2", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704319, "uuid": "5664bda2-9664-44df-9ea9-f38ac4b023cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704319, "uuid": "06253969-2043-4e2c-b5b6-108845d893bb", "value": "diagram-679431643.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5e2203-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703478, "uuid": "8423b776-261f-4814-8838-9c4d646d9bea", "comment": "Malware payload", "value": "31e15d596885bee78d778f62ef126942", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703478, "uuid": "7d4a1670-c362-4afb-bcca-93e53c52223b", "comment": "Malware payload", "value": "081484405707f6680f0be345d28c3e7c9028c09ba57834d405b426e305ebf7fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703478, "uuid": "6dd03b7a-9843-4ac5-b6cb-060d0512f19d", "comment": "Malware payload", "value": "d8a8d48836528e16dafc642414401033d68c6c9e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703478, "uuid": "65358937-1788-435d-b66d-6db93a751bb6", "comment": "Malware payload", "value": "5a33121ebc25bf7aa82ed45b14e477da39094e19c39d8b0f4dbf62c81a1ec1c79ed2ca92ae9117215c3861ebfe2c9d41", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703478, "uuid": "505d57ba-2eec-483a-9101-df768e08a6e2", "value": "4B330229887E7B2C533E20F14986DB5EDA076C99382DC585189CB0ADEC067E9113FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703478, "uuid": "cb850a3b-bec9-4d8c-98c7-88d5de9d6fcd", "value": "1536:VP6z4+ADViS8CWoD94pUnQ64x11RiCr/v:hPZBiS8jopkUQ64xRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703478, "uuid": "e3b8b9ce-9a57-43cb-9101-25fdd7504195", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703478, "uuid": "3f930d47-233d-4b2d-b825-28fcab5a12e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703478, "uuid": "b29cc8f5-066e-4af9-a44e-e211953c14e7", "value": "diagram-1935559132.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1bb702-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659026, "uuid": "ff4a2227-7b39-4c95-ae20-afea3518eada", "comment": "Malware payload (QuakBot)", "value": "c194cabc60fc4eade35e96995ccde780", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659026, "uuid": "6b6952f1-aae5-4e83-926a-39a6eea6d03f", "comment": "Malware payload (QuakBot)", "value": "081a70a8a1bf3632f66fb48a94dd1c7f7977634a0e3238c8d5deecb0f4d60b94", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659026, "uuid": "d0d75391-ff55-40a0-acf3-979cdb701181", "comment": "Malware payload (QuakBot)", "value": "f758c368e3893ea4eb54564b0fe1eca212a32caa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659026, "uuid": "a8f1ce0d-c3ad-4107-892b-9ba39ecd7421", "comment": "Malware payload (QuakBot)", "value": "3553f52ed201123115bae824734a988b03f9cd4e3c0c8204065ab243cc770e0c4604fb5cd0362fd966041f15dcbfe1bb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659026, "uuid": "0e336c27-c3c2-4dd9-9a86-3c40acfb776b", "value": "A574BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659026, "uuid": "e6eb8c48-5f79-41b4-8df6-864d6c17edde", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659026, "uuid": "0d6267f2-e76c-4464-8839-9fd30a2ba0f7", "value": "6144:VnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu9:aFrkNK11G9AEtMxQyOi6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659026, "uuid": "40825d75-cf13-4e98-b65d-401e7b03d8da", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659026, "uuid": "1717d91d-afe3-4678-ab5b-3fb32c0ac720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659026, "uuid": "5a93ac44-0f5a-4c9b-b3df-28bc0d7d401e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2cdd86-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699854, "uuid": "8a6367ad-49ea-40d6-ba88-06d0abe7652c", "comment": "Malware payload", "value": "39258a74cd496cb16e9915044f73bef7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699854, "uuid": "c82a2434-2391-435c-aa5b-9e20fab0d50f", "comment": "Malware payload", "value": "0833de2a390891362ac7484a347fcbad235fa44faf12c8423b8273a49508f2f5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699854, "uuid": "2b67569c-9575-4f0a-8b44-73acb7fdb66e", "comment": "Malware payload", "value": "967f008ca5250d4ecd787a9eff9244c6e4b761f8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699854, "uuid": "6b7958ea-d196-43e0-baef-2a7fcfc85466", "comment": "Malware payload", "value": "ce1b89273b46405f3e13e94c7f46d4c98662aae7f419b3f5b48dbdc99c5f933043c029e059d300f3f63a8eaea17b3d07", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699854, "uuid": "d20a0b93-38df-4054-adf1-e2c458ec0148", "value": "97330188C6C8E335D8F47431BC788B02D478AAAB441BC96581F786A37E06DD0578BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699854, "uuid": "94378543-203d-4088-99e2-00dc605959ab", "value": "768:ywnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2m:fFugXVpoD8ZxhrLAuNS07MrxrKsYUJ8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699854, "uuid": "ccf28e7f-2203-492a-ac67-f0f96c029b13", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699854, "uuid": "f6977eb1-5e23-4382-a648-9e01ad9919e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699854, "uuid": "ed45a202-db7f-4c9e-8e55-39cff87e897d", "value": "catalog-1092278542.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe13173-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659031, "uuid": "e3b2b27b-035b-4ab4-8a93-f5b3b5af787a", "comment": "Malware payload (Quakbot)", "value": "c65a76b6f80c2199b2facb98d0d72825", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659031, "uuid": "794ff3be-b319-487d-9a30-45670c1a09a8", "comment": "Malware payload (Quakbot)", "value": "0849b573c8daecd4dd8eea7673508ec0568bddc1e2c379d461f371926403860a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659031, "uuid": "f1c358ac-4eef-45fd-b7db-502c6b70b57e", "comment": "Malware payload (Quakbot)", "value": "a1804ac4c1de3e84afd1088986647efd656a4abd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659031, "uuid": "c34c6f98-80a5-4eb6-8a1e-43a984cfe103", "comment": "Malware payload (Quakbot)", "value": "b54390b02bb5434dab74dba7a21da9aad2a9ef615902b2c5f2174273a066dda9fb6ca2db0e5c29aef4db47ac285b6b9f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659031, "uuid": "d264fb77-22c4-4284-980b-33bccfdecc0b", "value": "0A74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659031, "uuid": "6ec77d07-a5eb-4e2f-a50d-7fa171dbc1f2", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659031, "uuid": "32f16a2e-22b5-4195-aed4-a77ec409b587", "value": "6144:5nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuL:WFrkNK11G9AEtMxQyOi6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659031, "uuid": "eefa6377-b24b-4a77-b929-a81c04ade3f9", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659031, "uuid": "92616c82-dab4-4a19-9a3f-0a8de018a29a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659031, "uuid": "aebd7833-4d34-4385-a820-01a4fcee207a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4794b3-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703080, "uuid": "cec7b7a3-ac36-4d1e-a9ae-95f4061512d9", "comment": "Malware payload", "value": "cee73e343c2cefc9bda25bdd0b7fec90", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703080, "uuid": "2f036176-a726-40a7-aa5d-12af8ab0c517", "comment": "Malware payload", "value": "084f910a65c6fc149154d812396dbfffa386019710bf8f8ce7553aac8c604136", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703080, "uuid": "1adc1407-0604-4c21-8468-ffce8d6b06b4", "comment": "Malware payload", "value": "2af775df4ee303fe75ebc9efe8c2c8f0c775af42", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703080, "uuid": "b0cdca19-adad-4253-b0c5-dcd474892c41", "comment": "Malware payload", "value": "f8c50c1e37075de278d95c63fae8c547f61b20f4257f21d4070cf1015ddddeddbaa72f58fb7c1ffb6653f780e3168b2d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703080, "uuid": "3fccea76-e18f-4d55-be29-ef8c0112f703", "value": "B233022548ADB73D637D10A085859F1EE9172C9A3C1EC5D21D8CF4A7DC06269117FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703080, "uuid": "3775981e-313c-464e-a1ab-ae212cd34797", "value": "768:E9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCQUd:9P6z4+ADViS8CWoD94pUnQ64x11RiCQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703080, "uuid": "c47dd457-2942-4071-9ffa-9bfac53c222c", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703080, "uuid": "ac8ff13e-7b4b-4949-b1d2-a32636494db4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703080, "uuid": "6478db0e-e327-4f43-b3f7-d2dfced1b036", "value": "diagram-1704336911.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef6a5a5-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706274, "uuid": "63bb8550-5fd0-4d35-9e0b-31f3708557b4", "comment": "Malware payload", "value": "3ef8ed1846e89b7863bbd74198da2267", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706274, "uuid": "3dde30f8-fde7-4f35-9c78-a2f8426ceb73", "comment": "Malware payload", "value": "0850e282d23dea800db4ed2583095dd7305ec6b93db1313e4410bbfb5ea8337b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706274, "uuid": "7060bc18-d024-469a-850d-c8500cd5d989", "comment": "Malware payload", "value": "20e636ecd9ad398209b84b5a6e9a0ef7217d8557", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706274, "uuid": "356a8685-91b8-4b7e-80fe-ae6050503476", "comment": "Malware payload", "value": "b42293d17e380a35da7b92fa0c8812a6076b1cd496f22c13e1558e62b2cfdf3d7eeaab8af43af2a1292b2ab954ac1db6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706274, "uuid": "5cd3c13f-2cc2-4549-9fc7-1f75ba00c12a", "value": "14330229586DBB29532E24B48685DB5EE613389D386DC6821CECF475EC05299023E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706274, "uuid": "5f1f15f6-55c1-4b68-8202-5ff0720325c1", "value": "768:g9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCS06:BP6z4+ADViS8CWoD94pUnQ64x11RiCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706274, "uuid": "eb0e680f-05f9-4864-869d-c507a385859d", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706274, "uuid": "8f8208fa-b48b-4a71-806e-4a210cb7618a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706274, "uuid": "ca7fe41a-a466-435a-8f2d-335c1580e686", "value": "statistic-244885707.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c723e0-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704543, "uuid": "cb257418-3c36-4ee6-85e4-e1bc247b5902", "comment": "Malware payload", "value": "ccff99200cad8f8cb5ae97df2ebe64f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704543, "uuid": "f3d59f93-e6d8-4868-8a59-a7aaf73a8629", "comment": "Malware payload", "value": "0855970dcf751a539b3e0576a26e58f051c7a5d51a4b47e119d42d85b90b4c4e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704543, "uuid": "1bd299d0-bc52-4e7c-b513-d50646e4b09c", "comment": "Malware payload", "value": "69484aead48136d16ca104827577fafe6a8ba191", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704543, "uuid": "85423bd9-3037-42fd-bf3a-9fba2e5ae8a8", "comment": "Malware payload", "value": "dc6d619b82e0fc599f0a96c2ba0673b149db24d4f4d73b438345513850f64d73435de4f76d5e506a409c94f789573d3e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704543, "uuid": "6fa021e6-d7c4-4cb2-9935-d3c1aab32b6e", "value": "3333021A8DAE7A2A172D10E04945CB4FE21768CE3C6DC6824CDCF4B6EC066D5063EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704543, "uuid": "2d4e7d7e-6f8e-4c2f-a7bb-6c45fa657be7", "value": "1536:fP6z4+ADViS8CWoD94pUnQ64x11RiCFbzE:HPZBiS8jopkUQ64xjXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704543, "uuid": "33a5feda-5cb8-4733-8a3c-d490da6947f0", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704543, "uuid": "90ea306f-a1a9-4aa1-93dc-d6ee87c881a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704543, "uuid": "17da1af3-2218-4a95-8bb5-de5f844fde6c", "value": "diagram-821893589.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04731143-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700432, "uuid": "0420a412-2b87-4ef5-a3e0-3912163587de", "comment": "Malware payload", "value": "8359bba719e7e5f8a59032e5351825e1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700432, "uuid": "e3f64fda-9f57-4d70-b015-6719e601b48f", "comment": "Malware payload", "value": "086451a751b501039da32ae8193f0888597e9c8940e850cbfec216b447102be1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700432, "uuid": "8e21a021-5df7-478a-ba0e-88fde4bd5945", "comment": "Malware payload", "value": "6643c58bc48ebd4b68d8ec2863ee5117b273c776", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700432, "uuid": "ea12edd2-7dd1-42a4-9dbf-ebe4071d7269", "comment": "Malware payload", "value": "cc2be0e57786f1fbfd97ffcd5cde0d1d367d2859edf1301d767d091606ebaaf7ac9bd29cdae6fbf47e180ccd1370cc04", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700432, "uuid": "0317312a-8c36-4cd6-92a4-ed39b5ec8383", "value": "C43302C8D6CDD37298F539319C7AC702C9A8A99F441BC46281F746A77C07E91274ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700432, "uuid": "1ce145de-f563-44d8-a1f7-bc32a644c5b6", "value": "768:lwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2j:EFugXVpoD8ZxhrLAuNS07MrxrKsYj5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700432, "uuid": "f970a8f9-4796-46df-9a51-c443307aa1b3", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700432, "uuid": "89fac8cb-f0ba-4307-bc20-a9de6a4b230f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700432, "uuid": "9aab42af-af46-46d5-9e91-649035ffeb25", "value": "catalog-1523145636.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9823c4-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703638, "uuid": "c2096234-24f3-4400-b62d-67cecde154fe", "comment": "Malware payload", "value": "605aacb7874889bd28e7abf12a4c1019", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703638, "uuid": "6d008853-6134-4951-b819-218bea397f66", "comment": "Malware payload", "value": "08697b5e971f2c9e740e492fffa5cfbd52bf3675116e0ac2521edda982482bd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703638, "uuid": "7434d186-a919-49a2-b4e1-a8c91e20c72e", "comment": "Malware payload", "value": "b96069c1d766d5db33f30254783434fe47cb006e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703638, "uuid": "51929526-ad3a-4b26-a635-97bd12b75e4d", "comment": "Malware payload", "value": "9cd41470be7cb4bb5d117f53901d3891c3727e155f34971d87407face528055b60b26de2b8e416268bab0bda1f040f7a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703638, "uuid": "30b19199-9dc2-4c42-99cf-604b6bcf3f76", "value": "BA3302294C6EBA1D57AD10A14585C74EE61758CA3C6DC6811CCCB4B9DC057E5123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703638, "uuid": "fd2a5a7d-67aa-466f-b9bc-eba0ff4a991b", "value": "768:i9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCief:rP6z4+ADViS8CWoD94pUnQ64x11RiCVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703638, "uuid": "801bcdf8-6624-4d1e-bac1-00104aef93f2", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703638, "uuid": "488a6a1c-fb84-4923-8b18-6dfbfcdd229e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703638, "uuid": "d6cb56f0-fce9-4a67-935c-8540bad1153b", "value": "diagram-2042227098.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a5c98e-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659036, "uuid": "35f541fa-0819-4088-a376-2ae314eb32f5", "comment": "Malware payload (QuakBot)", "value": "5e8bb1cfbcd28902bafabb9ea057a652", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659036, "uuid": "a562bb9e-aeeb-415a-9f36-d8ab3baf4f1f", "comment": "Malware payload (QuakBot)", "value": "0871f2b084213b79d99cc58f26d2f87154f43206f037e9e40bd1ef84854a731e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659036, "uuid": "8fa93897-48bb-4676-9484-40117b91be71", "comment": "Malware payload (QuakBot)", "value": "a083108a7143eebb0e485e147c0cce5b4b9bd296", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659036, "uuid": "fe37d99d-dc7b-400b-aa9f-ab8c1894161a", "comment": "Malware payload (QuakBot)", "value": "f2f5b42f649a7a157e3aa88a03eef3d67a8ad806d08e034cca3c7bf2994cd375a771fd9d67608dbf9fbb96d4fed79450", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659036, "uuid": "1b06fadb-234f-4dc6-a5f2-932418dc4486", "value": "C074BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659036, "uuid": "cedd0a00-d4bf-4930-982f-197cf3f9cc60", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659036, "uuid": "0636497a-c46b-4125-b0a4-de2ae5abc207", "value": "6144:zTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuo:zbi7/xZrkNK11G9AQyOi6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659036, "uuid": "d3084784-e8b5-41ea-ba4f-a24ba27a2762", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659036, "uuid": "b3415447-354c-4633-8738-f145f64c4864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659036, "uuid": "cbd729e3-4287-4686-980d-ec78ab13a9f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d592b5-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704378, "uuid": "5f9ee9ee-f50e-4704-81f3-29ed3228ed5f", "comment": "Malware payload", "value": "0096e9bb5cdf9673c54b45caf41b35f0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704378, "uuid": "36be01c0-869c-45bb-8a51-a100436604f0", "comment": "Malware payload", "value": "087370ec87f759f2e4de24d2f7f34c2b9bfb8ba65ee101a29b823d4f60996d7c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704378, "uuid": "7ae54e21-510f-4041-8fd6-c9314b4e6c1b", "comment": "Malware payload", "value": "004a3e023e27e110b474cfc2be1c7fb877692a3c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704378, "uuid": "4e034714-2f87-48f7-bffb-91e03aed885e", "comment": "Malware payload", "value": "b9ae5611d255cea48dcdc9d430f4202de2bfd2a02afe6bb4ec1bca98eb47b0fd74d7e6ed871554bd3b0f2c2c49ae84a9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704378, "uuid": "2e7c6073-5a38-4ebd-a3ea-363f242f1044", "value": "0E33021A88AD3639573D10F059859B5ED213789E3C1D86822CDCF4AAEC056AD163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704378, "uuid": "a3a734b4-1e59-45fa-99a1-75cee2265b0d", "value": "1536:UP6z4+ADViS8CWoD94pUnQ64x11RiCBKllx:SPZBiS8jopkUQ64xu/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704378, "uuid": "a988ae92-fd81-499e-832b-06558e51036f", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704378, "uuid": "14b1e59e-13cc-4f72-b778-faab9bd5b0a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704378, "uuid": "242cd0a6-0eae-47b0-b30e-ca9c6631adc3", "value": "diagram-714032311.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248d8eea-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702203, "uuid": "4c0fc168-de72-42e3-aaef-5a74b3791166", "comment": "Malware payload", "value": "bf081afbe3eb75ceed1f0a1a4fc1af35", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702203, "uuid": "7b539a11-2644-49c1-a62c-72601caefaf9", "comment": "Malware payload", "value": "088cda2123d63374388b4a08116583e81a60c0fa5bff730b4ce9df1d1177a251", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702203, "uuid": "ff7177e1-3f5f-4f0c-a0da-222eb865a994", "comment": "Malware payload", "value": "8523a1a7a07ff33c6f3044e8d05dc8221c967ce2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702203, "uuid": "1f10cde5-2af9-45e7-83d2-3f4b94095ecd", "comment": "Malware payload", "value": "c69fcbe2fe1bf99656ccf436183322c4fac0afbe707f17570a8da52d30416c0e1addf009869fc224e20bc6371b9422ab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702203, "uuid": "c0a9c9ca-5d72-4061-b1e6-a236e7cd93a8", "value": "F7330188D9C9E332A8F535306C39CB01E5B8B9AB441785A1C1F387A7AD07D915B0ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702203, "uuid": "6c64efef-1f37-4b54-8568-c80aa021371a", "value": "768:nwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2H:+FugXVpoD8ZxhrLAuNS07MrxrKsY0MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702203, "uuid": "786a0a7c-5e57-4c32-bc5a-b595b24e44ce", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702203, "uuid": "0c0f385a-f9ca-411f-89db-3bb0a4a75de4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702203, "uuid": "99712dd2-ed8d-4dee-a547-3cb57021bbe1", "value": "catalog-975057416.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a588d78c-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659041, "uuid": "c00f3546-97e5-4d97-89f6-cec59f5ded6f", "comment": "Malware payload (Quakbot)", "value": "604fe1dd217cc4cfc29766db3483b471", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659041, "uuid": "b5b696de-6f41-4d30-b9b0-24e91494d28e", "comment": "Malware payload (Quakbot)", "value": "089c4c421f428dd0f760871b8b03329303e38c242eb759ed6d6bdcc4ca11ce99", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659041, "uuid": "5932ec55-4527-4c7d-b07a-469dd0a7c964", "comment": "Malware payload (Quakbot)", "value": "07bd4044b41f10a79239cd440a592959f12a4b7b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659041, "uuid": "7a4086fc-d3c5-4308-a186-a06acc96a5cb", "comment": "Malware payload (Quakbot)", "value": "9775718478b3dee205397f2fbb1fcc943f204a0488d8c919f65bd64d8221b61d9196ecce8833e8459b5c40c486309d37", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659041, "uuid": "261aa7a2-3c6b-4343-a796-358a66b52949", "value": "6D74B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659041, "uuid": "dd182ec3-1c3a-43d3-b693-fdd6f9324ec0", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659041, "uuid": "bf49218e-5b07-40e0-9173-9c052bdec1be", "value": "6144:HTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRun:Hbi7/xZrkNK11G9AQyOi6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659041, "uuid": "8e611248-239d-40c3-92fb-f225f3d4be9f", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659041, "uuid": "cc07ecff-3fc7-4757-a9b0-b0fad936c27d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659041, "uuid": "f9c75ff1-65e6-4f51-8504-97d4be183a55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84c8ee7-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659045, "uuid": "bb50db2c-a265-4a7d-93eb-74755c1ff583", "comment": "Malware payload (Quakbot)", "value": "833629174af7ab92c1fa29c710f7501c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659045, "uuid": "76047f06-3e6a-45db-8bd6-e485e7298fa9", "comment": "Malware payload (Quakbot)", "value": "08c65064d5e99766b3455b39b68a90ec3c2576ec1528c0bffbb31abcbd52f050", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659045, "uuid": "034544a5-ee29-46d0-9de1-965b59ca6d8e", "comment": "Malware payload (Quakbot)", "value": "991ee84618dc84b8042cbe82ea360f28a04ec70b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659045, "uuid": "9d5f8c3f-d245-4807-a94f-b44b5b54cdd8", "comment": "Malware payload (Quakbot)", "value": "d9955e7e3c86a80336e7844dbb67b9ce5a018ac90891fd52cfc4b40b170baacca5896aa0d8d23e2c4a3ab7490ebf95a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659045, "uuid": "8234655f-6cb0-4730-a726-585efab6658c", "value": "FB74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659045, "uuid": "2e8bbc49-fccf-4ca4-9597-cb22e2d435a8", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659045, "uuid": "c0c96271-b714-498c-bf0b-4f3b23001fca", "value": "6144:YnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuv:/FrkNK11G9AEtMxQyOi6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659045, "uuid": "633501d6-630c-4826-9dbb-7e54cb7d7b8a", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659045, "uuid": "347bbdc7-0483-495e-86bd-fe392de8c0ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659045, "uuid": "d14e556a-f2dc-4aec-84ca-95b704404a08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97f1231-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701218, "uuid": "dc759b6a-da31-4ef6-ab45-d8092a58b6ee", "comment": "Malware payload", "value": "0e7f09ff6a7f757ffe2119725a714434", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701218, "uuid": "c7f28c36-b52e-46b6-9ae2-7cc2425f5f47", "comment": "Malware payload", "value": "08e2e3360ab41b4e041eb2d28f0bdcd1a91069ff29113c8a26fe8321a06dd715", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701218, "uuid": "d51c63ae-477e-4aca-821a-c56a763df35c", "comment": "Malware payload", "value": "25dfb3ffaf1ecb262dc99d8f254a9f24861b192e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701218, "uuid": "7a6e55bf-558c-4d8c-a98c-6a6e65215ace", "comment": "Malware payload", "value": "dcced413e7650d88b5190652fbf2db2a9a6be6d7a09518d2020759dd5d877bb7c34fa4e14437f1b02787c9056f4a4a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701218, "uuid": "a808d9c0-e49e-4e56-b5b7-b6b98a1267fa", "value": "7F330284C5CCD271A8F17535AC79C701D4B4B9AB081AD5A282F78AE7BD079C10B4AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701218, "uuid": "0f70f1c8-6793-42e3-a19c-b85797c9bca6", "value": "768:awnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2c:HFugXVpoD8ZxhrLAuNS07MrxrKsYO7M6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701218, "uuid": "fb98907e-c44b-4c85-885d-1452e0d3bf33", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701218, "uuid": "c591ff18-3a63-4ddf-8834-0a7f64352aae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701218, "uuid": "7539df23-e69d-486d-ab73-cc20007cc88d", "value": "catalog-230100895.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da913903-a8a6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619672014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672014, "uuid": "949edc9f-1d96-42ad-8401-9f0b39744784", "comment": "Malware payload (Dridex)", "value": "e870376124c28e70c17320abdf382ea8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672014, "uuid": "d5ce56c2-4f38-4161-8fdf-a24708af3b2a", "comment": "Malware payload (Dridex)", "value": "08ff9546e36a3299c71a3b0d9573381372ef2d49645343a153160dc3035329f7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672014, "uuid": "a05b93e4-6a37-4059-82af-caf35865fc43", "comment": "Malware payload (Dridex)", "value": "88d6c7bd279cada97e15220642d994445eeebd6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672014, "uuid": "f23d1129-0b28-4e3d-8e77-a2e8d3d4d690", "comment": "Malware payload (Dridex)", "value": "9da2577de162374cde53cba24e037d10458f711354a83e6588d1aa8bd58bd0285097139bacd1b06e65d3cac53b5cf543", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672014, "uuid": "ae34fe3c-239c-421b-93cf-4f91d7472487", "value": "44F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672014, "uuid": "51ad6005-494e-47a5-8b9a-e585b21dc72b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672014, "uuid": "5443de72-fdd9-404d-9a2f-477e81dc8f42", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619672014, "uuid": "f8a1238e-32eb-478a-914e-18ae95b6882e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619672014, "uuid": "466e37bd-5b8e-4947-a6cf-8a329397d8b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672014, "uuid": "544e32cb-94f4-4694-a1b4-99989f5f9309", "value": "e8703761_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb04c257-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705570, "uuid": "7df29419-e347-400d-a23a-bb043c02c894", "comment": "Malware payload", "value": "aad282f2be5385cdd3e86a7a1e3d8b4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705570, "uuid": "a839c762-d3fb-481d-a648-84ea9673a529", "comment": "Malware payload", "value": "090590264aa869e337d09d116db564f059db7b82e587fb60531394233ba8a588", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705570, "uuid": "f7390286-6878-4ba6-a27b-22622f34cb15", "comment": "Malware payload", "value": "224d81ace84ecc6824706ed1be3da8ddb2bd1220", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705570, "uuid": "548e83d3-3c1a-4312-a66f-ff9fa8a142b6", "comment": "Malware payload", "value": "026edff46a5474b85bf92658b8f90009bacc4fb6387780f867805b989a0c44def2fd1872dba69d32a2b81b90ee1315a0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705570, "uuid": "a7b3d372-86c1-4728-b132-f19e4aea9e63", "value": "CB3301269C5E763D577E10B44A819B1EE54B78AD3C2EC0851C9CF06AEC06AE9113EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705570, "uuid": "9c693bac-8fe0-4470-9673-e6f71903de85", "value": "1536:qP6z4+ADViS8CWoD94pUnQ64x11RiCnPHSi:kPZBiS8jopkUQ64xRai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705570, "uuid": "594d6891-6313-4af2-ad43-2e4a02026e02", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705570, "uuid": "dfb48c45-06c0-499e-89bb-1bf7d553a745", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705570, "uuid": "ef5fbdd0-a930-4754-a44f-0731d6ddb61a", "value": "statistic-1607998528.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efc30df-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706194, "uuid": "ef1f2dd7-fa42-483e-b842-dae1bf39be73", "comment": "Malware payload", "value": "8f1cdbd09314d8c418136bd625a9dc21", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706194, "uuid": "d22a1f00-f388-4e42-b73e-787191b91590", "comment": "Malware payload", "value": "09070da7ccaf6492e626de628cfaa22c703f13742932cb84cda43fbc22eac493", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706194, "uuid": "702ebd58-d333-492c-9f52-fd99fa7c891c", "comment": "Malware payload", "value": "9f6f64e2a34f6b8f52c45465e28a7874cb9d177b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706194, "uuid": "f2dc9806-256b-4e7a-90ca-25054528086e", "comment": "Malware payload", "value": "febd8bd1dee623671e2c434a0da143aa01165ded25c0125b2e0fa9ebe339734c0064572ea1b2c9b851261705aab38450", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706194, "uuid": "469b4dec-7753-41e5-bd42-e24be88e81a5", "value": "2A33021959DE7629532D20F08581DB4FE9536CAA3C6DC9416CCCF8B9EC092A8117FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706194, "uuid": "5133483e-e274-45b3-8981-13d3401eb235", "value": "1536:OP6z4+ADViS8CWoD94pUnQ64x11RiCFa+G:QPZBiS8jopkUQ64xq+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706194, "uuid": "cc4b59d1-3945-476c-992b-769a2357cafa", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706194, "uuid": "1d4fb53e-0c6f-4938-b742-46e4ed2663f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706194, "uuid": "68fca848-bbb0-4c64-be31-8151a531a005", "value": "statistic-2108671383.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dce276c-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705655, "uuid": "007fb08a-bc3b-4b1a-be92-8b3cd6eaefd7", "comment": "Malware payload", "value": "e87024514f2e150ff09e9d9b5554c453", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705655, "uuid": "a696b41c-c87c-4519-b1b3-04cb458db649", "comment": "Malware payload", "value": "091630db5d864ca1d4edaadfb2d1f22d2f18f509b6559fa2a58c708306d5e508", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705655, "uuid": "75b4365c-27ac-43c1-bf70-dcc6baad6990", "comment": "Malware payload", "value": "39548d46fb17228f8a677a53c4a3f3df482e2c07", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705655, "uuid": "96e86b41-03fa-4c11-9312-1f07d7a606a6", "comment": "Malware payload", "value": "fb78052199865b84947bdc1148726c0616a07bbaeede17ad2fd3f32c4f82ea3d187b85d751f054aa7f31655e9df6eae2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705655, "uuid": "f1af67e7-83d7-4d6e-8c0b-dae6ebe0d6d5", "value": "B93302194C3DBB2A577D00F44585DB4DE647289C3C6EC68118ACB475EC0A2E5167F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705655, "uuid": "fdb88b17-2fb1-4ee1-9d2a-8e84d61934e5", "value": "1536:HP6z4+ADViS8CWoD94pUnQ64x11RiC920:vPZBiS8jopkUQ64xu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705655, "uuid": "4bdf7c93-8297-4af0-88a4-759f1fc86574", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705655, "uuid": "7bb3654a-e428-4359-8915-7bf5e7a54f13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705655, "uuid": "21e8567d-75cf-4156-bb0b-552c95c8cf61", "value": "statistic-1662761950.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b9c396-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702789, "uuid": "503c28a9-0882-460c-9a3f-b027c66b4669", "comment": "Malware payload", "value": "92f2c77ae7c7031bf0b4b1895f272a14", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702789, "uuid": "e89cdf59-6b8d-4ce9-a213-31eb5aacffc5", "comment": "Malware payload", "value": "0916a291409004b0133382eaa72185a08fb4db597c5fb0339426694cf3e1035d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702789, "uuid": "b2132434-932d-4408-94ff-62393d104a54", "comment": "Malware payload", "value": "2d354c9a8c897dccb4d4532c09dea120836cb998", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702789, "uuid": "fd1ae9cc-44e5-4b12-857e-5c23733b7efe", "comment": "Malware payload", "value": "59e9305fd2b5407113901ff858920fe44b3b861901b6c0f366db89536645cf48ea0992a5aec98c20d8d787906ec2d573", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702789, "uuid": "3e3a7642-ae6b-4d53-b2ed-37aefe068e97", "value": "5533023E4CBE7719576D14B08945874EEA43688E3C2ECA821DCCF8B6EC05659127E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702789, "uuid": "1e3a005d-151c-40ce-9b83-17e7a8dd0d88", "value": "1536:NP6z4+ADViS8CWoD94pUnQ64x11RiCEGX:5PZBiS8jopkUQ64xvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702789, "uuid": "b99fd0c9-c4fd-4f69-a913-2e95728540d7", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702789, "uuid": "d8cf00df-2c32-46e1-a49b-a117c8b7055e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702789, "uuid": "b69a6be3-1fdd-4337-b2af-7063a96907ba", "value": "diagram-1458324702.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab11ef99-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659050, "uuid": "a3b30e28-f869-4a38-82d5-93c947974893", "comment": "Malware payload (QuakBot)", "value": "a619dc9ee49e6e71fc234170f4411cd7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659050, "uuid": "82d129bb-ff7e-42f5-a1b1-ddd885b23eca", "comment": "Malware payload (QuakBot)", "value": "091afdd65a11655b8a1d2bb72b9f5d0d8cc832a6d9155e5f1803c30449d2c57c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659050, "uuid": "2821726d-601e-4ebf-adea-951e7c9d2aed", "comment": "Malware payload (QuakBot)", "value": "1514f4ea1b80cfe038d6b925cd01e0fa4bcb1efa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659050, "uuid": "a3f8b606-cd6a-40eb-9bcf-ceddbb051cf3", "comment": "Malware payload (QuakBot)", "value": "3657e0a9938d4a8400ca38e275e80cc2ca0b99acb26f7ebbd49954c73b2c69a3dd95647b0ec3601edd5660be32994d09", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659050, "uuid": "cf747842-6824-4eab-a978-7cdb2804c658", "value": "8F549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659050, "uuid": "248633cc-78d2-4fd5-ba1c-3af2de47e024", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659050, "uuid": "ad80a490-83a9-4bf3-9f9f-f7902b08761b", "value": "3072:r3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ9w:rvv9sMoXBaRmr/dukbvuZ/7fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659050, "uuid": "39f3dc90-596c-4062-ab3e-f9f052a7bac8", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659050, "uuid": "5613ce4a-46dd-468a-a4ed-1e761e05b60e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659050, "uuid": "15d17673-0543-4f2d-97f9-8e25df8c2c81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cd47d2-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703093, "uuid": "f9215fee-e86d-4347-8df1-cd1e6fb51b99", "comment": "Malware payload", "value": "6fe506ef484511d36697a6333a0f09d6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703093, "uuid": "f2a0404a-9b0f-479c-ba56-ec565dc6afc0", "comment": "Malware payload", "value": "091f115ab7463662e994fa036e4885b1d93ac2c6e62516fad4a06e03143077eb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703093, "uuid": "dd8e2a4d-e8a4-4357-926f-980d53b60013", "comment": "Malware payload", "value": "23a80121ab33e28ff5bfba0fde0cd6d483b5e3c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703093, "uuid": "b0188849-b9ef-49e4-ad06-f00a5c42cfbe", "comment": "Malware payload", "value": "3285ef2d67f38f115298936f07a2169884122eeea8fca35733516b97a4b4ee9e1a1a3d54400bc8327451f729719bad16", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703093, "uuid": "687cdb3a-2c68-4505-b645-5b7fbfbee4ec", "value": "5C3302298C7D772D572D10E08585876EE51B68A93C7DC1425C9CF4AAEC023AE163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703093, "uuid": "9690effa-b8df-45da-ac72-0ff3e2caf7d7", "value": "1536:mP6z4+ADViS8CWoD94pUnQ64x11RiC9Xs:IPZBiS8jopkUQ64xPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703093, "uuid": "6bcd25fd-f29e-45a6-b0cd-d30ae3f49f31", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703093, "uuid": "52949c0c-1cb6-420e-afdd-64d3f9555470", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703093, "uuid": "c3f856cc-3ad7-40c4-a2b2-4c90ae4177ca", "value": "diagram-1713943929.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add2b427-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659055, "uuid": "fff747d9-575b-4e1c-9ca8-fe6229f7e483", "comment": "Malware payload (Quakbot)", "value": "9ef5f6bbcc1d641848f7276e48326e3c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659055, "uuid": "4ae35d9d-27d2-4267-bc25-709414385ac2", "comment": "Malware payload (Quakbot)", "value": "092df9d3e8db9d273e3fd63414ddd1f251af6b56dc27692433929864f8586059", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659055, "uuid": "ca454e85-2f6f-4e7a-89ed-6efc2ee9b178", "comment": "Malware payload (Quakbot)", "value": "f5891b7718fb7738543cfb3c91e273d80dd683f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659055, "uuid": "2144995e-7cf0-4a15-a276-e094213b3e9a", "comment": "Malware payload (Quakbot)", "value": "c0a080fc7e750a25242dfb40c19c364645c6fcc45a2f20d4eb2f93d2eae29ed994c2840e0d715c049667d65b1a05abe9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659055, "uuid": "5a9e86ac-0b7f-4783-b509-f1b3320b5c5b", "value": "25549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659055, "uuid": "00107d6e-498a-4acc-89e1-803a33ca5e7b", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659055, "uuid": "f50f42ba-af6d-409b-8c9a-1a7dc1f09be3", "value": "3072:Q3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZmc:Evv9sMoXBaRmr/dukbvuZ/7fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659055, "uuid": "4452a2a8-2212-43d6-b1e3-bfe5f9e6ae0c", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659055, "uuid": "18d6fc37-3ad0-4a11-a265-608e171d1754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659055, "uuid": "3f08ccc7-0b23-4e65-a165-075a9b73502b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578ef9eb-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706154, "uuid": "9a465c5e-3fde-4e2a-ba06-bea466826c53", "comment": "Malware payload", "value": "f15666d32f518a2b6e18802739a6838a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706154, "uuid": "183a2df5-0a93-4905-978c-5bb608773f18", "comment": "Malware payload", "value": "093705f40bf4c9e7ddc3e19c0ca97c003e448809652f8cc581dac235cb4c5aa0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706154, "uuid": "b6bcefe1-234a-4693-9bf4-5d69223ecf05", "comment": "Malware payload", "value": "e1a62fff65fb65b582d4e8869dcbc52f34eee950", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706154, "uuid": "837d85ef-628b-42f4-8416-c02179dad9af", "comment": "Malware payload", "value": "40132079b388a6db30df20122998e83ac179cdca0fb5fc0927e485f0b19851fe5cb2ef3bb968f6651970ca01aecae48a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706154, "uuid": "466f8a6f-d651-4dae-b098-d4cf1330abc0", "value": "3133021958DEB629572D10F08681DB4ED9536CEA3C6DC9416CCCF8B9EC091A4127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706154, "uuid": "35ecbc47-5cd5-4e4c-bf14-b4833f2b4228", "value": "1536:RP6z4+ADViS8CWoD94pUnQ64x11RiCPa+J:VPZBiS8jopkUQ64xM+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706154, "uuid": "a53ed4b5-b92d-4357-b28b-abdad6133e5a", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706154, "uuid": "4d1a57d1-4364-4d51-abe7-4e774f3a70b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706154, "uuid": "83e06baf-e105-4782-970d-25f03fe30ffc", "value": "statistic-2075026060.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09239b1-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659059, "uuid": "a05bfe8e-2100-4787-b5b2-2fe0999d2bcb", "comment": "Malware payload (QuakBot)", "value": "2bc16ac80e422ae3a4c77c51feff561f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659059, "uuid": "e547473f-bdd3-4e47-a7f5-37720e1e3cc3", "comment": "Malware payload (QuakBot)", "value": "093b6adf1617d9c0ef4438d004d4d953706827eaf2225c429004a624157537f7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659059, "uuid": "c4f983bc-0c9e-4d11-a797-3c14de17ddba", "comment": "Malware payload (QuakBot)", "value": "9698f2cc5d1f7560ac35f26ff6b79e68fcd5daa5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659059, "uuid": "5646b13e-60e9-4692-a39b-f1e4e2560442", "comment": "Malware payload (QuakBot)", "value": "5880c15269dfbf9f19bf1f18283f5b442fe7b5f75315692fd81ebd794ae9e6a5bd677a1286dfbbc8041e2d513713f386", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659059, "uuid": "a8c2e442-e60f-4abb-88b0-513e4b1b38f3", "value": "4074BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659059, "uuid": "037547a4-4da9-4c0a-a7af-01cff6bf115e", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659059, "uuid": "2b1c305d-eda0-4827-b9f0-d8854c7705f3", "value": "6144:lnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuZ:qFrkNK11G9AEtMxQyOi6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659059, "uuid": "1213b837-c643-4ff4-ac7b-79425554818c", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659059, "uuid": "34b00b96-db77-4744-b3ea-065096d6a0bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659059, "uuid": "f81f8eb8-b86c-4b24-9d53-445ed6b4b6b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326b2939-a8b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619676457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619676457, "uuid": "e8f0adb4-a81b-47cc-991a-01a6c3add4db", "comment": "Malware payload", "value": "d8aa01643063efa3f01d5ab0248e481e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619676457, "uuid": "32f8f8f2-c153-4a49-8065-e982e5a1beb8", "comment": "Malware payload", "value": "093b8924e1dfd81a87f79b8fbaf0b5baad8d00a1822b6ee745d430f301977922", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619676457, "uuid": "331824a7-51db-440f-9e62-26d143dbd012", "comment": "Malware payload", "value": "b70b6533a84d1d5040f19898dc5f99b04cfdada4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619676457, "uuid": "a32c1f52-b007-4591-9e47-3b837fe69025", "comment": "Malware payload", "value": "fc7d8fabf314c9759988cf181676d3af0c1bd9df69a39cc973f356eaa3d861e78ce1fa8572868d08d90642a2bcce19c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619676457, "uuid": "7ea161eb-64a9-4d40-bf70-221f75f30082", "value": "FAD4F02493E88F1AE1BE27B95475000057F2BA56E733E75E7EDC019D0FA7B808652B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619676457, "uuid": "a7ff15e6-840f-4ad2-afaa-d1f79c9516e6", "value": "12288:Lmz/E1LWVgRoBOu1rnNeBB6x9XdJHQp0O5mYHLw2iLsIM0wZZNdY1djV:Sz8gmR6rncB49XzVzYX5TbdAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619676457, "uuid": "b6f35afb-8add-4bd6-a85d-9836a977d565", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619676457, "uuid": "3d96ef76-e1e0-46da-b116-1ec5a8a0bfd1", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619676457, "uuid": "83160fd6-c7d4-450d-86dc-707543859007", "value": "ORDINE N. 078_2021.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3522c41-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659064, "uuid": "f9d08f86-4cd2-4ed3-b526-c857afd4ed83", "comment": "Malware payload (QuakBot)", "value": "249e3a9cc1566830b27f5a1dbd390cd7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659064, "uuid": "c2c3b68c-2cfe-4c4e-997a-ebe4f387a05a", "comment": "Malware payload (QuakBot)", "value": "0946aa1ddebc685fd235590310e63abc42c13861fb732372b47d861a11a41ebb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659064, "uuid": "b89700cc-e2ef-44c0-8929-7024f2730201", "comment": "Malware payload (QuakBot)", "value": "85c65a602e420d0821f96b8a21d4c4ac06fce31c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659064, "uuid": "bfc7e850-832d-4316-b033-dfdfdf2253f8", "comment": "Malware payload (QuakBot)", "value": "4d76a95ec7d6031271a74e36ef199cb550fd3d59013b856b880603a458f2b3640c0cbce0d3d545f8402584995da6d053", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659064, "uuid": "b1ef93cf-68a6-4614-8035-cd67e40e1e7c", "value": "8D549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659064, "uuid": "ebaa8fcc-2691-4dcb-96ff-3a3f26b4b282", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659064, "uuid": "c169d53f-963e-49f5-9df5-c5eb460e76d5", "value": "3072:W3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZmW:Svv9sMoXBaRmr/dukbvuZ/7fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659064, "uuid": "5c213538-7dc6-4574-9963-b98a563d2cf1", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659064, "uuid": "d20d4a53-9fce-467a-a973-f913fc812278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659064, "uuid": "e25889b9-9f69-4295-b3a6-c33dee5bb5da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43078e7f-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700107, "uuid": "e4b9888e-521c-4e82-9e8c-b3b653c17f65", "comment": "Malware payload", "value": "dbd319178debd187166fddedb86c933e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700107, "uuid": "f864fa47-11e3-4330-b897-c58fa5474d22", "comment": "Malware payload", "value": "0951598245ae0cf83c8aa2d61b4755ba462e311182d29437f27e90ee473202d8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700107, "uuid": "a000d8bb-9d47-4451-8940-41af4a517e6b", "comment": "Malware payload", "value": "c3cfae7eb3d75e900aa48780b46ebbbe87891cb8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700107, "uuid": "21e0216a-2a43-41a5-ad61-0c14b018abb9", "comment": "Malware payload", "value": "f7bcbf6493dcfe65146c408813d44d1e57703ac6f83a2e5b50f9f326b58886fbaa2acba087c44852476701e4dad30bda", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700107, "uuid": "d001cab9-132f-4729-950c-2ba55349ad98", "value": "073302C8C688D37698F17835EC79C701D978AA6E0817846583F74AEBBC07D901B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700107, "uuid": "06016228-15a5-498b-881b-a0794b6a4262", "value": "1536:WFugXVpoD8ZxhrLAuNS07MrxrKsYyh+WTf:Aq41rLZNkZLYc+Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700107, "uuid": "dc73fd40-5afd-4ad4-8157-153b8f5ea572", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700107, "uuid": "598c9196-c13f-4102-b138-9b9ba6bdb5a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700107, "uuid": "89ec2e04-60ec-4108-8fc3-830c199ed860", "value": "catalog-128385854.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b614d4eb-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659068, "uuid": "19aa2239-be34-4702-9d33-2f68d6445606", "comment": "Malware payload (Quakbot)", "value": "ce07ef48ff9d01b15ebdf8f95b940f26", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659068, "uuid": "9e0028c0-ada8-417c-a073-ddfd9bb17804", "comment": "Malware payload (Quakbot)", "value": "09529e03eff979973228a75b2fb7336bd12e342a05076ec5adeeffa4400efdb9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659068, "uuid": "1af507d8-c6c5-43d0-81af-794626dcac94", "comment": "Malware payload (Quakbot)", "value": "7a8b82a8e4495af34507618826be2e79f1fe512f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659068, "uuid": "bda6090e-c7c7-4cea-be61-250e12692fb8", "comment": "Malware payload (Quakbot)", "value": "c82a4cdf3625fb1e5622f2eba65eddbe72b40e8606ef883c68c0639bfc0fc3de902d3a77859e0cec67004c3cb0148e8f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659068, "uuid": "4b51433f-23ee-4c2d-b2f6-e573ee466e1e", "value": "1F549E7AFA12DC02E7A82BF023C36F581A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659068, "uuid": "6af4e7ad-f895-4972-ab79-948086e1d076", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659068, "uuid": "3fc5eb23-d33c-495f-b7f1-d409b966881e", "value": "3072:53FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZil:Jvv9sMoXBaRmr/dukbvuZ/7fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659068, "uuid": "cffc53db-3729-4143-9e1c-afe567119373", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659068, "uuid": "64ba926e-6657-4b29-977b-0c3a181a749b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659068, "uuid": "ae248863-65cd-4189-a660-02653bbb3bec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b301ade0-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705449, "uuid": "fc8887b3-1895-49cc-86f6-bb8cad9f6aed", "comment": "Malware payload", "value": "34573fc5b930c55df648e8873358849f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705449, "uuid": "640e4cfb-e24f-4254-90b7-b6ae0e7ffa7d", "comment": "Malware payload", "value": "095c4e21b2997dbed3b2cff6a8ae87b07f79debbd3d297b6e7af118ed517e0c5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705449, "uuid": "a31122f0-6058-4402-9f60-d28b8d1665aa", "comment": "Malware payload", "value": "71bf3a53c548d54247e115bd8def26d13ba91e10", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705449, "uuid": "fb80838d-0800-4cbb-987c-b44da31129f3", "comment": "Malware payload", "value": "989bd02af1a2ede5f5aec39d20fc6068e1653bd7dcbc030a6e6bb6a85c108d27e59d8de4a9aca6e32cee391f0741f177", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705449, "uuid": "332b4ed5-4e38-4e12-bfb8-893c64ee65e1", "value": "2133021D5CAE7725576E20F08584EB0EE503699D3C6DC9925CCCF4B6DC096A8223EBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705449, "uuid": "b916cfec-271e-44a3-9060-74a2908b864d", "value": "1536:gP6z4+ADViS8CWoD94pUnQ64x11RiCrQw:WPZBiS8jopkUQ64xlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705449, "uuid": "ecd7d275-dec3-4c2d-9b27-bd9d3f0074e2", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705449, "uuid": "18eff03b-4b9c-4be2-bc17-b1af223e5867", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705449, "uuid": "15e70a10-847e-4394-bb1f-fabf768019cd", "value": "statistic-1506535266.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a68dff-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703437, "uuid": "60d1ae77-62b1-47a9-b21c-60e06155e874", "comment": "Malware payload", "value": "d3ba7774fce926e78515efe21ee8becf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703437, "uuid": "6fea42eb-b47f-4afb-bcbc-fb956809c456", "comment": "Malware payload", "value": "09658c33cd58d8361a7efcd47d2c46a8a84d949a48dff8ca82789755e71fe7d9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703437, "uuid": "42d4c578-c98c-4459-8ed0-e9cf51f37e7a", "comment": "Malware payload", "value": "2f0f557b3dcfd83dd840c30e104e57eac7042390", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703437, "uuid": "abe9d37d-eb6d-4c15-97c1-903efc0ba60d", "comment": "Malware payload", "value": "a3cb7afbaf576f27d026a0fa0731d0037246bf5afb8cc3bf6d8acb814c0e757df724a7fdda7787e75c24ccaa8cc3a88e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703437, "uuid": "027868f7-1569-4d60-8efc-6325094fbb59", "value": "823302298C7D772D572D10A08585876EE51B28A93C7DC5425CDCF4AAEC013AE163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703437, "uuid": "223be743-1bde-4a45-b4a7-3e8a3ba36c3b", "value": "1536:sP6z4+ADViS8CWoD94pUnQ64x11RiCqU3:KPZBiS8jopkUQ64xv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703437, "uuid": "3db071b6-abda-4345-ba78-bc085588e318", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703437, "uuid": "b634b8df-0c57-4fc0-9288-bcd40f176ff0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703437, "uuid": "5847c908-a795-4051-af95-ef5ddd279027", "value": "diagram-1902509005.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7d1c52-a8fc-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1619708849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708849, "uuid": "398720d3-a336-4495-9c08-f2e212285bb8", "comment": "Malware payload (ArkeiStealer)", "value": "a6226ac51873540a25c2d5595b4e8c32", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708849, "uuid": "cba02304-b42e-4fcb-bad2-667857647fbd", "comment": "Malware payload (ArkeiStealer)", "value": "0980017e619dd4c5a946bb827d3aa6bde000c7f533c16f12f9d74c253818730f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708849, "uuid": "b6f1c4fb-15fb-41b7-aae9-80fd213d6c42", "comment": "Malware payload (ArkeiStealer)", "value": "7c6ca7f040ead69c4dd52fc88be258ac4dec242a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708849, "uuid": "549083d0-0426-4d29-b799-0ffdc94de733", "comment": "Malware payload (ArkeiStealer)", "value": "390a702287eb5b4c9326cc76b6210e7b770c02d742c0490a491fb193f0663558561f007b03261f4db7b31a619c010c80", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708849, "uuid": "417b4b04-d7d3-4f32-a1d6-1cb373288b62", "value": "83B4021034D4C0B3D8926ABB8D54CBB55FBF746555623E8EAFD606F80F18783A624B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708849, "uuid": "9d00b1ed-c85e-4d37-96b1-8305454abd2d", "value": "2989f428aa578b7654d541c15275e6cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708849, "uuid": "18ec4f92-050c-40e9-a84e-4024f2abd9b4", "value": "12288:uRKf4sRE2GksqXK85N//Wq6BT2HUnoeuY6F:bQsRE2Gksq15N//UmUnBz6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619708849, "uuid": "ddf9878c-40b7-4ed6-937b-6a73d7fea2ac", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619708849, "uuid": "aedbd78e-9c39-4400-b98c-4fb1ac4d4f9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708849, "uuid": "135bd2cb-fdad-4a00-8c9f-223ac1eea72f", "value": "a6226ac51873540a25c2d5595b4e8c32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195c92d5-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700467, "uuid": "4308c784-ab97-4a10-ae96-3e58156ab41c", "comment": "Malware payload", "value": "404c8f5db24943517c21c90352b0b8e3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700467, "uuid": "eeec6cfd-4d45-4f9b-bdca-8107e68037b1", "comment": "Malware payload", "value": "0981378b8b289dd9d014c37b1ff966c2ae3d4e1772047cbff560482e69e68579", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700467, "uuid": "01a44429-fe75-445e-ab7a-f1f86842f4e2", "comment": "Malware payload", "value": "2ba363f8c0aa25e2d96d4cfbe1fe369b47bd73fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700467, "uuid": "e5dd784c-fb2e-493b-82e2-84d83da382b2", "comment": "Malware payload", "value": "b683a14ceeb1d627f0bdae18b548122d136400b4460ccc5309c167da0f83ac1bde276af6def8ddd9649644d4ee9b5603", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700467, "uuid": "518f2b81-48a0-4727-b012-c480017238b8", "value": "EF33F188D6C9D372DCF639319C7A8701DAB89A6B0406C99182F386A77C07AD5274EDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700467, "uuid": "974fb9be-6c56-4006-b8d7-49719cebe0eb", "value": "1536:pFugXVpoD8ZxhrLAuNS07MrxrKsYs3zBD:Zq41rLZNkZLYKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700467, "uuid": "0b95d83d-0fa3-4d3b-a294-0b9f523d0136", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700467, "uuid": "fd1300bf-b2e4-4d20-9406-0275e517d486", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700467, "uuid": "056145ca-7e5e-4c84-b45f-9cee9aeeb726", "value": "catalog-1540396828.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6ae32f-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700557, "uuid": "b956c007-0839-446d-8486-e4f0ff957f94", "comment": "Malware payload", "value": "9a984696637adb6d7137491a7b717435", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700557, "uuid": "5a93fdd4-ff67-4eaf-851b-d29f22e266e9", "comment": "Malware payload", "value": "0985f6a262d34989a418a093e8392cb9e8cfadc68a2b2bf29100bd2ad43e7482", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700557, "uuid": "0a843626-319c-4908-bd65-199b1bb8d078", "comment": "Malware payload", "value": "229f7c850aa066cb5c80ec1cfb4c2a43f646c14c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700557, "uuid": "cd591ff2-98e5-4e63-819f-cb6f70d67ac7", "comment": "Malware payload", "value": "eee4f59ee7965a8e0e05c432ca9fda26a31967c891119672f32dc11fdb725f164fa5427025b95d6d00089ed3d39291a6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700557, "uuid": "5ac75319-1d63-4180-bdc9-e1d0d2f3db23", "value": "3C330188D6C8D232A0F67534AC78CB02C578AABB0416C566C1F387DBB907DE5670ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700557, "uuid": "1e1b1f63-17e2-4485-bcf0-70761c73ae9e", "value": "768:bwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2A:aFugXVpoD8ZxhrLAuNS07MrxrKsY5axV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700557, "uuid": "b00ee735-6eac-462b-8af9-069788babc3d", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700557, "uuid": "670b56a6-d3d2-49b1-8bb0-d057098bf0a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700557, "uuid": "8152b870-df55-4d45-b4d9-2796a07c5a78", "value": "catalog-1609841129.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d70f7f-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704538, "uuid": "0c786947-ddaf-455d-8c38-37ba8de50a77", "comment": "Malware payload", "value": "18fc9ef12950376ac8c1b9b2b947b1d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704538, "uuid": "15b7d133-dcfc-417d-8ae3-2a2832344186", "comment": "Malware payload", "value": "09868c2d992d5874f390d61f59f5891b0121fbd5ee5fb9dc77fb0da67147de2f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704538, "uuid": "58ceb8f1-92e2-4df6-a50a-ecbb6175cb1b", "comment": "Malware payload", "value": "973569c9c4ddb27b517554172c61e59085de5706", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704538, "uuid": "ddd8a3c7-4e83-42fe-ac16-09340eb92129", "comment": "Malware payload", "value": "184044fc1dedf48e23ea1520477ae3886f7a7791f4b58a5109748099b92a24475376dc7c951cb9994d12c7a12db541d1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704538, "uuid": "9d637564-c488-4dae-b1e0-c4caaf6c6184", "value": "CD33122A8DAE7A2A572D10E08945C75FE617188E3C6DC7824CCCF4B6EC056D5063EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704538, "uuid": "2e94ed5e-b30d-43c4-b944-b2b839ecbc23", "value": "1536:fP6z4+ADViS8CWoD94pUnQ64x11RiCFb/M:HPZBiS8jopkUQ64xjzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704538, "uuid": "e4fcce4c-91b8-4f1a-8097-6349eb43fcd0", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704538, "uuid": "2444a320-730e-4743-9872-a3ae49d76e88", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704538, "uuid": "33dc4bbd-eed1-4fc4-925d-1e6b2c2710e7", "value": "diagram-819671309.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8410f2-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704738, "uuid": "76df1adc-989b-4ebf-b171-ed4a7e1a222d", "comment": "Malware payload", "value": "d4411ed7c12c0902adc700b1a8e53f51", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704738, "uuid": "9a790e02-47ca-4c08-8b5a-78147b033620", "comment": "Malware payload", "value": "0987efab9ef255fcd31f8eba6b2df634aa2cb146c6f0a9a1885819ffd9915792", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704738, "uuid": "09689846-b46e-48b1-9b78-065208f62762", "comment": "Malware payload", "value": "a5b6978d93c153a91c51243d6fbe11d8efed8782", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704738, "uuid": "dc78f17e-7318-45f4-b651-a717ff2d4cd7", "comment": "Malware payload", "value": "ed289f34a3b621394f51dff2ea893ebe477ed45ab2dc25627ce531db0c1e010944c05a746b9427b575391ff0f16b2f57", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704738, "uuid": "7a3d95e1-5a9a-409c-9c3c-bc6c889e1d5d", "value": "44330129887E7A28532E10F14986DB5EDA076C99386DC545289CF0ADEC067E9017FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704738, "uuid": "b0859789-05d1-4105-bf56-5340c952155d", "value": "1536:TP6z4+ADViS8CWoD94pUnQ64x11RiCZqg:jPZBiS8jopkUQ64xGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704738, "uuid": "0049c958-c69f-43d4-8662-9701d29776f1", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704738, "uuid": "2ed4b1e4-b34e-4766-86d1-e9cbdd2f3f37", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704738, "uuid": "82645342-b946-4732-9633-797e2aa4a68a", "value": "diagram-941698606.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba622d1-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706054, "uuid": "0464d836-4c6b-4e84-b06a-e1ef0be68b22", "comment": "Malware payload", "value": "4715d5f7ea2c6be52232ff8e602607a0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706054, "uuid": "ff604292-624d-4f3b-b20c-b941557b3b4f", "comment": "Malware payload", "value": "0999959895b45cdc9472e82880cfe062537b08fcfe769b3b601002479af0b9b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706054, "uuid": "782bdafa-5c2e-4e59-b696-53baee348bc3", "comment": "Malware payload", "value": "dfbb24334e5311177645a70ea880b4dcc3ee698f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706054, "uuid": "47910516-1fc7-44f1-841a-5f0e137812da", "comment": "Malware payload", "value": "c5a54e5cc15da2c921ea9aafa991fb4e2dee26627c7da461171ac769c69176cdbc080b6cf69325f5841bb66424c39469", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706054, "uuid": "aaf6de67-dced-4aad-82d4-665f48784503", "value": "7833022E986E7629473D10B484498B4EE657189D386EC2822CDCF5B6DC027EC163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706054, "uuid": "ad3d9bf2-3409-404b-8b8c-0f7b2a548200", "value": "1536:kP6z4+ADViS8CWoD94pUnQ64x11RiCFOPvP:CPZBiS8jopkUQ64xi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706054, "uuid": "a4dd56ad-9722-4acc-9b42-1ad028299acc", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706054, "uuid": "d02e41cf-693a-4d07-97f7-1cbf3db75444", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706054, "uuid": "defb22a9-66f9-400b-8a5d-66e85c6c2a66", "value": "statistic-1990601374.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d078d6-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619734087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734087, "uuid": "95eca273-1ce9-4774-b6c8-4fc8ab488eb0", "comment": "Malware payload (Dridex)", "value": "65a907d9a270d39c73b57eef74cdf61b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734087, "uuid": "21f118f2-55d3-4068-a8d5-94543618ee91", "comment": "Malware payload (Dridex)", "value": "099a0edf8eed8701dffee6ec7720bf9a42796065a3717b5346f34d1f80eac4bb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734087, "uuid": "526cc192-080e-4b48-8a94-83b10e646dfb", "comment": "Malware payload (Dridex)", "value": "ec9de6866e9fc9fbe835ba8785c6d8a5259284b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734087, "uuid": "0e586625-b917-4783-8353-c382eaa047ae", "comment": "Malware payload (Dridex)", "value": "46f912c145d85df252dc3cb76b4e21133f037ef47ce1057b5b88129ee4da86192fd819700a22e8da971594c010593508", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734087, "uuid": "a22099f3-d0ec-4dfa-95f4-c0c9e5fcce58", "value": "83F3CF82D702C1ADFE212C7A28E677753D5837905E58CA69E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734087, "uuid": "957067d5-616b-4cd2-9da9-def6e812ab6a", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734087, "uuid": "8ac305e1-41bf-4716-abfe-bf3133d3fc08", "value": "3072:Su5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh8WH6:752j4pk5zMbVO6/HUIXU8KgMyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619734087, "uuid": "37ab045a-15bb-4c6e-ae12-2341094bff35", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619734087, "uuid": "2b03a48e-6812-4101-80d1-145d485dc724", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734087, "uuid": "6050de49-74d9-467c-84b7-52c9eed56a93", "value": "65a907d9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dc93c2-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659073, "uuid": "ce03e846-aa78-46cb-82f5-b12c375c7bea", "comment": "Malware payload (QuakBot)", "value": "52ca6e12433314ea3427989a60a278c7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659073, "uuid": "9f79918a-daa0-492e-8494-47fda1544129", "comment": "Malware payload (QuakBot)", "value": "099d838ec7c8cc24f768ecd48d82d541dcb19ab244e202acf33a90a4fefb696e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659073, "uuid": "55da6fc3-134d-4eb9-9456-5c49ca12785a", "comment": "Malware payload (QuakBot)", "value": "2579843443d64ddf1c8c13a58340b3a4d3f8df69", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659073, "uuid": "b729b0b5-effb-4063-ae3a-6a0ad930e431", "comment": "Malware payload (QuakBot)", "value": "49c9725542726e90efe188eb9086fc7f9f963d11be99483f6ddb599d5fefaeecfe3a6e7171f1926931e0bb7ef3388748", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659073, "uuid": "204e857a-782c-43d5-8d84-8493aa289bd1", "value": "E8549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659073, "uuid": "eeadf3a3-a996-4f29-a935-2c97987917b0", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659073, "uuid": "eedb6c32-040f-434a-b5df-f231354ad928", "value": "3072:I3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZU2:8vv9sMoXBaRmr/dukbvuZ/7fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659073, "uuid": "ab0eea77-1831-4768-8b25-9a86831da9e2", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659073, "uuid": "3f1a2696-bc57-418b-a08e-e3b0d1ae91e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659073, "uuid": "08fc6585-1a28-4827-bb7f-f91ac818fb49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c072096-a8a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619672769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672769, "uuid": "2e2f2311-1330-48a9-8deb-081f3f773aad", "comment": "Malware payload (Dridex)", "value": "bf179ff5df0637cc33b1393ec8e2a356", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672769, "uuid": "8718ed70-07b6-4667-a884-52614608c0c4", "comment": "Malware payload (Dridex)", "value": "09af59ece7cec7981fc5df476f79b69a299188f9e78b5e0b65e7eb9ab6918329", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672769, "uuid": "639e6927-0c59-4ccf-a033-bc6a697d79c0", "comment": "Malware payload (Dridex)", "value": "12f0991f9cbaa48665a0a7c79922ac6065a3a7ce", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672769, "uuid": "21780b3c-46b1-49a2-a1b8-68dd69be8ebb", "comment": "Malware payload (Dridex)", "value": "631c8dc13ca95c132a0f48bdaf3dc08d81c250f8b8cddee517b04345fa81fa94b09b222db24b2b6d14ba006ce2493434", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672769, "uuid": "32d0db45-5d0f-4f43-b6fe-1575a6a117f9", "value": "E2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672769, "uuid": "3bead4e8-a415-45db-a92c-13733c4deb95", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672769, "uuid": "21b37aed-ea80-40d3-8b00-3b59fb19cf5d", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619672769, "uuid": "04072f41-bc8e-4913-ba50-c229a55e3ce1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619672769, "uuid": "5ecad042-cdba-4de5-bf12-801f8572bf15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672769, "uuid": "48df6ebf-c266-48ed-80a3-82833e25be0b", "value": "bf179ff5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca98473-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619733946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733946, "uuid": "3659d4cd-3776-485f-b781-e4551366c24b", "comment": "Malware payload", "value": "58276a79e7a452551334783bb978a8f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733946, "uuid": "362e51f2-6bac-401a-be38-91ab91fd1f50", "comment": "Malware payload", "value": "09b84c5f36aa70f4f3d7d444c7db91996911e0408424334572f3eec05a6b0fdd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733946, "uuid": "dae87732-927e-4735-8013-9128f14ffda8", "comment": "Malware payload", "value": "ec09009d57640122cbecba8b32863f275d91e00f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733946, "uuid": "63b8cf4e-9df7-40de-9aea-3425eb86ba0c", "comment": "Malware payload", "value": "9f68f6aa9cf0cbd85fb96bfaff2e97fa5f86f3b96cee97608d92009d104431c290c0f981d62e43e866bae90736db8a2d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733946, "uuid": "89a11bf2-71a0-4629-bdba-f85101d411db", "value": "92F3CF82D702C1A9FE212C7A28E677753D5833905E58CA68E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733946, "uuid": "e416ab0c-a729-4bac-af5a-92c578a697df", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733946, "uuid": "7795673f-2069-4d2a-aa23-86db7ce4d8f6", "value": "3072:VB5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh8zH6:D52j4pk5zMbVO6/HUIXU8KgMyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619733946, "uuid": "9a77765f-9b2c-476e-91b6-dbcd2184baa8", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619733946, "uuid": "bb2f8f1f-d68c-46b4-ba05-34c5eb90b754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733946, "uuid": "3654344f-5e44-40a7-ada5-740bfd785c6d", "value": "58276a79_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0ded13-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703640, "uuid": "a9ae016a-de68-439e-9862-253b197742cf", "comment": "Malware payload", "value": "6cd5ef7d42ee2d8f32095fccf5748f4b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703640, "uuid": "60329f2c-a8c2-4af2-9edf-a6bdc6d06692", "comment": "Malware payload", "value": "09b92a3ac179c38a7372805916ac6f09d7e64a09d49e4c2a2fca4cb83ad800cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703640, "uuid": "c7ad26c3-88d8-4d19-bf0b-cd375a3dd118", "comment": "Malware payload", "value": "2515fb494fbe8789ef817b215b76c5a32987a175", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703640, "uuid": "2a754c03-4112-42c5-b433-5a154233dd47", "comment": "Malware payload", "value": "e4286636c1066143fffa267fac69ebf7dc4c42926f260f00524ded83938e79cac3f69aebaca134eea7649acc77b7725d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703640, "uuid": "c8231a13-c1c4-4574-82a7-cd4b4a434c18", "value": "C433012588AD773D637D10A089858F0EEA1B2C9A3C1EC5D21D8CF4A6EC06669117FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703640, "uuid": "291d3517-8770-4182-9dfa-1563c43c455e", "value": "768:Q9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCQUD:xP6z4+ADViS8CWoD94pUnQ64x11RiCQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703640, "uuid": "d882fe1c-a201-42d4-939b-7b12633f7823", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703640, "uuid": "922b69ff-7a35-4141-9217-99888a4e00f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703640, "uuid": "33054da3-7056-4c21-9a64-b2723d8d6c20", "value": "diagram-2043578383.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dda7e64-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700904, "uuid": "f3f3d8f8-d564-47fe-b369-719f6f4a8f4c", "comment": "Malware payload", "value": "44e9b9cb6e5a7f5d19c6d24af50dc791", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700904, "uuid": "a383abfd-a8b3-4c49-9578-8734e1b7d8de", "comment": "Malware payload", "value": "09bbcdf8f8e4a37da04a2dbe85cac3dcbc38370f8fb67f494af524bfa31ec0f4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700904, "uuid": "3d3f956b-9492-4efe-a70e-694f965a98a1", "comment": "Malware payload", "value": "4becda070337adec7fcf70b8675f88d38135ec4d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700904, "uuid": "ed589a95-fc45-4b18-bd5c-e222cc244489", "comment": "Malware payload", "value": "a697b90c765db7605a832d0dfac0aae0ebf35ab9bb7e057623a0c4a2dc0de3c413c99f1cda4811cd1e5e6f592ccb6238", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700904, "uuid": "6f2e8815-656c-43ac-9960-f6c9dc81243d", "value": "E933F1C8C9CDE331E8F534356C398B02D578BAAB4427C17181F34AAB79479A52B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700904, "uuid": "4a26faca-0eea-4709-af0d-9db1b38b636d", "value": "768:OwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2D:DFugXVpoD8ZxhrLAuNS07MrxrKsYetu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700904, "uuid": "4c7d0014-fc9f-4ffa-8c90-96be002d0991", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700904, "uuid": "a4a722a4-8586-46cb-808b-6e9e310c6c13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700904, "uuid": "bd0bb730-81b6-4934-bdf1-437460ce7c65", "value": "catalog-1918837939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681beb03-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701028, "uuid": "4a2b5c96-fc61-4e07-9529-628fa106c42d", "comment": "Malware payload", "value": "e716e89fd2d95338acf4e0be6db4aadd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701028, "uuid": "6eccc3c6-e5d8-46d6-a180-7718378c81ac", "comment": "Malware payload", "value": "09c3ed8323935649bcf178ed78522d45edace774aad527ecde3c08055fe0c822", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701028, "uuid": "1dc44234-6f43-4cd6-b5bf-2c50ec45f2e7", "comment": "Malware payload", "value": "9f78d327efae0acbabdd50150b6b181b421cb48e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701028, "uuid": "24f8b975-2e38-4ccc-b243-e1eba8d7753b", "comment": "Malware payload", "value": "f429e7a29279e36d6309d0f6966013f35ed13e394ad271bd80ccc576b8849d40c57472f6dd83ef491afeb120069cbd03", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701028, "uuid": "dd75336e-88fc-4398-894d-7da6f0429592", "value": "BA33F148D6C8D372D8F639319C7A8701D9B85A6B0406C99182F387A77D07AD5274EDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701028, "uuid": "cc3d86af-90e0-49f0-8787-caa5bd9b5ebf", "value": "1536:MFugXVpoD8ZxhrLAuNS07MrxrKsYw3TBZ:mq41rLZNkZLYWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701028, "uuid": "c7c2a956-0365-4bbd-bacd-6283c0c18b17", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701028, "uuid": "d0c319ab-cbbf-4732-b8f2-a6ffcd65adef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701028, "uuid": "77a3b484-2124-43d2-8488-55c4e498a79a", "value": "catalog-2015842738.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515c3412-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705715, "uuid": "836edef4-7e45-4b50-8e8c-f19391ff96bb", "comment": "Malware payload", "value": "6a1c241a25c49b7d9dd180e6d8854831", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705715, "uuid": "8dc6991c-97c0-440a-a58f-66399cc7bf1d", "comment": "Malware payload", "value": "09ce8c2c119a211d15e5497a385e2cf18b7cfd10bb7b393b71555278d66e7867", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705715, "uuid": "70d57d24-a035-4eeb-bc19-30dffa2e3fc0", "comment": "Malware payload", "value": "9f7fb7ec86fa876d494138162e914bc449493e47", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705715, "uuid": "7fcee85a-ab0a-4049-989c-039515d08a42", "comment": "Malware payload", "value": "f01d11063cc68396a4ea674feccaebefd3ee51b418d18f859325f1c0bee6341745c66c5524c2f4d6fc1ea029fb967f7c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705715, "uuid": "b918dbcd-50d4-425a-ad7a-6c6b90309311", "value": "65330129986EBA1D677E10F081859B1EE65368DE386DC5811CDCF869EC0A2D8113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705715, "uuid": "d314540d-f770-4994-b02d-5c884580d4d3", "value": "1536:hP6z4+ADViS8CWoD94pUnQ64x11RiClGoU:FPZBiS8jopkUQ64xbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705715, "uuid": "b60040ee-9924-4665-9d8b-6b0e4a6ea2fd", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705715, "uuid": "8aa252a5-bab6-4b15-b9e4-54b09572e68b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705715, "uuid": "00429f7e-882a-43dd-aab3-53b1881255c4", "value": "statistic-1717210799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2c9d86-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702463, "uuid": "666d201e-9a96-4284-8ce0-09dc424ecfdc", "comment": "Malware payload", "value": "f792a1dd9201eab3a1503df1ebb52698", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702463, "uuid": "9ebb80a4-25bf-409d-abd5-88359ca524dc", "comment": "Malware payload", "value": "09dac0dc293ea2bc47799b1521632bda1de3209c0b4fd7169f0f59a589dc8862", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702463, "uuid": "e9223d95-1e42-4999-8a86-87aaa6669b03", "comment": "Malware payload", "value": "4070271784c1b3b69eacb7ca86996c4b16d98c64", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702463, "uuid": "30c2fc99-cb9c-477d-bc1e-6d73ceb41ad5", "comment": "Malware payload", "value": "b4c20b480de421628539a65bb8d1ead646d9967b807cd254f031860299be2bc5aea709515e2f120685bd39fc6facbd44", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702463, "uuid": "a6792400-37a9-4344-82a6-a813c384083e", "value": "6233022A4C5E7B29537D10E08585CB1ED607A9EE3C6DC5412C5CF4B6DC05BA9123EBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702463, "uuid": "f442a334-b846-4b28-8ed5-b7a2c6a8482e", "value": "1536:rP6z4+ADViS8CWoD94pUnQ64x11RiCBKgsy:7PZBiS8jopkUQ64xugsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702463, "uuid": "f703efe8-f3eb-434c-a763-cdd2dfaade7a", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702463, "uuid": "975a8600-3082-4970-9796-23dcdf0500f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702463, "uuid": "d0b19f09-3d1f-4304-9869-78701ddf1f40", "value": "diagram-1180682462.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbaa4fb8-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659078, "uuid": "ed7b9007-23b7-4385-95a9-2afbe8c31f5e", "comment": "Malware payload (Quakbot)", "value": "b5f3e15022052058ef16d7d8bfc98b4b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659078, "uuid": "a0d2c34a-4d9c-45a4-a3db-333842027a4f", "comment": "Malware payload (Quakbot)", "value": "09db4b32f81da0619d3b28658e6e1d20d9cce56229cae2633ddd4d8accd3093c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659078, "uuid": "ba5dad08-07ef-4230-af12-e8b58f2d0e37", "comment": "Malware payload (Quakbot)", "value": "b9d3d89e20e55ccbd813241d0c4eec08e1ddefdf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659078, "uuid": "7c07b831-cf0e-4b1c-855a-b73af6473667", "comment": "Malware payload (Quakbot)", "value": "6f44ab83e6de406ddd231ad51bbd723dbae1dee20093cfdf8dbfcb018b55d66190360dbd2ae8fdc71b0fe1cf0ee12559", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659078, "uuid": "a22f21fc-3db4-4a9f-90d8-c57e8e378bad", "value": "9674BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659078, "uuid": "50838971-fd57-4f84-a2b1-8a2d4c4ab480", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659078, "uuid": "7d77ccb3-974f-45e5-a08f-00ae7403b9f3", "value": "6144:XnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu+:AFrkNK11G9AEtMxQyOi6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659078, "uuid": "d9893228-b1bf-44f5-a584-e18ff58fb4dd", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659078, "uuid": "6a07d4e0-1420-4229-b632-77a6968ebc1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659078, "uuid": "7ea01bb7-18c9-47c6-98e5-8adaa653d5e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81893eff-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702359, "uuid": "8bd6da27-3fe9-4731-8a9b-8c80bcf3fe41", "comment": "Malware payload", "value": "85f4897fb2bb1c9565ff05c8132690e1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702359, "uuid": "2a1ad9aa-b01d-46e1-b080-c33c7f98b849", "comment": "Malware payload", "value": "09e743313e03de8eeb5fda672b19f25ae24cea1192ae85d8a86ba28820e562fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702359, "uuid": "fe05aabb-23a4-49ac-8b39-530a68c1038b", "comment": "Malware payload", "value": "fcfd17618c174be4d0cda2bbbe24a0315d3c1507", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702359, "uuid": "ce5e58a3-2541-4d17-bf62-edcf280b29cd", "comment": "Malware payload", "value": "6947fe1edab9323ad5f85493570abc238be01ce7d04be67e29a84765ff4f68b027099d22a44973399ad904b288ed3b54", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702359, "uuid": "6051dbd5-9a57-4f14-8df5-0019fcd176f5", "value": "E33301294DAD7A1D532D10E089459B4EF617A8BE381DC9D21C9CF476EC062AD123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702359, "uuid": "15bf80b8-66bd-4662-b32a-db297bbc2aeb", "value": "1536:SP6z4+ADViS8CWoD94pUnQ64x11RiC1Sz:sPZBiS8jopkUQ64xez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702359, "uuid": "3514395a-9246-47ef-a71c-b677f55ff352", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702359, "uuid": "69589f8d-9806-4800-9b9a-c67deaae488a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702359, "uuid": "bb23b0bd-9f7f-40c0-9c6f-2f66faf7e887", "value": "diagram-1090192114.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a837e5-a87e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619654726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654726, "uuid": "dfced903-f3f6-4d5c-abd2-db2e88b85854", "comment": "Malware payload (Dridex)", "value": "5dca128613ecd9dc5bbeb291dbae8b4a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654726, "uuid": "06356093-b84b-41ec-a0af-a225e38def5d", "comment": "Malware payload (Dridex)", "value": "09ec87ef04d21018c823705f40b774212cc511d5d5d9df6c413e9e984a9bd8fd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654726, "uuid": "25bc7fe2-392c-4b03-8324-78c1ee055140", "comment": "Malware payload (Dridex)", "value": "1e7400cebd48ac905c7d15055b0672692e441bfa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654726, "uuid": "655d0e1c-b99d-470f-9f75-d478a0074c95", "comment": "Malware payload (Dridex)", "value": "263d5f9f78383d4a5aef5de26f896e646d934d52444940633144a7ae6c88e3c929cf654c089365770669b2d9f07fd9b5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654726, "uuid": "29b1506d-d172-4b2e-9e9c-007c59c75708", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654726, "uuid": "fe3c10f5-d57b-4b99-99dc-0c7251e2f4fc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654726, "uuid": "cbe58b54-9e69-4059-a885-bcdc404b37e9", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619654726, "uuid": "5369c035-02b8-4dfb-977b-6f08b25d6732", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619654726, "uuid": "70c14ce7-5323-4ff3-b66a-8b127f20f919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654726, "uuid": "018415df-085e-4ae6-8f02-8831749c9c3f", "value": "5dca1286_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8d3532-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659083, "uuid": "c9e21bc6-b6ef-4c4a-9cda-a6bfe27e9481", "comment": "Malware payload (QuakBot)", "value": "20928ce1f33effc101c7c42d9f7c58b5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659083, "uuid": "b9730cd8-59f1-4a5b-b2af-3936fe1156f3", "comment": "Malware payload (QuakBot)", "value": "09fa58aded2f60c2e971923ac09f6e36162eb97860b7d227597e1324ec5c388f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659083, "uuid": "53db87aa-e7b1-4375-a431-3fc1abd3f2cc", "comment": "Malware payload (QuakBot)", "value": "cd712f39b9b6202c40e33032f881c08b7572572c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659083, "uuid": "bc66f70c-0138-42cd-a4a4-187799e60582", "comment": "Malware payload (QuakBot)", "value": "40467524ab5e95adf872cef2e92fc9f7384d151eaa5a4e713f5ae8761c644ea3754c8eb11f4d500fb4e441ed17240188", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659083, "uuid": "727380fc-1838-4e5f-ac70-d843880566a6", "value": "2474BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659083, "uuid": "07f804bd-e3c4-49bb-b087-a6bf71c44cec", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659083, "uuid": "4c9b3f6f-4334-403a-9749-c3a0668484da", "value": "6144:VnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuh:aFrkNK11G9AEtMxQyOi6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659083, "uuid": "22547fdc-9493-4118-9011-2dc96a6976c1", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659083, "uuid": "95158cea-b5d1-4094-aafb-db126310d325", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659083, "uuid": "5dcdca9e-a35a-4c7c-8ce3-9bc816e90d47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14e5886-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659087, "uuid": "07b3e363-7266-4578-a4fa-a7160761896a", "comment": "Malware payload (QuakBot)", "value": "9138ea85afac405fbb5555c361143f06", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659087, "uuid": "d2e73abd-6d8e-45a3-a445-b4a120c22d78", "comment": "Malware payload (QuakBot)", "value": "09fee71e849b227c54c50b22623b8ed3599d2801d602cf6654a8d60744669d65", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659087, "uuid": "de709ea0-6b63-4b05-b285-77408f286c43", "comment": "Malware payload (QuakBot)", "value": "1ce01b21b77e31191fb1d7d59ca154a3bdbd5d4e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659087, "uuid": "ef9ca268-b203-4434-aa4d-99585257d351", "comment": "Malware payload (QuakBot)", "value": "c6b7faf474cedafc1a8e1d91a0f04d722ff6b0967c17b7453e9feb1928dc43e5fff7e14527489c8b794f8ac430410d12", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659087, "uuid": "abdccc46-ecac-4a2b-9c36-6863f3ab68db", "value": "2F549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659087, "uuid": "1420ef4d-7bde-4424-bed7-37589efbccb6", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659087, "uuid": "98d3e9e4-020f-4484-b74f-0cbdfe7d90ff", "value": "3072:D3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZln:jvv9sMoXBaRmr/dukbvuZ/7fP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659087, "uuid": "2f428d48-0a7e-48f1-8c3a-33eb3bf3523b", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659087, "uuid": "cc212bb2-958e-46a5-9ff0-69241f20404b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659087, "uuid": "4f12ce7a-905c-4307-ab19-9435fc54af63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c430d41e-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659092, "uuid": "7e1b5c50-19e2-4ccd-a6a9-f3b1ba7b37b1", "comment": "Malware payload (QuakBot)", "value": "62b8ea031f1f5c4b4295e5fe8fb1caea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659092, "uuid": "f50cbaa8-f267-4723-9414-c4e34dd56a21", "comment": "Malware payload (QuakBot)", "value": "0a1d16d7d930e49f7a0924286e1cea1fc0def083d6c4d3b23b09cb93f249ec60", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659092, "uuid": "0bddbd19-5dbb-4334-8081-180196db09fa", "comment": "Malware payload (QuakBot)", "value": "2ad322f57c707b06f06d72bc5eb1b2f30f956134", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659092, "uuid": "7c63f3ed-a77d-4945-8a3e-f7b638cebfb0", "comment": "Malware payload (QuakBot)", "value": "f7786569fe39e6bb3f1428bc1e9cc7cf76a265ece58f6b6347fc945244446e54874b5cc7c486b177025be2b406e78237", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659092, "uuid": "c61ac9fb-0229-4fe7-9e89-de98c811f751", "value": "06549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659092, "uuid": "fb4b7dd6-01ae-4197-9bcb-c69f5538f122", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659092, "uuid": "35b3b740-2694-4848-b2de-cabe3e1ef729", "value": "3072:l3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZBb8:1vv9sMoXBaRmr/dukbvuZ/7fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659092, "uuid": "b118237a-2ec6-47d7-9d5e-67b279fe928f", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659092, "uuid": "cf1dab65-16ae-4c11-b9ec-cfe700cdb7ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659092, "uuid": "2aa2c4bc-f50b-4daf-bd85-5859cf1491bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8ad25c-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704339, "uuid": "bfbfbf02-2b34-44f0-8ba7-7de6a458ddd9", "comment": "Malware payload", "value": "466b3055bd1336f610b2c51b2e780973", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704339, "uuid": "130d0223-411c-4e50-a22b-e7e69aad4814", "comment": "Malware payload", "value": "0a2d8f2dc5093bfd886eeaadede6f255a2a40d99a866e9cd8d88b10e96a7822b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704339, "uuid": "25819602-5f87-4926-a334-ee170486d887", "comment": "Malware payload", "value": "1631e21fc71aa17bd53a9c1ab85c566ea8b1a36a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704339, "uuid": "56d0433a-62b3-4199-b062-8f0938438181", "comment": "Malware payload", "value": "bde265ee5560c5ab426694e3fd24c82483196f24d50668b2b0a61abc7ed22dd0c15c001774ade4ae93924e68d988d2c8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704339, "uuid": "ff2ef4f9-c5c6-487c-afb3-645d0b61eadf", "value": "2733012A88AEB639172E50F08549D72EE61768DD385DC9812CDCF467EC066B8013FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704339, "uuid": "09566a45-8a06-4de6-84db-c34c4968be50", "value": "1536:vP6z4+ADViS8CWoD94pUnQ64x11RiCxe6:3PZBiS8jopkUQ64xa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704339, "uuid": "ef0f1e6e-18d1-4518-9cab-4d237ba69a20", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704339, "uuid": "8c8396e4-8f1b-4898-ba89-42bdb968fa4d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704339, "uuid": "b6f7c283-2848-4634-813c-900cc3a80f08", "value": "diagram-694131576.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74792bd5-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701908, "uuid": "e6ea7668-46ab-4125-9371-e335ca9a43a6", "comment": "Malware payload", "value": "96f600ef70dd03cf5710eadf58443fab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701908, "uuid": "1629993b-6ad7-46bf-bfd9-c14f28d3d357", "comment": "Malware payload", "value": "0a337b4fee794ed576966b40064536f6d12d453c2fc28f59d1d06ed42d914bb2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701908, "uuid": "c8986a0f-a77c-4c23-bb82-40d5ba078fbd", "comment": "Malware payload", "value": "8a922be9a3d1f4d53288e47a16d7da8a8a8e650c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701908, "uuid": "5b82893d-b786-47d3-b859-312499a79e9c", "comment": "Malware payload", "value": "0734d8b945121cb57742fedee1278b4f9b4891bb9784647ceab764f6006036f2f797958e27ae50a19dc04215af7c826e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701908, "uuid": "ed979e58-191f-4728-a92f-511277703967", "value": "2933F188D688E375A4F13831AC78CB01D578AABB4416C5A381F74AE77907DD11B4ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701908, "uuid": "624826d5-2d01-4189-90b0-1b784e1dd6f6", "value": "768:ewnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2o:TFugXVpoD8ZxhrLAuNS07MrxrKsYLNPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701908, "uuid": "8fe09738-d5b1-4329-b034-c0ca44b83236", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701908, "uuid": "d1d788dc-0c2b-4a33-946d-fb66f39d38f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701908, "uuid": "3c898d76-8ca2-4452-97a0-53c76e1cb8fb", "value": "catalog-749251979.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ca82aa-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700914, "uuid": "749c0973-8488-4e21-b837-1fa845130d37", "comment": "Malware payload", "value": "00bb93c0c818d82401b9bf26096ec15b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700914, "uuid": "ef89c6e7-970d-4a0d-9fa8-b679722af52e", "comment": "Malware payload", "value": "0a3b9ac10a3b7cceaf223c660192ee59ad28c457eafa9b5a6d21a402b521ad89", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700914, "uuid": "729061ee-2658-4777-a3b7-b6dcc3b95355", "comment": "Malware payload", "value": "07b14cb1b28933c8e4b4861f9ab6a6d2364fb1ad", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700914, "uuid": "7d4f21b0-8fe3-485a-85a5-40e70a661711", "comment": "Malware payload", "value": "ba635e9271b89f16643e1d0aafcb04ba928a15f3fe781dc41ed7ed314c0e6f6fc64b744594f209b508709147cfe1bd92", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700914, "uuid": "bab1ac66-20fa-4afa-ae0b-86d286ebba4f", "value": "A033F188C6C9D332E4F57535AC79CB01D97869AF082BC5A280F78A9B7D07E85574ACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700914, "uuid": "4e5c35cb-61fc-453d-8c92-94fb0c976877", "value": "768:0wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2Q:JFugXVpoD8ZxhrLAuNS07MrxrKsYfIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700914, "uuid": "bc208109-a873-434b-98cf-60c791bb484f", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700914, "uuid": "b65c997e-0419-48d4-9e92-c9b0090c84a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700914, "uuid": "9c12ac46-bf3c-4045-a1cc-e81e8c953039", "value": "catalog-1928899830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a545c2-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704329, "uuid": "17d8c4be-5f62-4b05-b4ab-9ce1cefd4723", "comment": "Malware payload", "value": "140e4dabc354d91ce32e2d70e38333ba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704329, "uuid": "186b5c19-7c66-48cc-b0f3-6fe5e395bbdf", "comment": "Malware payload", "value": "0a538f57d0fa9201644216cb234f0985f90946eb99618213e2bb437013236e86", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704329, "uuid": "4b91b201-7f6b-4725-af59-26fb43e5fc70", "comment": "Malware payload", "value": "529257cced1c4a9f3071beb1a0ce9d6b6b1d0934", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704329, "uuid": "0865e0d2-3a33-4317-8e76-de7f07ef2894", "comment": "Malware payload", "value": "22bcdaac96e01ec2111f4632eb99b3de21e181cfa2ce1726bcb805fad012bc203fc7863712bdc5b1b70e028e62b67447", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704329, "uuid": "a5f0a79e-9a67-4208-bfc5-9348d233f82e", "value": "EE33121A486EBA2D133D20F40548DB5EDA0B54DD38ADCAC11CDCB469EC057A9163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704329, "uuid": "31a5ae71-9f91-4c15-ac23-50597e445fad", "value": "1536:WP6z4+ADViS8CWoD94pUnQ64x11RiCf6k:YPZBiS8jopkUQ64xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704329, "uuid": "b912c1e9-6619-4217-8173-4f10d3573b91", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704329, "uuid": "2fe77354-8262-43ef-bc36-d5d5686304cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704329, "uuid": "58cbceac-e4dc-49c4-b2f2-22d173f2d42d", "value": "diagram-688873924.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7197db3-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659097, "uuid": "6435b8f0-0496-460b-8069-4c8f26e561ad", "comment": "Malware payload (Quakbot)", "value": "d44fc1c073818bd1c7391980e79daa24", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659097, "uuid": "834777f8-d70c-4f35-9639-5a17b84ee41b", "comment": "Malware payload (Quakbot)", "value": "0a5499ecf8c2eb9f82419e369df577b6b71ebb0b8f88413e9deae220b3e41b5c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659097, "uuid": "1e17711c-ee4d-49df-9c7d-49290ee192d2", "comment": "Malware payload (Quakbot)", "value": "b890de85c185ca957c13a646064d13f73ee26868", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659097, "uuid": "24acee53-385c-46cb-b49c-d2e24622fbce", "comment": "Malware payload (Quakbot)", "value": "818ecc0b78e7d9a9c6ce459557106275efe3c7f3447a1214889e43b0e6dfc70b20175517ea67c97e3a989a5f6cd88806", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659097, "uuid": "c0dfc643-467b-41a6-a251-259cf72bd7b7", "value": "2674C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659097, "uuid": "6cfad5dc-cccb-4728-8b71-507b6ffdd942", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659097, "uuid": "17ea20f4-b9e5-4bf2-81a2-ed99e6433279", "value": "6144:2Tfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuk:2bi7/xZrkNK11G9AQyOi6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659097, "uuid": "10a44643-da5a-4c57-8a61-aa4b3c591deb", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659097, "uuid": "7f318cde-06bd-4295-a96a-7daef1f3e04b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659097, "uuid": "1837c76e-1259-4e22-8b1d-871dca567bd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9de73f1-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659102, "uuid": "164a82bc-bae8-4b79-8fb8-e71a3f67162c", "comment": "Malware payload (Quakbot)", "value": "77078294e7f5b6c681abc33dc47c3e74", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659102, "uuid": "004fdff1-6f88-4741-99a2-a9bb3798ce34", "comment": "Malware payload (Quakbot)", "value": "0a5ef6659eea43210e4a20d7f0845fd0751f1a04cc36350e129cb6def00b3dd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659102, "uuid": "70e006a0-844f-4e7b-9aab-5a17a4c1d42d", "comment": "Malware payload (Quakbot)", "value": "27ebf14b3e9df905b7071a7906b5acdc0650e065", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659102, "uuid": "f9e1dca9-63ea-49ba-a03f-b6d7f8b8a896", "comment": "Malware payload (Quakbot)", "value": "75a9bfb0882845f00c215fccf4d2995932e65163a8e7f2ff31ac5e64d706c429d735b4dc7d663dfe8795373c1acfe005", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659102, "uuid": "9c4fd0fb-28a0-4e7d-a2f5-870da6e7342a", "value": "6B549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659102, "uuid": "11742ed5-a6e9-469f-bb77-22624217e8fa", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659102, "uuid": "d3cb97b4-9624-472d-8179-cba82157e154", "value": "3072:k3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZM/:Ivv9sMoXBaRmr/dukbvuZ/7fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659102, "uuid": "b1128c12-fb04-4687-bb00-348a539f833b", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659102, "uuid": "1964e3d8-13d0-480f-aca8-e61143b2f64e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659102, "uuid": "aa127734-6c27-448e-bef3-658703f76052", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cba232-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706044, "uuid": "f5c57346-6a2b-478a-86f1-0ea1551aace6", "comment": "Malware payload", "value": "3b59ddb4be4e29cbaba8b712548d1b6c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706044, "uuid": "2e3a888d-4ec9-4f33-bc58-b335a744c99b", "comment": "Malware payload", "value": "0a6235910b5bd5f022e72b21c509112286ec4f5d95761ad15a9d37bbabfdb899", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706044, "uuid": "4722a80c-45b1-4373-b219-861d9707a594", "comment": "Malware payload", "value": "befafc517711cb44a22f4875f8083ffa567606da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706044, "uuid": "0f871095-9fe5-42d2-8d61-305f42c7e58f", "comment": "Malware payload", "value": "242d13664bbec60138f4964d48816f4608710b4a11a013f509eac6492c738dc17c0da8d7ef870e06497fcf16fe1ca91c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706044, "uuid": "9d7c73c9-a3ac-4d86-bde1-22a18b528f35", "value": "18330229985E3A2A473E30E085858B5EE55768DD3C6DC6825C8CF0F5EC092EA123F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706044, "uuid": "8d2ef45b-8db4-4fc6-a01c-1a1c407a5078", "value": "1536:7P6z4+ADViS8CWoD94pUnQ64x11RiC2+Ene7aM:rPZBiS8jopkUQ64xpEnkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706044, "uuid": "6220b31d-4707-4904-baa8-a9555ecb65d1", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706044, "uuid": "8dfa9b18-3266-46a9-ba54-492e621a3a78", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706044, "uuid": "8b26abc9-3e44-44ea-b187-db4009936eba", "value": "statistic-198624884.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54bf458-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706365, "uuid": "5f752c35-b933-41c3-8b22-6392294aabba", "comment": "Malware payload", "value": "4a2b60ed80d08710f94d171e3f1df506", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706365, "uuid": "a8c28536-025a-4dad-adcc-a14ea2defcdd", "comment": "Malware payload", "value": "0a6ac276b25fe97eb71a94510840e56cc90189736e2c2c3ed268d746dc1ca8d3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706365, "uuid": "ba0b6c5a-c6db-44d2-bf0d-7b1e3e94708c", "comment": "Malware payload", "value": "d9550bd5bf7aaa492dc025b939642fcd81684bc1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706365, "uuid": "29d50080-40b9-4f95-89f5-cdcf04ac2141", "comment": "Malware payload", "value": "f1a34fd508b353f5ba4467b7fefa081a54b59058e242722b6eb9101cac7032d25635b716d0973cf92d158be46540e63f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706365, "uuid": "add53e13-4578-419a-8bdf-e175c019fa2c", "value": "733301298C6DBB2A573D10B44588DB5EE6532CDC386DC6421C8CF4B9EC066A8263F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706365, "uuid": "63956bf2-5f21-4235-aada-4fd1ebbc30dc", "value": "768:r9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiC6k:eP6z4+ADViS8CWoD94pUnQ64x11RiC6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706365, "uuid": "09582dfc-d7b9-4f1a-bc98-38595857da45", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706365, "uuid": "32783e21-b223-4654-9220-570822952135", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706365, "uuid": "00dfc40a-06f2-4fd1-ab1a-3098213b90a5", "value": "statistic-312270176.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdcd5de-a8d4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619691480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619691480, "uuid": "6c39b169-8a69-49d6-b7b3-1fe25d1e1fca", "comment": "Malware payload (Dridex)", "value": "5a2fa988f7cd0129dfe24321a1eaa045", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619691480, "uuid": "a1e9d570-764a-4c2a-b4f4-4944fe7b36b1", "comment": "Malware payload (Dridex)", "value": "0a90f5b13fa69c41d0ca85b233480764c8e1ea1a6d7eb481bd6d1f1d5d98968a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619691480, "uuid": "4e79378b-fe49-4be0-87ea-52b40c3b8161", "comment": "Malware payload (Dridex)", "value": "1f63a16222b2f7084f2562d8c3be8699a2f77078", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619691480, "uuid": "7aba663e-5f25-47b1-943b-de1b1caf30ea", "comment": "Malware payload (Dridex)", "value": "fdfb46080af33c558e4f7cc106e3c2a89693b66dc161c30bdb6bd51560e06556a6e7d3adc0acf454f22f5923b9564aba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619691480, "uuid": "34f12c41-edb6-4be9-9c86-953988b11d30", "value": "1BF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619691480, "uuid": "8aeb931b-4a87-4894-b358-b4bf258e4673", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619691480, "uuid": "62c88e92-6c80-4c1a-9391-74cbd26fd7f5", "value": "3072:h98CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYkZwd:QnClX8WZ7/HrRCADTR0Vl2Zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619691480, "uuid": "f64594ab-62ff-4971-9ab2-895063664f8f", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619691480, "uuid": "9c7ab9d0-59aa-40d2-a0a9-cd1f10495ceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619691480, "uuid": "9d4991cb-0c53-4ba6-9633-d8f484e8f49e", "value": "5a2fa988_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c067cc-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706470, "uuid": "9767ee93-9c9d-4d33-8f05-d5dc10237230", "comment": "Malware payload", "value": "64b93cfa34c5d04775fb58ce22f1c6f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706470, "uuid": "9aa32a18-1ae1-475f-9f49-152a753ee569", "comment": "Malware payload", "value": "0a9138288e5f1164008c32c9f7ea764710f1f2e1daff68f887051d7a05d26cfc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706470, "uuid": "f7c8e2d9-b528-4760-bf44-fd79f12923c4", "comment": "Malware payload", "value": "62a05f85d9102f90c1d4a7bb5cbfb23cb530920f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706470, "uuid": "35e351b8-98cd-42b0-a7be-ddfe4e1c36e9", "comment": "Malware payload", "value": "61bf73683f3fe417d42213d885ff1ee992a19668fde164426e57263f213ad5705c3d8564609de5b8159b8a437e9da1be", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706470, "uuid": "aabe2662-2e78-4d67-9b47-ec952daeefd5", "value": "C733022A586E7629573D10B08449DB0EE667189D386EC2821CDCF1B6EC017EC123F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706470, "uuid": "728744d9-9b28-4c44-8c8f-df34cf6144c6", "value": "1536:6P6z4+ADViS8CWoD94pUnQ64x11RiCFPPvk:UPZBiS8jopkUQ64xHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706470, "uuid": "48ff7dd6-d642-44f5-a5cf-e34045c3bb4c", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706470, "uuid": "1044d1cf-d405-41d5-8bed-44204d92cdbf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706470, "uuid": "27135088-83d8-41f3-9ce0-f8144a02043e", "value": "statistic-376754173.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a8e6a3-a8d2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619690718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619690718, "uuid": "54296704-ec3a-4018-876f-a2f79260bd91", "comment": "Malware payload", "value": "ea5b0a11238124c6fc78dd72a7bb2401", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Servizio fiscale", "colour": "#E53242", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619690718, "uuid": "caf51619-4e93-43bc-8cf1-f2fc06aae6ca", "comment": "Malware payload", "value": "0aa0c65b1c37512536706d22a19af44e4ba91f8406bee0b1cdf691a050e8e7f0", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Servizio fiscale", "colour": "#E53242", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619690718, "uuid": "94feb1d5-ce3d-42bf-96ed-3f7d5416e4c3", "comment": "Malware payload", "value": "a2c2fc03ba42b8eed7800423294ec46910bc9dca", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Servizio fiscale", "colour": "#E53242", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619690718, "uuid": "65992b00-9aaa-40a9-93f1-7cd7af772ba9", "comment": "Malware payload", "value": "f37c62090a49a82dd763946dd7f4e577e581de70eac7adea16626de97e9caf1dce22797de3b4849031ffd33db612260d", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Servizio fiscale", "colour": "#E53242", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619690718, "uuid": "8e53c562-c241-432c-9261-70aa5da4f103", "value": "69C49E21B2D6C532D86E0274352AD79A9565BDE49FF280FB13C92E0F0E739C05635FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619690718, "uuid": "3aad7d55-dffc-468e-8ea5-888730500ce5", "value": "12288:pSxfYeOMTeyaOfuYugPElcG2WV6ENLFO6PACX:pSJYeOMKDcPWVLzO6PAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619690718, "uuid": "1645c4bd-6924-4854-a533-71ce708089e1", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619690718, "uuid": "05304bee-04c6-4c78-90ed-8b1b23e1e46c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619690718, "uuid": "943c8256-f645-4b49-a1f2-e61fc80a9982", "value": "ea5b0a11_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f07755-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701533, "uuid": "fc5a8709-95df-4a5f-bf3d-cdc9f598918d", "comment": "Malware payload", "value": "5e69dc2e59f8288387423795ed7e1f8f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701533, "uuid": "5dce2c4a-b867-424c-bc00-d05595c5f386", "comment": "Malware payload", "value": "0ab16eedb0a4329db1f7690a634b253d1737e63348595c17b94e334027ab27bd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701533, "uuid": "d59831e9-ac97-4b64-8d4a-b15894c816ef", "comment": "Malware payload", "value": "49788bf432fadac0bcd7e84839e5a0f07819f127", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701533, "uuid": "66a6b25e-b13e-458d-a2ab-ed99b4ec30ba", "comment": "Malware payload", "value": "5d465b3845789032a2c1ebe854cab2ae8443765dba9d38ccbb9559b25f435ee1695b80220da6cd0adde0e19cd260dacf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701533, "uuid": "4c7f3f34-fe55-4b39-b379-c5eb483225e5", "value": "D6330188C689E335D8F47431AC798F02D478AAAB441BCA6681F786A37A06DD0574BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701533, "uuid": "afdeb6c4-db64-49dc-9409-bd0e41437d88", "value": "768:fwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2F:WFugXVpoD8ZxhrLAuNS07MrxrKsYUJq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701533, "uuid": "913765db-d271-4bdd-b096-ceb4d0f6d7a4", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701533, "uuid": "0c833130-2664-4c46-b327-b19f9e295641", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701533, "uuid": "9839b9af-3948-439e-8115-4a3240cef110", "value": "catalog-45180001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc4e62a-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659106, "uuid": "19a5fa13-fbc9-4b2a-8fe0-a81accfaa627", "comment": "Malware payload (QuakBot)", "value": "7886dfb8ff62a2ff43bb3643ec93ab47", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659106, "uuid": "5a098f0e-ff50-4fed-be6a-4d7dcde3b5fc", "comment": "Malware payload (QuakBot)", "value": "0acf964212852ac52240d779583bcbbcdc6e100b9d1de1435f76097592d7c52c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659106, "uuid": "d83cd874-bd1b-4aaa-85fb-5ef7c81e587d", "comment": "Malware payload (QuakBot)", "value": "c3ad8733545fdc258e829f60f7f334c1fe6a5d7e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659106, "uuid": "e00c3ad9-373b-4349-a0a5-3a63793a210d", "comment": "Malware payload (QuakBot)", "value": "cbb452dcccb4bf6776d79b5ba776ac5979bbd1bb01f96666feba75c45f12d161baf6b8db22ada663e37db1243c5ce436", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659106, "uuid": "cbb413ff-6e45-489b-9fbb-83cd1b1998cb", "value": "8774BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659106, "uuid": "5d1becc3-fd2c-4a38-b168-7f9a96d7c4bb", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659106, "uuid": "7e01ca10-95e2-4c87-b604-a487ec2ff8ce", "value": "6144:NnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuB:yFrkNK11G9AEtMxQyOi6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659106, "uuid": "ab187711-202d-4406-a9f2-3f041a9a11ad", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659106, "uuid": "f9be9464-b23c-4529-9bf9-f49aee233fd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659106, "uuid": "dc452bcc-b4cb-48f2-9cd4-b195b879d5d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c81ac1f-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700042, "uuid": "33aaab71-d3ac-4e3c-87d3-6aecdb605588", "comment": "Malware payload", "value": "57ec5643cd121c0351890a200ab135ad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700042, "uuid": "90611191-1f33-4460-a53b-b9ffabb9c46f", "comment": "Malware payload", "value": "0afc600c8033a80e898db9a640de1e7572b39947f28219f8f0db4a740c25f3ea", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700042, "uuid": "c9cc1e9e-ad74-475f-ba82-5e85a4a4c472", "comment": "Malware payload", "value": "677e723c2db60e84920e4aa1e9d1a9e3af947c94", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700042, "uuid": "2db9cb34-a1df-4b1c-b830-1942ad9d7998", "comment": "Malware payload", "value": "08bd6bec8bf9f83cbb490a12c0b7270b4bc7e4a1ade26118f444360c911278cdc494bbd50d9a37bc0c6ee2acbb2ae19a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700042, "uuid": "d6fa86b8-0ce1-4cb8-a8a2-74012c416214", "value": "1733F2CCC6CDD33294F578315C79C702E578AAAF4816856181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700042, "uuid": "30295633-b678-441a-8927-3afde67f1865", "value": "768:HwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2V:eFugXVpoD8ZxhrLAuNS07MrxrKsY4Or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700042, "uuid": "042448de-f386-4048-9d10-05644c779dae", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700042, "uuid": "1b3fc9d7-67b1-49f5-8018-b94d878dfc62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700042, "uuid": "d0a6aaf8-d79d-443f-a17b-2f2578cf482a", "value": "catalog-1256543642.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a833a3-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705161, "uuid": "5e2b3343-a0f8-4022-b349-fd11f5c923f0", "comment": "Malware payload", "value": "b2ada03b8f3ca19d3c4ee3659b00bb5e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705161, "uuid": "7979608a-e6c6-4aed-aed4-d3621b08bb38", "comment": "Malware payload", "value": "0b0120e3c330dbb22707930f9956160e27907a55916c42876f346dd33d8841da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705161, "uuid": "2f220188-d476-4980-b721-fce980b8268f", "comment": "Malware payload", "value": "902c40e54d35a55809dbc201ac51d15b8c3bfecf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705161, "uuid": "498b7e59-df84-4f37-b93a-e566fcecd018", "comment": "Malware payload", "value": "d6cbd967a6a91fecd55adc87279da6b208eab202a5d456df957597c822dc3826fe6b526587a2e36118f83c8b775debfa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705161, "uuid": "70fc62e3-40c1-415f-8a11-bc8f68452ce5", "value": "4833022948AE3629173E10F4C585EB4EE9572C9D387CC6829CDCF479EC056A5123EBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705161, "uuid": "3a95e33f-e15d-401f-9218-6f8e34abfc9c", "value": "1536:dP6z4+ADViS8CWoD94pUnQ64x11RiCJOx:pPZBiS8jopkUQ64xfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705161, "uuid": "8b088ed6-e8da-4b13-8b47-31dda07594f3", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705161, "uuid": "fa370fcd-36a3-4125-8cb0-3af98323186d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705161, "uuid": "3efe91a9-2b3a-4621-9c56-d5748429b418", "value": "statistic-1244905330.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa4182d-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700209, "uuid": "1313615d-27cd-412b-abd1-7a39b13856bc", "comment": "Malware payload", "value": "5d85e8bdee783e3176d7e6e68f90b35f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700209, "uuid": "641a0933-f1c0-404d-9fca-b6466e40b05c", "comment": "Malware payload", "value": "0b0a0a998e359292c5fb631e83dc8ea072040ece3fa15fbbddc06cadd7278889", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700209, "uuid": "2b4db588-a1fb-42e6-8976-c7214f98be9b", "comment": "Malware payload", "value": "4231293d75c7d467ca470f2290463693abeb0554", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700209, "uuid": "303a2fec-5efb-49cc-b843-9ccae6cb7d7a", "comment": "Malware payload", "value": "0fac643fda95467ff671e42ede09ac91c3808a90fb13fd882e989c9b80a8488b706cbf76cbd8f9d7fe2bde1fd17f3a97", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700209, "uuid": "f0f929cc-01a7-475a-a9d1-bfbc8f1e3e18", "value": "EC33F188C58DE33294FA35355C3ECA01E5BCAA9B0416C56281F78ADB7D07D941B4BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700209, "uuid": "8d96a683-440e-40bf-b1df-567190e827b9", "value": "768:zwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2q:SFugXVpoD8ZxhrLAuNS07MrxrKsYMcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700209, "uuid": "5a089414-34c5-44f4-8960-85c88b37b137", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700209, "uuid": "620dc2c8-92d7-4e28-951a-4ef5db4e32d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700209, "uuid": "48f1cb32-86b1-468d-9b5c-35ad51eb81ac", "value": "catalog-1363047123.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa88a3f-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659111, "uuid": "9321a18f-c449-4670-8292-747945257a81", "comment": "Malware payload (QuakBot)", "value": "2acbd34652d8a95872a371237cb7018c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659111, "uuid": "a4020755-36e1-4add-a317-3967dead5285", "comment": "Malware payload (QuakBot)", "value": "0b1bfae44585c383260920e08f846ab7026ae8c8cf8d9cbb77a8f49345dd69e7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659111, "uuid": "1bd65528-8ff1-4849-b347-f2336dca58e9", "comment": "Malware payload (QuakBot)", "value": "b6f54957b88c95ab0c7707685eb7c637775f34bb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659111, "uuid": "ffd7bf15-27ab-4ee9-8e88-dc6c29044930", "comment": "Malware payload (QuakBot)", "value": "6d48f7cbcf7760fb1388ccc4f16f6fb9ea04d8e0f33b37ce32452a245c3047935a30137cc2e6940f5d54792440d74f4d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659111, "uuid": "3365c12e-9868-40e6-b925-c2935f7942e8", "value": "60549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251A55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659111, "uuid": "22b6411e-e6f8-4448-920b-5e0c7f0851a2", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659111, "uuid": "84a178f8-39b5-4cab-94c0-d23ccef16fd2", "value": "3072:p3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZyq:Zvv9sMoXBaRmr/dukbvuZ/7f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659111, "uuid": "0b25532d-6102-48f5-b6cc-e422eb36154a", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659111, "uuid": "f3fbb6b3-f79d-4b05-b490-c258622d5b79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659111, "uuid": "8b021111-6079-46aa-b6ac-5174cd1fddf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf73fa98-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704208, "uuid": "0517de63-d8c8-4c48-8953-02f15b15bae7", "comment": "Malware payload", "value": "e6bb2001875f9831bc0cc183e32d009e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704208, "uuid": "39189439-2ea1-4a76-b9ed-cfc809097356", "comment": "Malware payload", "value": "0b1c3d2ec26732321ec16e33732fd29c9d03bc1e20d0b477a39065348b04a6b7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704208, "uuid": "aa768747-27f6-437d-9f02-89ad55032c4b", "comment": "Malware payload", "value": "56c96db3a2976ce45d8357b91cedd14660a1675e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704208, "uuid": "ecef27ef-2e36-4f26-9d3e-83a44059a697", "comment": "Malware payload", "value": "83be97866118c1b91c6edaad86be63a6d651aa0fdcdafbdd2c7d0cb6ee7386c4b4ef72b076cf17c92f19af25210459ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704208, "uuid": "3a49526c-4afa-47d7-b4f4-dbdd9f1b73bd", "value": "E73301198CAF3715637E10F149489B4ED617289E346EC6816D9CB4A6EC047B9063F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704208, "uuid": "31f5cf51-6be5-42be-aadc-cafd658f53fc", "value": "1536:iP6z4+ADViS8CWoD94pUnQ64x11RiCDM04:cPZBiS8jopkUQ64xNM04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704208, "uuid": "48f50326-39ab-4f42-af16-eddfe653ff26", "value": 51476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704208, "uuid": "6830c0cc-9d97-4122-9aeb-d0935a3680c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704208, "uuid": "9cb524ef-bb15-4182-b188-f4a87d35a581", "value": "diagram-587449763.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26b93b8-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659116, "uuid": "53010409-abed-4d1e-9ce1-5870bf738f11", "comment": "Malware payload (QuakBot)", "value": "8204c05344bf64805062b6b45374d962", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659116, "uuid": "a41d0530-f6e0-4d71-bd29-3a3c0d149d93", "comment": "Malware payload (QuakBot)", "value": "0b31f2243b06462b3434e08e2943fb238058eb491cf2046295444d886d951159", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659116, "uuid": "0cc7098e-3980-4f37-9425-3a2c01bc2064", "comment": "Malware payload (QuakBot)", "value": "5cc9e403463017041964cde53b08e62011400a97", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659116, "uuid": "4f0aeb07-fbf4-448f-b25c-86c985c88d80", "comment": "Malware payload (QuakBot)", "value": "107842a7efe8a68b3a36abcdb5e183af15ba966cced3d8d99d76c2a0b2c7003aa99c37d1ef42084c6552c213d3dded3d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659116, "uuid": "3a4799a0-c9de-44b9-9110-c3d7a6dcf99c", "value": "2274BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659116, "uuid": "9fec871a-1095-4574-b47b-cce3cd83f16d", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659116, "uuid": "b1a7306d-48b4-4ca5-a9aa-4a68893db97f", "value": "6144:rnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuB:cFrkNK11G9AEtMxQyOi6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659116, "uuid": "33ee5f5c-36ad-4557-af0e-907fefc429ee", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659116, "uuid": "eb6bb0ac-6286-4b7b-adba-74cdf1239847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659116, "uuid": "862c76cb-7d41-4f9e-bb55-a68ab481148a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b956047e-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702453, "uuid": "4136778f-536b-49a0-95b7-ddadf5487009", "comment": "Malware payload", "value": "bf4cd4075b033a880663dead9f40f090", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702453, "uuid": "bbf0156b-51c8-4976-8690-9148914df26c", "comment": "Malware payload", "value": "0b33abc3eb5bce7df3bfdcbb20832403b4cece8a0fab1c8e19ad20b19eb57fe7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702453, "uuid": "00801cef-fb11-4414-b5f3-4580def8e589", "comment": "Malware payload", "value": "5838bca92844bf2378c414c2bdc1a611e9f8189c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702453, "uuid": "82ebdfc1-031e-4a53-b251-5d7433b53696", "comment": "Malware payload", "value": "1e266cb963c42f03a804bf5f065f3814fcd7023a904e884ac1ce61acac35a0dd309b3a0ead2c9c88171b1eccc4caa8cb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702453, "uuid": "8f6bc74d-ca74-4336-a1c8-39f9e08ce42e", "value": "B633022A4C5E7B29537D10E04985CB1ED50769EE3C6DC5812C9CF4B6DC05BA9123E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702453, "uuid": "b4b1958e-837e-4869-bac0-73568cf5fe79", "value": "1536:uwP6z4+ADViS8CWoD94pUnQ64x11RiCBKFmK6:hPZBiS8jopkUQ64xuFmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702453, "uuid": "f2f70fe9-170d-4c9a-a5f5-f48480e9d935", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702453, "uuid": "9355dc7f-6b4e-4d75-92c9-152365998d3f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702453, "uuid": "765eb51e-8558-4f9b-a1df-2b5ca4e0cc83", "value": "diagram-1175908722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93897ca-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705540, "uuid": "890f9284-4af5-4091-b95f-4e613dec6d0f", "comment": "Malware payload", "value": "81b8eb9832aa576cab8dd825a842632a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705540, "uuid": "f682550c-b13e-483d-ac5b-4cfd5ea8de14", "comment": "Malware payload", "value": "0b3d400e359f07c29b35725e63be968e7ff0897fb14f96dcb388d6eecfd455eb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705540, "uuid": "2e31073e-1821-4057-8987-2a9aaa951b7e", "comment": "Malware payload", "value": "420118aba836b4eefe689c70371e7a9bb281d28d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705540, "uuid": "d0fea981-5f87-42b1-b724-9a53aacbbb75", "comment": "Malware payload", "value": "76f1bc54ecc6c02715bad7f5c7feeb2305e2cde21b75f189d33a8ac377868b23723ccc61d11287e069a413140d0a5876", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705540, "uuid": "3b947320-cb44-4526-a983-e26684882ab3", "value": "7F330229985E7A2A473E30E085858F5EE557689D3C6DC6815C88F4B5EC092EA023F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705540, "uuid": "bf88b84f-b8ab-4eb9-9c9d-e0d654630c60", "value": "1536:FP6z4+ADViS8CWoD94pUnQ64x11RiCx+Ene7ab:xPZBiS8jopkUQ64xGEnk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705540, "uuid": "ceab2af0-b006-44d7-8d31-6f19e50736c2", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705540, "uuid": "b483f175-deed-44a0-ac27-d7f19e016ba0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705540, "uuid": "391ccf31-fb18-4133-a9b1-c8b3b6620404", "value": "statistic-1575542679.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1907cb0-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700400, "uuid": "e2ae454c-79a2-42f3-b4f7-eb73a3b5e96a", "comment": "Malware payload", "value": "63b750d50ba957adf458aae81506f3f9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700400, "uuid": "9ba3d152-543a-44fa-ac8d-ee8f5ebf2a3c", "comment": "Malware payload", "value": "0b416b4a0e957a1cc1bdc96e14fbe505c07a74533efa6ea3cade4bb84c96ac27", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700400, "uuid": "4c106635-a2f9-4f63-8740-d8d7929b7f5f", "comment": "Malware payload", "value": "9c79a08c6702f383945560e8ec6873e737540117", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700400, "uuid": "fde6bab4-8e45-44da-850b-deb8f3f5974f", "comment": "Malware payload", "value": "e73fb24c1a67cc98406d0940e2ffd618d803a1508dc0cffdab8923665c3bd5f8110b0b2b6bc583ab27b19739f38e2df9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700400, "uuid": "1a4d8c34-99e3-4980-9386-a6008f254576", "value": "AE33F1CCC6CDD33298F578715C79C702E578AAAB0816856181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700400, "uuid": "f4215274-074f-4b40-abb1-712beacaeb85", "value": "768:cwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2W:xFugXVpoD8ZxhrLAuNS07MrxrKsYIO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700400, "uuid": "fdffadb0-cd3c-4d3a-8724-221a3496bc15", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700400, "uuid": "56b724ce-67fc-43f6-b6ae-a4bc8ae0af95", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700400, "uuid": "ad18f914-2d36-4cbf-8562-2cae4aeefe53", "value": "catalog-1511189965.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdba00c-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702216, "uuid": "00bfcc8a-e02a-419d-a4d2-da1d8223b46b", "comment": "Malware payload", "value": "d5fe1a4d352ba73048184f441787febc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702216, "uuid": "5c342383-7dc1-4d2a-9bcd-40b3f88115ea", "comment": "Malware payload", "value": "0b43f93774162dee0634f5f191f61db270faf26e7b4f68a811bff29e3da8cccf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702216, "uuid": "5a78e78c-7486-4564-9ae8-afe946cd6407", "comment": "Malware payload", "value": "53e90bcce4bdc00b2f1aa7afa690cd92937cfb7e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702216, "uuid": "e2e960b6-3447-4e0f-84ab-a00e76ce5c63", "comment": "Malware payload", "value": "3e9708773157fc17488a9e2dd1287c330ae930760600e7f08f4afab3862652e05f83db4e20f2fa285c9159ec9694f151", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702216, "uuid": "41f3d779-ea76-4acd-a575-41d282be330d", "value": "9C33F188C588D332A4F63531AC79CB01D978A96B4816D5A1C2F78EDBBD07ED5170ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702216, "uuid": "8f15570b-72ed-4504-9e33-15387c1789f6", "value": "1536:BFugXVpoD8ZxhrLAuNS07MrxrKsYlT7mK:hq41rLZNkZLYlXmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702216, "uuid": "b6446bbd-4f20-4789-945b-02257337cda3", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702216, "uuid": "917dff12-d613-469f-86e7-bdee6d7b695f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702216, "uuid": "22c5a7ba-ebfe-4d98-b4ff-5cc24793cbc7", "value": "catalog-981771605.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52cc018-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659121, "uuid": "cb358a77-5296-4945-a6ea-42d9dbcbaeb8", "comment": "Malware payload (QuakBot)", "value": "d5048f5daeb2abdfe23d14c406c83a50", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659121, "uuid": "2a172bb3-1744-4015-8aee-2194224bfa78", "comment": "Malware payload (QuakBot)", "value": "0b4438b95d65158a0e1b2da3152bb24161cdfaa4c4bc9145071464fda40d2cc5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659121, "uuid": "91903ba0-cf96-4bf0-88e6-b73d655d49d9", "comment": "Malware payload (QuakBot)", "value": "f4137c9e3ad44d84222b47839cde58c4fe8d3e15", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659121, "uuid": "fde6a12b-3eed-477d-bac6-e6087c80d003", "comment": "Malware payload (QuakBot)", "value": "8b253a8d2b16e28d943183066b2570cda14f614440aa645cd977c0675c9a013883fc1e092d6120a2e129ed52636356d9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659121, "uuid": "6bff136d-187c-461f-a39c-243ce61deae1", "value": "2F549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659121, "uuid": "28797352-650e-4771-b7df-8bf3841fe348", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659121, "uuid": "ad3cee71-ce96-4fb7-b573-f54c9aeb1ea0", "value": "3072:l3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ6D:1vv9sMoXBaRmr/dukbvuZ/7fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659121, "uuid": "203d4087-41c5-4277-9776-93a3e1cdbb2b", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659121, "uuid": "eec2cc02-a7b9-406a-a8fa-8fdc27d69d1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659121, "uuid": "5657144e-4556-41f1-8d9f-f6e7a9ed0c16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd9fde6-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701868, "uuid": "75abbfc0-536e-42b5-ac0b-a4619ec454e5", "comment": "Malware payload", "value": "17767f6a2122b4ba0ad99dc960b8b24f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701868, "uuid": "3949f12b-be18-4164-8228-23176692808a", "comment": "Malware payload", "value": "0b56e511cd49d6b5f80909fb918c3c73b549c1ec59c2f1d9c8fc4fd40098d5c6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701868, "uuid": "d2f87698-7438-4242-9ac2-78bff7489851", "comment": "Malware payload", "value": "fd0dd3eeb18850ce2fbac65fb6898f0e9f949cb0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701868, "uuid": "4200383b-86e1-44b7-b61c-a9bdaa0cabf3", "comment": "Malware payload", "value": "0a109f677d964cd822d92b19297d9637b4e51dd10c1216ced5b15595281e6f8cbf825106c711a074b4be992af59bcd60", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701868, "uuid": "31756322-d2c5-42f7-a44f-903027063dfb", "value": "7E33028CD6C8E332D8F6B9319C798B01C5B8AA6B0417C55281F386E77D07ED02B4A9DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701868, "uuid": "f230023a-4a71-4d37-bc93-72cf79e7a1c6", "value": "1536:aFugXVpoD8ZxhrLAuNS07MrxrKsYkDd670uN:kq41rLZNkZLYkDd670uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701868, "uuid": "a6899f19-d192-42da-8f7d-2e5c104c12c7", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701868, "uuid": "0cd0514c-558d-43ba-aa74-9569497f0e11", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701868, "uuid": "6dd0e38c-9a04-48a9-aba1-97ed98487d7b", "value": "catalog-730326455.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8903d728-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701513, "uuid": "4ad1745a-b964-4658-a043-fb841425cc87", "comment": "Malware payload", "value": "88e4e6d2e8720cccf4627958529cfc41", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701513, "uuid": "28f5e29d-62c4-4f0b-95c4-1b3a8792dc3e", "comment": "Malware payload", "value": "0b5acf778e846bf29a9b676a04eb313ec49b1aa2271270d460bced877e939a9b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701513, "uuid": "e78cb8a0-7fad-4aa4-9c23-449a4a8fcc30", "comment": "Malware payload", "value": "b45e44367cc8141534980452f9111947c5e67ab7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701513, "uuid": "f171f302-1ae2-426f-98b1-cf9fdeadc965", "comment": "Malware payload", "value": "e0aaefb5b19b42917180ecd1a3d37a540cbce03ecb31d7524768046cd2f3ec3d158cd9c3cd22055d8a3acb15ad2655bc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701513, "uuid": "d192a740-3812-490b-a165-5bad700025cf", "value": "0733F2CCC6CDD33298F578315C79CB02E578AAAF0816855181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701513, "uuid": "3925c678-9527-4197-a9b6-73ff1535ae86", "value": "768:WwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2j:rFugXVpoD8ZxhrLAuNS07MrxrKsYhO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701513, "uuid": "49375cb8-355c-4bdf-95de-07b536434d2b", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701513, "uuid": "2f6a9555-1bbd-44f2-8ac0-f0acf91bab69", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701513, "uuid": "0686ccf3-6925-4bff-b42a-ccb8449e011a", "value": "catalog-43594835.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be48ce79-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704609, "uuid": "1146e0f3-2ea2-480c-9cef-290cf45f727a", "comment": "Malware payload", "value": "51d38533e3c390565297b3fbda449ca7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704609, "uuid": "58d1d8b9-8d2d-4321-b421-7756362fddcb", "comment": "Malware payload", "value": "0b617e6b05070eb75356d02b8613ee8cb3146e5184b71d2a34fa21ace95a5aa1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704609, "uuid": "9821db06-16f0-4b4c-bb20-ad878a0c1a8c", "comment": "Malware payload", "value": "2d2512f579ceb3e34ee43411962b527222b42542", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704609, "uuid": "a2bbc7ab-88f6-44fb-82d1-94cdcd4ba014", "comment": "Malware payload", "value": "db0c8fc5af0034624b46c5f22e1936a40140fad8ce343e8e106e2a38f83f90ee08d1f067a749d12cbdee098f10bf8538", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704609, "uuid": "0619a640-475e-456b-b701-2f3252256bd9", "value": "E733022A8DAE7A2E576D10E04945CB4FE617188E3C6DC6864CCCB4B6FC066D5063EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704609, "uuid": "94adabc5-de88-4bd6-93e6-8d52af3bdbbc", "value": "1536:YP6z4+ADViS8CWoD94pUnQ64x11RiCFbRC:uPZBiS8jopkUQ64xj9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704609, "uuid": "7908ef4a-fa28-4f7d-8203-833fc7ae712e", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704609, "uuid": "9aee6777-bc83-469c-a09a-95dd3d57e926", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704609, "uuid": "d5d497a7-633c-4eb8-85cc-50ef1b202161", "value": "diagram-863542447.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f18142-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701397, "uuid": "afe64219-0354-401d-b579-05c7ee23a12e", "comment": "Malware payload", "value": "333cb866e0d45c8e2f3c4959a01a5636", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701397, "uuid": "90582248-4309-49f7-b930-e6c716fd492e", "comment": "Malware payload", "value": "0b71757ddd5397a4770b0d149eff12cfc35ded9254e2534b83fd4beab5a5c7c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701397, "uuid": "2369176a-b0aa-4779-8676-238ada1be524", "comment": "Malware payload", "value": "017afaa47dd9e2dee216bd1b526eb71e2ddcac08", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701397, "uuid": "674d7ba0-5838-4a0d-a3ef-7fbd1b5fa87d", "comment": "Malware payload", "value": "a13d958554e316770f0d23d71bf25f1d2133abe2314b65c23d2f660a0702958d1bd88ac76db8265777546b1c0d5efcec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701397, "uuid": "cffbff6e-51c6-40eb-89b7-5d996685ebc7", "value": "BD330288C9CDD276A4F27430AC3ECB01C478696F481BC56182F34A9BBD07E956B4ACDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701397, "uuid": "dd04fa47-90c7-4457-bf15-08b634b9f5f7", "value": "768:KwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2l:3FugXVpoD8ZxhrLAuNS07MrxrKsY72G5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701397, "uuid": "8f88d7bf-8554-4019-a153-65a2bda9f617", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701397, "uuid": "6510fe17-11de-4edd-abbf-61073cabc741", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701397, "uuid": "607ebf8d-4b87-44a7-bc9b-292b8c23508d", "value": "catalog-348854772.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5134f899-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707432, "uuid": "586831d6-840d-47ca-a61a-85bdc83d43d3", "comment": "Malware payload", "value": "2d204dca0f0ac3e30c5d2c104030f593", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707432, "uuid": "3bda2787-385e-42bb-a504-9df89da3a4e0", "comment": "Malware payload", "value": "0b86a716e549eaf5c650d864cc65a8ac5ac459d5d67a2a30af7d4a2374845962", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707432, "uuid": "97487418-b81e-4670-9df8-047df22426b3", "comment": "Malware payload", "value": "fd611fe0b13d535e23c00db909b754e3e4e84fe8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707432, "uuid": "16738d60-e990-435f-bc93-51a7cc804d1e", "comment": "Malware payload", "value": "3a1e75550424bd09cd96f65e306d90be2072c1327a2a27a342268836500f00a23fdff6d28e7212107d59ac7d1f3ca426", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707432, "uuid": "9c48ab6a-7c49-4630-b12a-c943cdeb02a5", "value": "5E33021998DE7629572D20F04681DB4EE9536CEA3C6DC9416CCCF8B9EC092A4127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707432, "uuid": "4599579c-477d-4677-9da2-26cc3b8025ce", "value": "1536:WP6z4+ADViS8CWoD94pUnQ64x11RiCVa+K:YPZBiS8jopkUQ64xu+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707432, "uuid": "9da7d3d2-d431-426a-91a2-0c919dc331bd", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707432, "uuid": "ef2bf259-3e91-40f1-9980-5149082b09f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707432, "uuid": "5c79c2b0-2915-48a0-b2c6-26a275c66486", "value": "statistic-968892759.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9248db-a8c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619686273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686273, "uuid": "a0b7f106-c32c-4ea0-9e5a-41398d0ee06c", "comment": "Malware payload (Dridex)", "value": "698160d49dbefc1ae2acbf6bfabf2e49", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686273, "uuid": "9786d665-04de-4f37-9f2c-82a9edc2f7e5", "comment": "Malware payload (Dridex)", "value": "0b943f3cfa91cfd7f4800150379afc9960ecce918bc380e9400d7c982917c8aa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686273, "uuid": "c1d6e24e-cbc5-4a84-9e2a-546bc2dd3edb", "comment": "Malware payload (Dridex)", "value": "88e7282a279affe261a71fca0f88b613287ca4d5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686273, "uuid": "5c698587-d4ce-4361-8ab7-0354542dd88b", "comment": "Malware payload (Dridex)", "value": "101f19e60f30bfb18ea9eaa680823e3968d7530283ee502639edfb9b52d0cf31d6d9ba049d421332d3fc77b70f972a3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686273, "uuid": "9d06daad-4f45-42d5-bf2f-745bf5c55a69", "value": "D8F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A98DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686273, "uuid": "5bcf601e-91dc-43f3-b653-da3be0b884a0", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686273, "uuid": "6a74917b-341e-490f-abac-741d3964d5ff", "value": "3072:mnSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2xGkFY:2nS62Fl+pkeJl3CvRStrFl+EY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619686273, "uuid": "ad4f9a9f-ccb4-46cf-884d-ffb9eee03a26", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619686273, "uuid": "079addbc-9c7c-4175-ab48-9d6dfa329247", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686273, "uuid": "b8953521-4369-421f-8ed3-01479b9b1070", "value": "698160d4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1942ac0a-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701755, "uuid": "eca37352-135c-4bb1-9967-c77deec4908d", "comment": "Malware payload", "value": "bbeaebb0fe41594431f22fc7c9dd4079", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701755, "uuid": "1d695d41-d0ce-4415-98f6-40f826130568", "comment": "Malware payload", "value": "0b9ebe7d28e514ab9d37e24f583513daad1a0c060bd9643c890720972120e41d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701755, "uuid": "b3513d2c-3969-42d2-9289-be0c92ce9c27", "comment": "Malware payload", "value": "a9b1c09a64f0361162b8157f2ca45154d867a2de", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701755, "uuid": "cb3275ff-2af5-4679-b71b-5bee44871ea1", "comment": "Malware payload", "value": "0505c8a47c03d5e7dc984ebb3a045f3b58c9030625c709bbd0d9479e8e46b15e3acd22a9804f793cbd6ab38459fbaf71", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701755, "uuid": "3ceb4e2f-daba-4800-a0a3-9f3a3db69a9e", "value": "F53301C4C58CD37298F2B8319C788B02C5B8A96B4826D956C0F34AEBB907DD5274ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701755, "uuid": "fc688db9-e87a-4c33-8fbf-b2ff84b769bb", "value": "768:fwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV29:WFugXVpoD8ZxhrLAuNS07MrxrKsYyCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701755, "uuid": "c4527c88-9d6b-42fb-b6f3-bef5bb3685f4", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701755, "uuid": "b24e2bcf-7afb-4676-a80d-16975992b434", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701755, "uuid": "37a45e92-4177-494e-96cf-518f0788eb05", "value": "catalog-646826678.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9294d3a-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706291, "uuid": "54f00132-4c96-4d36-a4bc-9d42604e756e", "comment": "Malware payload", "value": "b67bf26a6980de34f884d52e8da08425", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706291, "uuid": "135d6d93-781f-4286-ba75-f50bcbd3dc5e", "comment": "Malware payload", "value": "0ba6772de20945e56fe53dda033aa1b085f3d5df0b14ce6947a002ff474a764e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706291, "uuid": "e4aaa1ad-e245-4812-ac4d-8ac4355f487d", "comment": "Malware payload", "value": "8dbd5336fda5c3df119a640d9791a91a3d6754b3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706291, "uuid": "e2f1526b-03f6-4505-b2d8-103b733adba3", "comment": "Malware payload", "value": "0a4f30bac6b11196273b1b6885780a28de39716a8c9ab83d16c815eed8ae0b683c79bc96fa750b0a667e66774a2c503e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706291, "uuid": "7ff90f5c-1496-49c8-af64-f1d1bb7ad989", "value": "48330129886EBA2D577E10F08185DB1EE553689E386DC9811CDCF469EC0A6E8113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706291, "uuid": "acbb9edf-b299-4c26-a8f9-ff4ddc0f0602", "value": "1536:WP6z4+ADViS8CWoD94pUnQ64x11RiClG7+:YPZBiS8jopkUQ64xbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706291, "uuid": "e2fe539a-7d0e-4a3d-a3dd-727c92f7a0e6", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706291, "uuid": "9f7288fe-5263-4232-9ba8-31f02f18cd2f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706291, "uuid": "14ec8a20-96c5-49e0-8e77-43cf3cdf290b", "value": "statistic-258487893.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a196d20-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704736, "uuid": "62d23631-246a-4165-ab20-105455a9d802", "comment": "Malware payload", "value": "94c905c2bb2fb6679b2cfbb602080b83", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704736, "uuid": "9d11c4e6-827e-44b9-8466-86027b786b10", "comment": "Malware payload", "value": "0bb439dff21a448ece854d990b06277a6d233b8cabeaf2763275affc2dfdac3d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704736, "uuid": "c89cfe13-d65f-4f38-9a7f-3687b0e880b6", "comment": "Malware payload", "value": "4eb8035c23e48ad487ff6fdd1aee99283e091f1b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704736, "uuid": "f6363033-7c44-498e-b984-30953e0d0200", "comment": "Malware payload", "value": "f5b1964bac887032cc4f8c1906f25b15e9ba3788d6097e8f173c382deb62f41d51864a7dc0bfaf01a6790107fead2274", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704736, "uuid": "4532f0a3-896f-44f1-a2bf-30428ceb7d39", "value": "7B33022A486EB639172E50F08549D72FE61769D9385DC9812CDCF46BEC066B8013FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704736, "uuid": "870c93a1-5a4c-4041-a698-41734b76314d", "value": "1536:BP6z4+ADViS8CWoD94pUnQ64x11RiCpkeQ:lPZBiS8jopkUQ64xhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704736, "uuid": "be5cc472-98fa-4f61-940e-09aa04fe2ae0", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704736, "uuid": "b6e16c08-7b6c-42e6-82ec-58d232dbc088", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704736, "uuid": "98bcc6a0-4dbd-4002-b30c-fa994f3370c9", "value": "diagram-941360122.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378ee659-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706960, "uuid": "165bb25c-b271-4729-b74d-72bdff58d95c", "comment": "Malware payload", "value": "2dd57f89480af4f92b456c72657c2000", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706960, "uuid": "8e24082d-b136-43c0-a636-140f4eeef939", "comment": "Malware payload", "value": "0bbdc4631f3a17554f78fa7c6e286f04cbb461b1b1a9f42dd10c00ac2a51bb99", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706960, "uuid": "7a464885-ee02-443c-acfa-d14b9109363e", "comment": "Malware payload", "value": "92da8041adad8430a8a391527456bcd7a30b2468", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706960, "uuid": "8c7cf1b6-8eb7-4dd4-8a15-2407fc128efb", "comment": "Malware payload", "value": "e32bccafd4bfe928ead1d87bfd4bff40097da7fe34aaeaace0441d989c2548d53742abaa70b03660efda6bff0d1a6f6b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706960, "uuid": "4a68aa71-5fe1-450f-8900-fd42b44fbbc7", "value": "A83302194C6E362E573D10E08585C71EEA536C9D387DC6822CACF4A5EC036AA167FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706960, "uuid": "92033006-c33d-4d5f-8fb5-1574b1d76c0b", "value": "768:c9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiC229:1P6z4+ADViS8CWoD94pUnQ64x11RiCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706960, "uuid": "f9b849f2-ba82-4760-a846-fc987d1437bb", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706960, "uuid": "46a89717-4697-45bb-ab03-b6cfcb0fd4e1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706960, "uuid": "ee044287-82cb-4c8b-97d8-0133d99ccb16", "value": "statistic-631277748.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6e2620-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705599, "uuid": "48b0facc-fc28-4f74-803d-200a51303fee", "comment": "Malware payload", "value": "23762ebf1b7d61fd22ac572f7ed224ca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705599, "uuid": "3985aa78-a55f-4ab2-8c5e-a6e00b9f25ed", "comment": "Malware payload", "value": "0bc6a42c66b48a90ae40d3485fa07e3b5c32cfe7620a217939565808ac5a50e9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705599, "uuid": "1613525e-114e-4d72-bf8f-b682a34bc8e5", "comment": "Malware payload", "value": "e2de585d80debb33b49fc4858b075171cb18f7a0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705599, "uuid": "d6ebd705-70db-447a-85a9-576c26eba1ba", "comment": "Malware payload", "value": "384ba3fc35cd330355529658e7324f253b3bde16c1a22050c65e2f5e6db125eebf545a18079a86a2ef0d4e6ae541f3cb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705599, "uuid": "d515af22-48df-4f8d-b777-ac35d59d086e", "value": "9733022A986EB536577D10F985848B4CE50718AD387DC5812C9CF075EC0A3E9127FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705599, "uuid": "0d9a43b8-04f3-49f5-92df-be1cd0de53b3", "value": "768:b9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCp4o:OP6z4+ADViS8CWoD94pUnQ64x11RiCGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705599, "uuid": "c0012eab-cfd8-40e8-87d6-54144ebab77d", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705599, "uuid": "e07468a5-de57-4424-bcb3-cfb0d5c30db4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705599, "uuid": "8d2394d6-bd95-4b7a-943b-3fc8eb0d5ae8", "value": "statistic-1625981058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e793cee-a8e3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619697979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619697979, "uuid": "55e1c3c3-446f-4a3a-aec4-1472943044f8", "comment": "Malware payload (Dridex)", "value": "76aeaa9935fa9f4b9fe13ce83a4ddab9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619697979, "uuid": "4abcb15d-2e2e-4d71-b4e1-2c07e1bbfda4", "comment": "Malware payload (Dridex)", "value": "0bc725d4a53dbe9a2286c3b9326a426306454ec0587d1f034f2fbc1b4ae2686b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619697979, "uuid": "57123487-5f2e-4f9e-a79d-07e07c143cfa", "comment": "Malware payload (Dridex)", "value": "686d1d4237a96d1d46e7db62ae38374230a0a627", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619697979, "uuid": "d5e671c4-292b-402e-b809-71434b3806ed", "comment": "Malware payload (Dridex)", "value": "59caa9977dd9c05b65197cf029e0fc9efd1c71eafd655c1848bda01007928e53f3570b1d2f6fd8b74b06363189cc4c12", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619697979, "uuid": "e3268701-2f8b-423a-8fe3-65193be161d4", "value": "10F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619697979, "uuid": "1b55df86-933f-4c5b-a8d4-dae3a8214ef6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619697979, "uuid": "07811948-1539-40f0-bf35-213dc01cceef", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619697979, "uuid": "6f093193-511c-4641-9f9d-5f26547bdaf8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619697979, "uuid": "c2cc2f33-854d-43f8-a5dd-1a0786b23d97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619697979, "uuid": "ae2724b0-2027-470b-b2a4-3d55ebd3adde", "value": "76aeaa99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81166d7-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659125, "uuid": "e8c40f66-aaf5-4010-ad40-70190d2fa20a", "comment": "Malware payload (QuakBot)", "value": "b8cd183e591793efc75e494a6b81b2b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659125, "uuid": "eefdabc3-4ea3-48a1-96a9-42ebb56758f7", "comment": "Malware payload (QuakBot)", "value": "0bda44b4f1d9244d04af37e8a2a67fa3799a57b744d829adbd3136b482f5de6b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659125, "uuid": "44349a11-02be-46cd-9c48-594a74b1192c", "comment": "Malware payload (QuakBot)", "value": "95f9955db08abff07562eb06ec9d2a4c9a2c8968", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659125, "uuid": "db795077-1157-487c-89cd-58c1fde3897f", "comment": "Malware payload (QuakBot)", "value": "1b61093a07c488b23926fc53700ae7a134f9846b69eb33efb1892ed2e3cd6a1e49e592025db198db6809ff48a04f59b6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659125, "uuid": "bc2d7691-366a-464c-9b44-5f4dcfb70a13", "value": "51549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659125, "uuid": "2394bc6c-2ceb-4690-b043-55168557cbbe", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659125, "uuid": "26fc520a-b998-4a6a-b968-6123267c3259", "value": "3072:03FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZh0:4vv9sMoXBaRmr/dukbvuZ/7fE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659125, "uuid": "cad8f927-b5fd-46a4-ada3-6b0f943490ff", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659125, "uuid": "18ead228-75ea-4b5f-ad0e-9f5ad69c93c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659125, "uuid": "bf140d1c-9ced-49bd-ad18-f26a9d86b858", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad3f951-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659130, "uuid": "719937e9-ef24-4d11-bc7e-ef33da443ea7", "comment": "Malware payload (Quakbot)", "value": "0523388322299acaa251034523d044ca", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659130, "uuid": "f3c95bc8-4f10-4924-8fc3-8c69779f24ce", "comment": "Malware payload (Quakbot)", "value": "0be24049927202f31d04419d4fcf5d5bf626626426a8adeb51a5e7cd9f95939c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659130, "uuid": "0030382a-1414-439d-ac48-0421cc180fc8", "comment": "Malware payload (Quakbot)", "value": "bbf4cfb916afeb1c1e427ce1c409daf3ee926509", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659130, "uuid": "00cb1391-da6e-4301-a2d6-45adca540e74", "comment": "Malware payload (Quakbot)", "value": "15494748c64f675a3c4579796fabdd56cee70e472403994667dd87cecb87fa79c0a8ff80498d781661a857b28c2f4a36", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659130, "uuid": "dbc5e89a-2567-4743-81a9-b37328645e1a", "value": "EF549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659130, "uuid": "b707cbe6-c7b7-422e-ac09-431585c2a426", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659130, "uuid": "22ee9ca1-796e-4818-83f0-4fc8c6cdaf20", "value": "3072:G3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZBx:ivv9sMoXBaRmr/dukbvuZ/7fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659130, "uuid": "29684784-f90d-4384-b298-d4967c754064", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659130, "uuid": "1b6dc381-67fd-4efc-a9d2-e838b693f922", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659130, "uuid": "fb10bf9d-50bc-457e-bf13-97af4026f8b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4289cd31-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705690, "uuid": "59442460-13c8-4261-9c72-75cab65f8b73", "comment": "Malware payload", "value": "2d4918b6bed9c10b0ec7ddcc7ca45c10", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705690, "uuid": "78cdbec6-dc23-4d2c-96f5-b14442edfac4", "comment": "Malware payload", "value": "0bebdd61b9f61ab412e4a3e764ac10a1d3c637200f60ce5bf4de56461f021b54", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705690, "uuid": "42f36ccf-db31-471a-84fc-9a20d63f30c4", "comment": "Malware payload", "value": "4151273827bd79116bc039a432f40bae33f37c78", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705690, "uuid": "393119ac-316a-46ec-b9e2-4a69d557eb26", "comment": "Malware payload", "value": "f47e31745d4a00759ae2760468081327a6c306d48752ca427a8d73f74fcd98c33fda8100c0c89ad7f70ad285cd856435", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705690, "uuid": "da2bc859-915d-4009-a1a1-85036d1a1124", "value": "5233023A8C5E7B19572D20E405449B0EE55769D93C6DCA82189CF4B6EC063AD123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705690, "uuid": "3fb14c39-0cea-4be1-a4f0-6d401422b843", "value": "1536:kP6z4+ADViS8CWoD94pUnQ64x11RiCituE:CPZBiS8jopkUQ64xjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705690, "uuid": "cc216e3c-7114-4bb2-b579-5460221c7aeb", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705690, "uuid": "8729889f-f180-4d29-9fc9-a64fa00dc9a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705690, "uuid": "762373a3-249b-44bd-819e-af5b4a5c09e0", "value": "statistic-168960074.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a152b0-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702772, "uuid": "d56bc171-fbb4-400a-810b-7d386d4abb5a", "comment": "Malware payload", "value": "e49cf8d066ec42a3d37dc4d0e8edf3bc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702772, "uuid": "de692ea6-2cd6-4b21-8515-057a596ba163", "comment": "Malware payload", "value": "0c06d239701981754b2f749b0b805596fff848d35403fb18a8ebbfccad0665db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702772, "uuid": "1adffd4e-93b6-4bb4-91db-d26d41485537", "comment": "Malware payload", "value": "9f5faae57f6513aa590c5b4c9ecdd15388de30ee", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702772, "uuid": "d59e66b8-2c9b-4d67-95d3-cd9147f79e58", "comment": "Malware payload", "value": "1cb4136718104fa36bd9a7ef2121db4822f7939ff6992a65d902e130fe202fd7fc905f85aa99fd624c8ea851d13c22e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702772, "uuid": "3ff2816d-f3db-4a5a-8439-45c2014d6596", "value": "8F33022548AD773E637D00A085859F0EE5176C9A3C1DC1D21D8CF4ABEC05269117FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702772, "uuid": "6ec097d5-b8fe-4c8b-96af-38e96a5ff02c", "value": "768:s9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCQUj:FP6z4+ADViS8CWoD94pUnQ64x11RiCQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702772, "uuid": "dddf5bfa-7481-4705-94ae-01aa2865f34d", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702772, "uuid": "1ecad78c-d088-4a8a-b117-074704d480a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702772, "uuid": "ece9ad9e-76e8-47a9-bac1-a72987a29695", "value": "diagram-1451630750.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f10666-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707029, "uuid": "228945d2-af88-41b8-9912-2f0e3d24438f", "comment": "Malware payload", "value": "261600c19ea13adccf7507458a691ee0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707029, "uuid": "c7c82d73-bed0-4136-8f6a-f1cdb7f1784a", "comment": "Malware payload", "value": "0c0ad7434223c876698c38fe2da4bf48fd69140e73bc215806a69308138b8869", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707029, "uuid": "83de2850-07c6-4032-aa12-67651f62cfe8", "comment": "Malware payload", "value": "1456f0ef2d373ffd77b7ae97988c80155c044119", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707029, "uuid": "35933fee-5dcf-4d4b-8543-1289eaf9a6c5", "comment": "Malware payload", "value": "c7fe3c05c26a3c6be68697f29b66279ff49c368fd4e16fad2a601e7e1788471c1c398dbdd4a58803ce104a849f075e11", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707029, "uuid": "7b3d2a93-00cd-4984-886a-79d6dbcf2bc8", "value": "6C33012A5CAD363D173E20F0C485DB1EE5176899386EC2826C9CF8A5DC066D8123F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707029, "uuid": "2eed6674-10d0-4a92-bdee-8fc9498d2bbd", "value": "1536:iP6z4+ADViS8CWoD94pUnQ64x11RiCiCJ:cPZBiS8jopkUQ64xsCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707029, "uuid": "3b132ba7-9269-4d39-962a-d364ab92a4f2", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707029, "uuid": "f52a7210-0e29-42cd-aa19-a0322e7f612e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707029, "uuid": "10ef5cf8-9581-48b8-99ef-180e76b86d33", "value": "statistic-696391799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb5e937-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659135, "uuid": "37ef892a-6c57-4e53-9b56-e0b5d62ba6b0", "comment": "Malware payload (Quakbot)", "value": "1c6e0d30e1cc0ad2920639d34bdbcd76", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659135, "uuid": "90761e8c-2a0b-4dee-b808-50958afea584", "comment": "Malware payload (Quakbot)", "value": "0c0f11d9d9f42c6495d400f5827da9bb616c9ea77a770858cc4a18d1174ce4b9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659135, "uuid": "912b254e-1df4-4fb1-9077-e4a732e362f4", "comment": "Malware payload (Quakbot)", "value": "fa956305fd1f14cce66b6fc712782ba7506135d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659135, "uuid": "c781fbdb-fa8a-4eff-90e1-7dfea85aa052", "comment": "Malware payload (Quakbot)", "value": "7eceb1fdf3894f176fd9595434e6dc2e37ee0332ce73f89832a23f3ff4c26910abcd3f492f55972ed6becefd4325e3a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659135, "uuid": "a6775c88-05c9-4999-8e3e-234a7dcafb17", "value": "DE549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659135, "uuid": "198f7942-cf2e-45e1-89d9-a7de44047119", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659135, "uuid": "9a8a6909-2878-4614-90d6-5f29a860ff3b", "value": "3072:a3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZEv:Wvv9sMoXBaRmr/dukbvuZ/7fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659135, "uuid": "d5aa6527-6d1c-471a-90d2-0bc144605ee2", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659135, "uuid": "578022b4-f1d2-4a89-98e6-3644e9299374", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659135, "uuid": "28d21b9a-a486-421f-a5b9-cd20677225a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07809f4-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659139, "uuid": "ba8becc0-a614-46c6-8b6c-8d0986fdae39", "comment": "Malware payload (QuakBot)", "value": "2e5abe9efbc98deaf6536723b03ebbe5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659139, "uuid": "b74decab-500c-4712-a222-a8ab64ca23d4", "comment": "Malware payload (QuakBot)", "value": "0c36e05986271083aa54c6f96572d2fd9b60f266a82c00135443ca80a67892c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659139, "uuid": "fd5503b2-d8c8-46cc-b3a4-ec7bd20dc5f9", "comment": "Malware payload (QuakBot)", "value": "d1853dff5e1f4a053b77097945c64d3eb4081cb7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659139, "uuid": "7638a4b1-2bda-4586-92d6-fdefef76e822", "comment": "Malware payload (QuakBot)", "value": "6007a43887ae1734753252d6393e6a670b61d1a6dfc9132b7ed3def302562240f0fec77df39ae249526b1a1e5f64bceb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659139, "uuid": "f4b3b24c-915f-466c-85d8-ef95383521af", "value": "BB74B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659139, "uuid": "b6ba70d2-24ed-4e81-a1b7-fdbd2f382743", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659139, "uuid": "d3838cf2-d276-4fc9-a168-1fce23554bc2", "value": "6144:kTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRul:kbi7/xZrkNK11G9AQyOi6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659139, "uuid": "272c4d6d-d16a-401c-b229-5b708aeff792", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659139, "uuid": "217150d9-6d0a-48b1-a4e2-508b99af39fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659139, "uuid": "e08be7a0-dc47-47b7-9fdd-da0fc7a95c8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a8a465-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702745, "uuid": "5569a4bb-22ec-403f-9c54-69511479b119", "comment": "Malware payload", "value": "d9fbb367e463052550d1d29dcb0b1422", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702745, "uuid": "1777e88a-4ef6-4056-8a33-386b8127d8c7", "comment": "Malware payload", "value": "0c5124bd7e9b19c83ed13a1899210baef2b180a40f0295813e18b12d862dbed5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702745, "uuid": "562e5585-abbf-4c9f-aac6-63f2c82555d5", "comment": "Malware payload", "value": "43f847c814bbf36aff2818da2bcf2378abf2d6d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702745, "uuid": "ce1b5fad-d4be-41f0-8e2b-44967dcc7e82", "comment": "Malware payload", "value": "8fa1008c4f9ab17da9bc182c0a9cb7845afa0150e6584aebc2631b4f9eceae7c2fee911f042f49a3c2295c7c9b6b1fd1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702745, "uuid": "5dde8a19-8286-43a3-9013-52a76385b4f6", "value": "6533022A8C7E7B28536E10F14985EB5DDA076C99382DC545289CF0ADEC057E9113FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702745, "uuid": "9142741a-e570-493d-9eba-298c4162d280", "value": "1536:rP6z4+ADViS8CWoD94pUnQ64x11RiCg/M:7PZBiS8jopkUQ64xQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702745, "uuid": "eda4d33e-4f95-436d-b3c9-c725868bf870", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702745, "uuid": "3319dd86-34f2-4d5a-b6bf-276b87061df1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702745, "uuid": "6db5c968-7d36-4a79-9fe7-171f1c538b64", "value": "diagram-1431345033.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35d5276-a87e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619654769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654769, "uuid": "a053405e-799d-4dd1-8a68-4bfbacbc652f", "comment": "Malware payload (Dridex)", "value": "ff4466f69fe40647a025edcb53f9b892", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654769, "uuid": "572331b4-4606-4420-92ab-62ebf706a745", "comment": "Malware payload (Dridex)", "value": "0c53468fcfc449e942d5b6542e281e28e52c6a4534818ab545e3f4cf4968e1b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654769, "uuid": "3c2c50f5-714b-45ab-85cb-e8073cbb40fd", "comment": "Malware payload (Dridex)", "value": "5b8e88959c19cdf9c94f4c1dd6bdffe2ed806076", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619654769, "uuid": "18b87717-330c-48a2-aede-929e60280fd4", "comment": "Malware payload (Dridex)", "value": "95c7c639761fb38345284ee3f1298859036f2b8a3fb6cb8ff642d491441f8a4ded1220974366278d65289056a0527a40", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654769, "uuid": "c739d425-5323-4c2b-b10b-1fda2cc7ee9a", "value": "2EF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654769, "uuid": "c3f867f1-193b-441d-90a7-7cd52cdcbfc3", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654769, "uuid": "41b28990-28f8-4497-898c-9dba9feea617", "value": "3072:n78CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYOZwd:QnClX8WZ7/HrRCADTR0VlIZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619654769, "uuid": "50f4b14c-4636-4de0-84e9-8b67a85f75e1", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619654769, "uuid": "c02851c7-c8b3-4bf2-9363-6c2443be5fa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619654769, "uuid": "bc305921-551b-4d15-9d7d-762d6553b60a", "value": "ff4466f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8be132d-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701164, "uuid": "2ecba21f-13ea-417a-889f-ad110bdd8a5f", "comment": "Malware payload", "value": "91720937819ad6bc6303ffc8dff6f942", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701164, "uuid": "78ae2eda-68cd-41b2-9c0d-608e75de242d", "comment": "Malware payload", "value": "0c538681c50730c862f1da2397a0336fa94bbc48493a8b6ef3d1dcae76b2f839", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701164, "uuid": "4d330dac-3a18-4d59-8517-3a0932aa1fb8", "comment": "Malware payload", "value": "00de8f5ed149faaf611306885f41a1ba22a3f31e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701164, "uuid": "c5d72925-4781-4d57-8893-6455d90825bf", "comment": "Malware payload", "value": "a1619c74b3f1c8ced9f3586ce13dd691020ed32bfdd4d84b67c94ac40344455bc9adc88d956bc8399c63c43e0255ec7d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701164, "uuid": "125c76fa-aa55-4833-86ea-5fdaff6fc7ae", "value": "AB33F1C8C5C9D372A8F678319C75C701D474EAAF4816C86282F786D77C07EA46B4A9CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701164, "uuid": "2778ab4c-9372-4217-8a06-c6bbae6cfaa8", "value": "1536:qFugXVpoD8ZxhrLAuNS07MrxrKsYoR+wm7:Uq41rLZNkZLY++B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701164, "uuid": "c382c32a-c326-474d-acec-e726c48cf543", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701164, "uuid": "9ed511fa-decb-4e72-bc3d-fa97c0c036eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701164, "uuid": "84726f99-d007-4f4a-b349-d3bf98d82189", "value": "catalog-210999578.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35c7ce8-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659144, "uuid": "7011c846-0774-4d13-8819-ef8e05e88a23", "comment": "Malware payload (Quakbot)", "value": "2893835b3bc0adaf3edc12d709c6d712", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659144, "uuid": "d18a6b29-8167-4b7c-b2a8-c5c54d68d2a9", "comment": "Malware payload (Quakbot)", "value": "0c583602606e8b5ecdb758481278b4f1586e8d92bec6cb421bdf6401f3761c19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659144, "uuid": "12843e3d-7b6c-4705-a8e3-4b3796c85e49", "comment": "Malware payload (Quakbot)", "value": "b1eb3d008ff86ba27ee973472cc54b693cedbe07", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659144, "uuid": "eaa71438-236c-44ad-ba2b-b725009893c6", "comment": "Malware payload (Quakbot)", "value": "25ca85dfa182efc790f10eee4f165cd97cb66da8d3b3fccead123ca89ddf30ba8d6c808d9a61f898b684bf50dc5ca319", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659144, "uuid": "999f374e-ef0c-48d3-8356-aa027055b23a", "value": "16549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659144, "uuid": "c7742043-37ed-44a3-b4c1-006f13961dc0", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659144, "uuid": "787de1f2-9f74-474d-b257-c114b05bb701", "value": "3072:N3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZwk:9vv9sMoXBaRmr/dukbvuZ/7fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659144, "uuid": "ef097b28-0e6f-4789-bf71-82120f4a297b", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659144, "uuid": "7f1a49fa-7088-4dc5-bd38-3d3ec573403e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659144, "uuid": "8c1616fd-312c-4b37-9699-5e36a9a4f76a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61cc564-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659149, "uuid": "c96ebab7-b2c5-4261-8a77-611cbdb06cfb", "comment": "Malware payload (Quakbot)", "value": "e6f7dde7298dd94b6ad0accfec708913", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659149, "uuid": "b9baa561-15d0-4685-b74e-2beabc0e72db", "comment": "Malware payload (Quakbot)", "value": "0c66ccb40f5ac22dedb20416260390ff87be374da89b703cc21f283c0432226d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659149, "uuid": "958960ba-844a-4aca-ac41-9aa4d676e187", "comment": "Malware payload (Quakbot)", "value": "5909d3dcf951c2224b6af23a400764a4beef93df", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659149, "uuid": "bc8043fa-f98b-44fa-9fbb-4882768259f3", "comment": "Malware payload (Quakbot)", "value": "709b2adf7b7530c975ac6b9ccf67bcff513efd4c64bc0ec79e7f7a2746e83284eb80917001ca79f1b66287422945f323", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659149, "uuid": "5f92887e-3499-43a0-9175-a180f89ae689", "value": "97549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659149, "uuid": "80bf04cb-0e01-43e6-94fc-6fc7a56b0665", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659149, "uuid": "a5966f5a-17f8-4df3-8819-731369b54132", "value": "3072:p3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZTR:Zvv9sMoXBaRmr/dukbvuZ/7fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659149, "uuid": "d84d25ee-2f8f-4b84-872b-f5393cc60cc6", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659149, "uuid": "d9803403-51c2-4032-b629-e1fb48094880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659149, "uuid": "18588d43-5b99-4b39-8117-60d8d9803892", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e904ed9f-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659154, "uuid": "7a9b3a14-9684-4b17-9f78-ad74afaadc64", "comment": "Malware payload (Quakbot)", "value": "b02a6ed2cf3dbcc982f5c3b5e187a57a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659154, "uuid": "6b42db10-f1e9-4d4c-a1f4-9269b4a409b9", "comment": "Malware payload (Quakbot)", "value": "0c8357ed4d3f89831b46aa988a2724a17510d9a1659ab89cae029f4b964002f4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659154, "uuid": "88924c2f-bb4e-4c37-8a4e-0196230bfe9f", "comment": "Malware payload (Quakbot)", "value": "a6db51183520758f66189ab4c70cfe86f223d4ef", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659154, "uuid": "cef950ef-049b-401c-bd7a-e6c2ddea102e", "comment": "Malware payload (Quakbot)", "value": "9d0f41d8569bd71c790c732eccdce269dfe27576740105e4fe88e591118426f1f7647d2248b19a1e549239721e691134", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659154, "uuid": "e9fb82ad-6557-4331-8229-7bcd61d9ad29", "value": "F574BF7DBB16DC23E2681BB062D35B581A53DAD63250210A1AF19F58ACE7394BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659154, "uuid": "c925f1ba-a5ef-4007-8844-89392704ba3a", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659154, "uuid": "30fd949a-53ef-42c4-9d8b-ebfbb1d965b4", "value": "6144:ynQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRue:NFrkNK11G9AEtMxQyOi6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659154, "uuid": "e675f658-f970-4bcf-8962-2de1fb9d2960", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659154, "uuid": "21a7f801-801c-4074-ac77-f0aa5743d16d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659154, "uuid": "17161239-0d33-48ec-bc7d-a793203fc7b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a51b4a-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699952, "uuid": "1d4013c2-a6be-4e53-bcdf-c46eecea7a29", "comment": "Malware payload", "value": "4f5c2af8c65cbf1bde53629f4687293b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699952, "uuid": "a8b33289-14b1-4679-9739-130ee9995498", "comment": "Malware payload", "value": "0c88b5136e63dcffb9537c81e2eb057e687a5903ba81f4319123f073546e7e57", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699952, "uuid": "5f6db89b-ecd2-4bbb-9f51-48de0c1a028e", "comment": "Malware payload", "value": "53fad1bf080eae0ad0fc8b18acc58b9faba4e6e0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699952, "uuid": "8d0b8302-237a-40fe-b073-70061625f078", "comment": "Malware payload", "value": "1090f6cca4a42d549998b464b0e6f47bd2ddd794c8b9b66ed617cea68f00683f809fca48db050d55850a5c0f75e3f766", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699952, "uuid": "a8bd1ae2-f6df-40f4-92a0-f36e328d57e8", "value": "D533F1C8C5C8D372A9F678319875C701D478EABF481BC86282F786D77807E946B4A9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699952, "uuid": "58ed50d6-5bde-47e7-83e6-22a024da27bd", "value": "1536:FFugXVpoD8ZxhrLAuNS07MrxrKsYoR+P1m9:Vq41rLZNkZLY++Pg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699952, "uuid": "eba03f71-d26e-4b88-b895-2ae1e3e67e21", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699952, "uuid": "31c28972-3bf5-4a2a-b4b5-154e755b59b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699952, "uuid": "870ae9d3-758b-4b4c-be4d-491a3bd21038", "value": "catalog-1204012641.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e2e3da-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703352, "uuid": "52eabcaf-54ac-496a-8853-3b83454aa789", "comment": "Malware payload", "value": "abbd1f0772b1790e91ff1830a27c2c63", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703352, "uuid": "16c4ca01-1c4a-403a-a95e-368869a4dc87", "comment": "Malware payload", "value": "0c8ba08499be4ffae5ace4ddd3aadfaa644f6e6e5fec9135d3833fd972b3fed8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703352, "uuid": "f4f865c0-708a-4623-a7b0-29de4ebbd3f4", "comment": "Malware payload", "value": "fe796d11f9c80f7f9e1b5f5c19425ec9db8e1e74", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703352, "uuid": "3e0e85a6-2c93-4dac-ad38-34fdbb05e477", "comment": "Malware payload", "value": "8f712859846dfb99c393fd59b0729850d5b1ba611ab2000f29d9a3ce445a432b57fe368bd62f2590d304706e259cf523", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703352, "uuid": "2eea4ce4-bff2-4c14-bda4-82a318c69cb8", "value": "1133122A8DAE7A2A572D10E04A45CB5FE617188E3C6DC6824CDCF4A6EC056D5073EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703352, "uuid": "6be4ba17-7f28-4b2c-ace3-734174d128d4", "value": "1536:JP6z4+ADViS8CWoD94pUnQ64x11RiCFbX1:tPZBiS8jopkUQ64xjL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703352, "uuid": "f35c9012-3278-4b81-a2b6-017ccea56a50", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703352, "uuid": "d0b3c73f-7d30-4852-a66f-f73059b01fd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703352, "uuid": "cfbf8bbc-662d-402c-b991-7e78acd54f38", "value": "diagram-1813672544.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc59e10-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659158, "uuid": "818ce5f2-495a-4f3c-b8e1-6bfbedc5cece", "comment": "Malware payload (QuakBot)", "value": "e8fb6b26f8f0b0a6116c81afae2d6a54", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659158, "uuid": "e2132418-b319-4c4e-a567-9b1358f76a6e", "comment": "Malware payload (QuakBot)", "value": "0c95bf7fc957813e4c5623744ef6dcd14dda4a4858a7e6282e896422166acdde", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659158, "uuid": "5fdac58d-7303-48b2-aee3-4228a873e736", "comment": "Malware payload (QuakBot)", "value": "b45e188038fe17d6152f21ad437341fa3a523f74", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659158, "uuid": "48e608ed-2e2c-4b53-8360-c95d45bf43fd", "comment": "Malware payload (QuakBot)", "value": "5d61cfb6a5f5c9c5b452c62e5d8876426c2fa5a7b972ee5759fde7d939285a0b40b02aab53f5b102ca0cb1bf2cefe363", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659158, "uuid": "02b79598-a940-43ce-bfa9-f01a442ca109", "value": "C574BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659158, "uuid": "4dc90fe0-aed7-4c15-9b04-29a1b4f6132f", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659158, "uuid": "d1a88d92-80a2-412d-8a8f-b882815bf475", "value": "6144:0nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu8:DFrkNK11G9AEtMxQyOi6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659158, "uuid": "c84f0d67-9c77-43c0-9083-6b2ca49658f4", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659158, "uuid": "29420d8c-4329-469e-a5c7-b8a3653f579b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659158, "uuid": "646dac43-b0ab-4c96-88a2-c687285fa7e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62023cbd-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706601, "uuid": "5e67dac2-8dd3-4d89-8ec4-34faba732d1d", "comment": "Malware payload", "value": "2a246e44b8cee67d644e08a89188b0b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706601, "uuid": "c341f824-80ee-482d-b9bc-1f9dc8a7e0b2", "comment": "Malware payload", "value": "0c9b5e39037e0a7f6612b0520d2b80b178362db3d82b9b0f9af824c2f670f343", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706601, "uuid": "76b7bcdd-5fef-46be-bd03-67fb8b0bfb20", "comment": "Malware payload", "value": "d8a9244e7ebca5538a5bdf0c41cd285d3c5ecb31", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706601, "uuid": "56b11db5-b2b3-4a3e-8e4b-d78a9090b1ed", "comment": "Malware payload", "value": "be2d6e657a761c23f60d69a816eb24dc72f67aea786395be3bb4c426ae401492d94eef353edc5756fac7863765251977", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706601, "uuid": "c14343e0-c1dd-4b57-840f-cc9f0e7b8ee3", "value": "A13301195CAEB72D533D24B886858B5EE503A9D9341EC6450CECF066EC066ED223FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706601, "uuid": "3ff73916-e231-4054-9f7e-8e5e975240f9", "value": "768:P9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCB:6P6z4+ADViS8CWoD94pUnQ64x11RiCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706601, "uuid": "a2b58279-e433-4c2e-b987-eea6377ff1d4", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706601, "uuid": "92ab9c17-9976-449a-a377-90e5f6f170e3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706601, "uuid": "07d4fd04-d935-4c9e-a8db-36992c6ad070", "value": "statistic-450517421.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8f9508-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659163, "uuid": "e2baecc4-55f0-4c99-9ce2-4df0e87cb586", "comment": "Malware payload (Quakbot)", "value": "6d8fc4587d906db44426258f7419fbe2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659163, "uuid": "a9e717c4-008a-4be6-952d-9fc48d82744a", "comment": "Malware payload (Quakbot)", "value": "0cb97be95f1c8d925cc20f4da1ea4995331bbdd24f26bc6be676ce6522834b9a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659163, "uuid": "84c03325-1331-48a1-affa-a872bc18e3db", "comment": "Malware payload (Quakbot)", "value": "a684018db63b23df6d10d40a69136c32d1abf8fd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659163, "uuid": "05baaf09-1540-4fd3-8900-f33aa366d9f8", "comment": "Malware payload (Quakbot)", "value": "746cb10ed0269ca5053ae8a4b07271f899750c35745e35e115c366eec82567e39e91cb7fef6de0ca7354b2dc5de23169", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659163, "uuid": "9f9768b1-2847-4f1d-9c75-1d20a1301920", "value": "9A74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659163, "uuid": "c965e794-3104-4aaa-a1fe-c23e66193c74", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659163, "uuid": "b98bd6e9-e114-4f71-93a3-7f9f6e8a0b73", "value": "6144:8nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuu:LFrkNK11G9AEtMxQyOi6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659163, "uuid": "220ca540-4f08-4e14-be88-154174c1e45a", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659163, "uuid": "b10eece4-5fce-4176-8aa2-181f437e9ae7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659163, "uuid": "5bf3392f-a9bd-482e-8ec3-5d036873ed4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2333c1-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707046, "uuid": "6744d602-0d3d-41dc-93f9-677b7dd4933e", "comment": "Malware payload", "value": "50bd83ba76c2e2bf6639a9d4235104c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707046, "uuid": "6488dea7-5942-414f-8bbf-7d34468735f2", "comment": "Malware payload", "value": "0cc2cd348d9e3ee8d477ffe7cfd00decf2901a26bea37c5acf6f42f64bc81c1b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707046, "uuid": "6970893a-6fdf-4968-a086-bec6877641fe", "comment": "Malware payload", "value": "723fabc39055eaa62d69f6d76898bcb1091ea113", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707046, "uuid": "ace26595-8f83-4673-a42b-d3a0f32f41d9", "comment": "Malware payload", "value": "fc75b7a06967e148a77143e3db35783933ed36c2dc0f68d2d461716fe4f9ee3974cd4c4940cca28646e39d07ff949b92", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707046, "uuid": "2f82ddfc-a21a-4113-9c65-f544607fc2fd", "value": "5A33021A4C7DBB2A5B7E00E44585DB4DE647289C3C6EC68228ACB075EC0A2E5127F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707046, "uuid": "164e4af3-5b1d-45bb-990a-ca39c88ccbc3", "value": "1536:CbP6z4+ADViS8CWoD94pUnQ64x11RiC92NR:iPZBiS8jopkUQ64xu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707046, "uuid": "1401a552-3de1-4fc9-9fc7-9ace32e5aa46", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707046, "uuid": "f83b27d3-e330-47e9-b387-2d6b226fc652", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707046, "uuid": "6f3b4e79-ba29-4b11-abc8-f1aae898fced", "value": "statistic-705027025.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f171c9c5-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659168, "uuid": "21da6c5d-721b-47c5-9b32-93b7711637b5", "comment": "Malware payload (QuakBot)", "value": "11ed9e9433580e568cc28ecc9453c9db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659168, "uuid": "2de62380-8aee-4513-ab32-2fdf0b97625f", "comment": "Malware payload (QuakBot)", "value": "0cd74fd12f950619f6fa2a068a54ebe885052610a023705ba2a11ea92731bd3c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659168, "uuid": "080fc2fe-2c7e-461e-95bd-cda0cb3d5535", "comment": "Malware payload (QuakBot)", "value": "74e34053e9babe010c6483f2fd13bc1a3226164f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659168, "uuid": "13e103dd-3e83-4c2f-b855-e733af308032", "comment": "Malware payload (QuakBot)", "value": "11e98b679efc1ff5c990527018159b31f866939c4ce9784ca75a708b189018bf130c358283e34624ccb475e246b31c44", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659168, "uuid": "98a29e54-4bf2-4604-ae05-da03250da33c", "value": "08549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659168, "uuid": "0a531bda-d807-4b6b-bcd4-fc7ddc827d74", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659168, "uuid": "c36315bd-e92c-4494-a2ff-784eb2c918bc", "value": "3072:S3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZQ+:uvv9sMoXBaRmr/dukbvuZ/7ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659168, "uuid": "f5bf9f2c-e1b7-4366-903f-c85756ca5799", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659168, "uuid": "c22a858f-d495-4736-a080-64442c3f8db7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659168, "uuid": "31260654-4281-41ba-9d77-0398797fa9ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e06424b-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707024, "uuid": "0c71ae91-c25e-4943-9fa4-619edccdd1c7", "comment": "Malware payload", "value": "db1b7a0c572a281e97a03839389d8d4d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707024, "uuid": "7adc0d44-69a5-42f3-8cf0-83789001cdc2", "comment": "Malware payload", "value": "0cdc2339719613f59c9f664ce1431ab8f51223941b54ccf0f93b9c0bd5be4156", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707024, "uuid": "b1ff114e-e7ee-42d0-80e0-5c1fd8134a81", "comment": "Malware payload", "value": "bb421036480898ce15846f184837ce06a74a1544", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707024, "uuid": "81fca987-1182-46cd-aba9-19e117b42bb4", "comment": "Malware payload", "value": "5fc5082749b06093f0f4ca7ba1e13706ffb70d92c274a447bb873df888ba2a6f4401c18d67ed71dc39f14eb5f04f9104", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707024, "uuid": "45069eca-d2d3-4fc0-a401-e982fce97df8", "value": "E333122A986EB536577D10F884858B0CE50718AD38BDC9812C9CF475EC0A3E9127FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707024, "uuid": "52d037c8-4c97-4d37-ac7f-f5ce9e05fe13", "value": "768:i9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpxz:rP6z4+ADViS8CWoD94pUnQ64x11RiCXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707024, "uuid": "21f47438-f283-4b45-876a-f619931169f5", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707024, "uuid": "f443f624-2f9e-4b38-9e72-8bf50cef42c3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707024, "uuid": "45902368-5557-49d5-8798-3cadba8cea7e", "value": "statistic-693556246.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af36195b-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704154, "uuid": "350daa42-c0da-46bc-ae90-7e441f3785ab", "comment": "Malware payload", "value": "a60e045691ca64da2379d3296eddc92f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704154, "uuid": "5748d677-473a-48a0-be6b-612bced561f3", "comment": "Malware payload", "value": "0ce300049ad0efa1fd275bb6af3bdcefa237b711501ee3b2acfa5f343d24fcf7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704154, "uuid": "f1abe44c-1699-491d-b271-84d50aeae398", "comment": "Malware payload", "value": "361d0ae1c57cad13714aef11dfff6ad4a093b6cf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704154, "uuid": "d4404bb6-6bd2-4973-8d69-0afa9acb6808", "comment": "Malware payload", "value": "7cdc052f44eff36f480f5c0509166a2ce37c2cc3137ab6c23b8b51b6ca78e3f72c1339252aee224d16f2653ccec5994b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704154, "uuid": "67a0056a-f5bc-406c-8082-ab1c42f79d0a", "value": "9A33022A887E7B28533E10F14986DB5EDA076C99382DC545289CB0ADEC067E9017FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704154, "uuid": "88c053da-9c1f-445b-8efa-3f91ec2a50c0", "value": "1536:LP6z4+ADViS8CWoD94pUnQ64x11RiC3K1:bPZBiS8jopkUQ64xU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704154, "uuid": "fea75cce-ad71-4c9c-b94f-6c5b7f0d1bbc", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704154, "uuid": "ed99f033-799b-4806-a385-779624596efa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704154, "uuid": "9b6c0e51-6d04-409d-95e4-8a0112f967d0", "value": "diagram-549521010.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45576ea-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659173, "uuid": "8a65b583-fb19-4bc9-bceb-8fd1a97e034c", "comment": "Malware payload (Quakbot)", "value": "fb6289d622b32b2dced4a604b8b00035", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659173, "uuid": "7b742a2a-20d3-4b72-b011-260d60e3e3d2", "comment": "Malware payload (Quakbot)", "value": "0cec1f5a70472cb35bfbf884dc0c93fc42dc650b10238f69b6ff5141ccd23f37", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659173, "uuid": "309d9281-8fbe-4809-af2a-0b8bc6732659", "comment": "Malware payload (Quakbot)", "value": "acdb6f4ee1ff36eadc50883918349949551ee122", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659173, "uuid": "b9c238fb-5de4-46a1-b51f-58ffc049c479", "comment": "Malware payload (Quakbot)", "value": "ce0796624b4fc7cbd9a8c66e992000fb5003ec964f6f0913bed102045f106434e091e27ec7dd7dfe89469a50f208c7de", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659173, "uuid": "1319cd4b-fef4-4b71-b893-99031802f87d", "value": "8774BF7DBB16DC23E2681BB062D35B581A53DAD63250210A1AF19F58ACE73A47C37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659173, "uuid": "5f054dc7-c3ef-4814-b305-603a1618bc34", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659173, "uuid": "cf8bc96f-409c-4e39-8b0e-ba2c08c2974e", "value": "6144:inQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuB:9FrkNK11G9AEtMxQyOi6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659173, "uuid": "2888f07d-cbd2-4721-bae8-01a68372b8c1", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659173, "uuid": "ed7efa2b-72cc-4585-be49-0b6638644754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659173, "uuid": "f9d5d4bc-0444-41f3-97ee-76a74ee40770", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc53228-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701444, "uuid": "38565b36-03f8-4793-9deb-4c77e3215546", "comment": "Malware payload", "value": "000e66caad164c5732a7eac264f03cb6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701444, "uuid": "e2e31da6-6cc8-4627-9250-be9fb73915c0", "comment": "Malware payload", "value": "0d0c9e1f238b3e7f50f10531569176a5dc1aa35c2a712f520a442372fe4c26c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701444, "uuid": "9edac465-226f-4a71-94eb-1704584b2e56", "comment": "Malware payload", "value": "e647ed75ecccfb9c9a63e5b7f806337fd67b977e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701444, "uuid": "2b6c393e-d4e2-48dd-9dc7-9b98f0a58fd5", "comment": "Malware payload", "value": "eb6cdc796fec1ec469892f7feed802b5dfc936c995854addeab8187980501fd9e1ade8c31b3f689e084c5063b90db076", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701444, "uuid": "c998facb-2f57-44d0-93b3-40b9d25ef70c", "value": "6D3301C8C689D37698F17835EC79C701D968AA5E0817856583F34BE7BC07DA01B4ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701444, "uuid": "b0996e24-0d2e-4c6e-92c9-c9d7cde975f8", "value": "1536:0FugXVpoD8ZxhrLAuNS07MrxrKsYZh+WT+:eq41rLZNkZLY3+Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701444, "uuid": "674f921b-a733-4edf-bd41-53b97904e8d5", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701444, "uuid": "bca6f0e0-7dbb-40b3-87c6-5b47df946a74", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701444, "uuid": "5d5084d1-bcd3-4b6f-8e0a-2dd9f458d861", "value": "catalog-386388686.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc696fa3-a8cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619687882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687882, "uuid": "e41eb021-f300-46e4-8c38-42783934d5c9", "comment": "Malware payload (Dridex)", "value": "a23072fa1013a428d64cdf1064545705", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687882, "uuid": "3b1f7180-4829-4dcd-99dc-053e101d9aef", "comment": "Malware payload (Dridex)", "value": "0d18aad54475f8174f75869242e481af421e70b118bdd79f0da35471b6830746", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687882, "uuid": "1745e1cb-7fe6-4b62-a70c-a2b84996bf20", "comment": "Malware payload (Dridex)", "value": "53dc859816c020a3a381c26136710997493270ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687882, "uuid": "260b4981-3961-4cfe-9733-f2debfc61773", "comment": "Malware payload (Dridex)", "value": "397edefa30bcfa8ff55d1e0b81573e3770da53c02f244b69f50f05d3f1b966a1b2dcd022e9bfaae62cbbefbd00b748ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687882, "uuid": "5636d4c7-eb46-4bf6-a783-190bc24ae3d3", "value": "2EF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687882, "uuid": "24665da7-5685-4fcf-93cf-7fb590fbaccf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687882, "uuid": "dfcc1f9c-0d7d-45a2-9386-12e4d05a87a9", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619687882, "uuid": "064f5f60-33c0-4f1f-8b89-56e83ace2ff3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619687882, "uuid": "ad85a56a-51cd-49b0-b559-f26ec53b02b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687882, "uuid": "42b304fd-0d3c-4b85-b3b8-9510e021d80e", "value": "a23072fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7235bb2-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659178, "uuid": "8e133fc6-0d7c-4e31-9a29-576dc91e19d3", "comment": "Malware payload (QuakBot)", "value": "c0dabd37464c871621ca299ed70b85b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659178, "uuid": "15248b1a-3ce4-4c9d-8b50-ec095e9df84f", "comment": "Malware payload (QuakBot)", "value": "0d3bf3280655abdb3e9a75f01bab6f6268ba46ae459c59a90beed6a18d63e912", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659178, "uuid": "6232cc23-68e3-49ae-b14e-6799d318edb7", "comment": "Malware payload (QuakBot)", "value": "2b72cf3865283da08202e491d85599be5db221b4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659178, "uuid": "a956e604-825a-4ebf-950d-925aea7863ad", "comment": "Malware payload (QuakBot)", "value": "1828e4d66b1eebd2631fb52ead90917f3acd8fdb5490d4171d63961a374cc7b157235293eaf79ca0b5c8675acc6232f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659178, "uuid": "f8bd8262-7b21-482a-a962-a37dcbb43802", "value": "7274BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659178, "uuid": "6d3bd47b-b94c-461d-9465-7c925cd78f25", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659178, "uuid": "9acec89b-60c6-469a-95cb-110416600f74", "value": "6144:PnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRut:YFrkNK11G9AEtMxQyOi6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659178, "uuid": "2b2a3f49-b0b0-4628-a9d0-f18b6eb98ba2", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659178, "uuid": "3c6dc336-f7fb-4a1e-a01a-f0cde17df85f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659178, "uuid": "0b9515c2-b549-49e1-8d0a-a86d221ffef2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f8711b-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699781, "uuid": "7d8069eb-e0bd-4b42-bc88-b39bcccda996", "comment": "Malware payload", "value": "3f0f7fa12a355a1be65d04c0d227bcb4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699781, "uuid": "fe1a9c2c-408e-437f-ad83-edeacd729670", "comment": "Malware payload", "value": "0d3ff1495704061f477d1ae27d1d46ef0a17677a4e270c52f5376e33b6688da4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699781, "uuid": "582ac8f7-6dc8-4c21-a612-333671372060", "comment": "Malware payload", "value": "3b6f870ee24da4ca9ae09fe447d0b1166c6773c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699781, "uuid": "9ca50974-206b-42b9-9fb3-ab18e58cf8dc", "comment": "Malware payload", "value": "109007a225555f8894d00ae75024bcec9902475b2a02f3565b2ab7655e096113f1b0e47ecf33ede2aeac857eb0c720f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699781, "uuid": "61770c84-1be3-40a9-b340-911840b91ec4", "value": "1E33F188D68DD33294FA35355C3ECA01E5BCAA9B4816C56281F78ADB7C07D941B4BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699781, "uuid": "fd3ed09a-29c9-42b7-bc5b-3cc147596d90", "value": "768:7wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2h:6FugXVpoD8ZxhrLAuNS07MrxrKsYM9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699781, "uuid": "bde7e22d-b8bb-4e33-bd04-a35e88f74e20", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699781, "uuid": "686f49e0-a763-456e-8d4e-63f56b246e76", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699781, "uuid": "e210024e-7b0b-41da-b530-d2e7fa254580", "value": "catalog-1030908982.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dbcd64-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707083, "uuid": "e40a6438-652c-4a72-a43a-949cc8d58e38", "comment": "Malware payload", "value": "e9daf4836fa5f3d1d8ac9f68f19e897e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707083, "uuid": "5bcf24f0-a446-4d3c-af12-5180cc4f7775", "comment": "Malware payload", "value": "0d46d22fb8640461cdab5c429e366ba1226350d638ac14be081a20af7c8975a2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707083, "uuid": "537f742b-3208-49a7-b882-4594e67225b3", "comment": "Malware payload", "value": "1896572dbb887f735aa396952c8f425673512803", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707083, "uuid": "5faa00ab-5e14-40a9-9f52-e8e34c9e61e5", "comment": "Malware payload", "value": "d54fdcf7f636e95f34854f77de9650b7707a17deb7c0f7473008ee5c2870890b991a0d47e8440f33f5c058952e9961a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707083, "uuid": "dfc9b38d-31b7-416f-88a2-28d457cedb23", "value": "10330219589E7629533D20F04681DB4EE9536CAA3C6DC9416CCCF8B9EC092A5127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707083, "uuid": "e50aa8dc-5b79-4ebc-9591-e3f7217cc0ec", "value": "1536:AP6z4+ADViS8CWoD94pUnQ64x11RiCTa+C:2PZBiS8jopkUQ64x8+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707083, "uuid": "6b131409-2c4c-4ac2-8bbe-d89499a90649", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707083, "uuid": "e886c52d-dca1-4940-a1c5-e9ac209c3408", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707083, "uuid": "716cb509-c8c0-4909-b4a0-30c5d89149ca", "value": "statistic-744222198.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e13018-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659182, "uuid": "4ef6f3b5-2fad-41f4-affa-d24b8439b4b2", "comment": "Malware payload (QuakBot)", "value": "f0ad3950092354b22db907bf25fbf194", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659182, "uuid": "36373f2f-f9cc-430e-9ca5-f2e5aaeda499", "comment": "Malware payload (QuakBot)", "value": "0d4734cc04a793c609c1c8b801357479d423c33f93e35c4a1fa2a460a5601b28", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659182, "uuid": "fc636665-9890-41a5-a910-7d56fde25972", "comment": "Malware payload (QuakBot)", "value": "c543d5c31b996c3d6c5f3c9c165034f249c62a3e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659182, "uuid": "90613af7-5d03-4f3b-acee-76e74931bf1b", "comment": "Malware payload (QuakBot)", "value": "051122eb12ace8086c9908d6cc8ae895815e72b87eb9eb94a3e60e27585e578ea6e96796d666d75b0d0dbf9aba89a16e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659182, "uuid": "3f1fa968-2168-4565-ac9f-b924a5f5db44", "value": "45549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659182, "uuid": "3dcb30f1-879b-4392-b511-ca20173f88fc", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659182, "uuid": "73f3c07f-6717-4eec-86d8-be8ab4110769", "value": "3072:T3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZSH:Tvv9sMoXBaRmr/dukbvuZ/7fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659182, "uuid": "9d97d0f5-4d2f-45ce-9aad-b3874ddc4d7e", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659182, "uuid": "463e3400-b5e0-4e5b-b1a6-74ccf242a332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659182, "uuid": "73e269cd-c2f9-4b26-bad0-8e82cf4aea3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8096b03-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707202, "uuid": "0aeb183e-2217-4244-bc8b-de491f185c62", "comment": "Malware payload", "value": "a973ab80e3c0ee055cbc1745a90e0e7c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707202, "uuid": "b856d57b-6551-40bc-a86b-03a6c1a51347", "comment": "Malware payload", "value": "0d4bd9705172916278422cccbd1f7b77d155b6f2183916e52f016764e4dea011", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707202, "uuid": "84efdf05-d6de-4cdc-a3bb-dab22f889b46", "comment": "Malware payload", "value": "7e8a275a52eaaaf0d7960bdc920eb5b316d67de8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707202, "uuid": "44aa696c-b6b8-443d-9ff4-e131ccf5126b", "comment": "Malware payload", "value": "b68495bd3ae0366cc4a9c6ccda0e61ed5dc5cde60da5988d4a4c0ea5dabfbecd2d7c5e63bc608ce8d16dc6b904dd7f06", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707202, "uuid": "c7d06db9-7005-42ff-8cdd-12ff6b2c9dbd", "value": "1A3302299CBEBB2A677D10B04541875FE51369A93C6CC5420CDCB4BAEC093E9063E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707202, "uuid": "ad7dbaed-caeb-4035-8582-2f019802575b", "value": "1536:LP6z4+ADViS8CWoD94pUnQ64x11RiCH0A:bPZBiS8jopkUQ64xdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707202, "uuid": "4ea6c1c2-4fe5-48e5-976c-be2bf9f39385", "value": 51484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707202, "uuid": "8ac9a515-50fe-4aca-9032-0417d2a1534b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707202, "uuid": "d0338545-2aa0-414b-b6c9-7d7c79fa5b2c", "value": "statistic-80965108.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca2ad6b-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659187, "uuid": "99284042-cbc7-4c7d-9c7c-5bc3f352e164", "comment": "Malware payload (QuakBot)", "value": "77981d824827049854e37fde12ee8b82", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659187, "uuid": "9ddd76f5-c7b4-42d8-b107-a7af3c82bd7c", "comment": "Malware payload (QuakBot)", "value": "0d515ecf43b1671fc573f3556557a6af56fd0a1daed761139c8222b7138cf782", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659187, "uuid": "475c0677-bfcd-44a7-ba06-5a5d45362d6a", "comment": "Malware payload (QuakBot)", "value": "3ae9895377dc5a261eb903d63c7b8e8fad309f99", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659187, "uuid": "f2817e3e-fb5b-4eb6-95cf-17529eb296f4", "comment": "Malware payload (QuakBot)", "value": "eecb37e552354ea2dac6a73ce227e276e8e200043ee76841f7822ba46e58ab67d5ade854f31990ddcf44d3735b425258", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659187, "uuid": "f0172c60-8fbf-4d13-bc17-9f154ce284c5", "value": "9A549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251A55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659187, "uuid": "9b813bcb-6b57-4cd6-bb46-42922ae818ee", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659187, "uuid": "f80c7c1f-ce0a-4bda-9356-d1846dede9df", "value": "3072:H3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ9b:Xvv9sMoXBaRmr/dukbvuZ/7fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659187, "uuid": "d41b9151-1332-42fb-8af9-eccb8c61b378", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659187, "uuid": "51fd0ea8-7803-4465-afd0-07249fcb2dce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659187, "uuid": "6c77b456-a2ab-40fe-80f0-656fe0483898", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f03778-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700790, "uuid": "10408b9b-7ab4-4386-8f60-874797d76d25", "comment": "Malware payload", "value": "0cf1f043b62545bb9b70811b5cc54829", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700790, "uuid": "2df15816-bc51-408d-b617-f4f69341fad6", "comment": "Malware payload", "value": "0d66301a5e9d3058a0b669fc6ac86b2b7bb76c921d32e1502a088a7831484f55", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700790, "uuid": "3e362544-930b-4b59-8d57-3635f81d694b", "comment": "Malware payload", "value": "62c0c6036127d71aef71386d7f72506ddca28c39", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700790, "uuid": "b5ba167f-680c-4095-a135-61ff6e0d7c96", "comment": "Malware payload", "value": "f1619d5be89fa21e54517986f069eaeaaa5e356595836ddedd4be5f685a49648ab9c84104e3452ee77c79fe067aaf66a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700790, "uuid": "946b70f9-861d-4b74-aadf-204c2801a98e", "value": "1B3301C8C689D37698F17835EC79C701D9B8AA5E0817846183F34AE7BC07D901B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700790, "uuid": "23ca3028-9879-44ae-aca6-60a66d80ddc6", "value": "1536:DFugXVpoD8ZxhrLAuNS07MrxrKsYXh+WTe:rq41rLZNkZLYx+WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700790, "uuid": "d383855d-8007-4297-952b-7e684284067f", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700790, "uuid": "bb952b03-c96e-4691-80d8-7cd548eaa967", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700790, "uuid": "82fbf10f-cd28-45c1-a83c-9e9ce59db220", "value": "catalog-1822578906.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83074f1b-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701932, "uuid": "fed4be48-c338-4349-9a65-9a22507d3c71", "comment": "Malware payload", "value": "06d0ec67ca72fc96e473dce5a81d0469", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701932, "uuid": "73ef3d6a-1a7a-4714-bec9-64e26ac5bc9b", "comment": "Malware payload", "value": "0d6dce11cd8262004e9028a4fba6ff5f6546b77636457c1925b82349e1a56453", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701932, "uuid": "52c87f76-5fad-4783-b97c-42f38efcbff1", "comment": "Malware payload", "value": "2a3c75d53893cf59478851bf9d5e2d45f78a8479", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701932, "uuid": "3c039858-390e-4b50-8b4b-203e1af5b219", "comment": "Malware payload", "value": "e033f1338bda66a8c6bed961af63062fa28a54f19cb2fe253c23020fd6a4cf22ba0660ae14bce1a97c0d8d7fd9356bda", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701932, "uuid": "edbae36f-69a5-44b4-820b-c2b6af707cd4", "value": "7A330188D9C9E332E8F575306C398B01E9B8B9AB04178561C1F387B7AD07D915B0ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701932, "uuid": "b29e8f05-17fb-4238-a89f-a22af46f0a57", "value": "768:ywnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2i:fFugXVpoD8ZxhrLAuNS07MrxrKsY0MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701932, "uuid": "5de61442-8aef-4194-b905-45501fcde48c", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701932, "uuid": "05ffab4d-8435-4a86-8bbf-a9a9cc5df20b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701932, "uuid": "b302670c-eaa3-4946-9a57-96d30df19811", "value": "catalog-760519867.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff670903-a888-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659191, "uuid": "fb7567c8-7f6a-4821-b565-d40a1cb4bff8", "comment": "Malware payload (Quakbot)", "value": "852032b2f2493a1a84b1e304133404bf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659191, "uuid": "6c98c0ed-9d55-493c-98aa-6c5b7188a111", "comment": "Malware payload (Quakbot)", "value": "0d7f0c94960f22c484631784dead58a9b8bbceb1319a379ef499a41ce2678ffd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659191, "uuid": "8115fa66-b932-4a71-a206-305c4e2791e2", "comment": "Malware payload (Quakbot)", "value": "f71c6c31416d201fcca1f3e3d47b0454697b0204", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659191, "uuid": "cc24737c-3fda-4094-82e6-2fcfba00bf47", "comment": "Malware payload (Quakbot)", "value": "652e0475f6f78fb39f2d18a9eb2a90d3291142e5418b844292080e48cd446f35abac1a25539c75389865ce7bcb5a05a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659191, "uuid": "deb64bf1-e3a0-4bbe-88cc-c75a7746e8eb", "value": "6874BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659191, "uuid": "eabbea8f-817c-4dce-ba55-5f384317928d", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659191, "uuid": "882a8901-c7bf-4e8e-a123-061f3fc20424", "value": "6144:EnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuQ:TFrkNK11G9AEtMxQyOi6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659191, "uuid": "a05322e7-0ac6-4386-a3b9-3c67bed29fc0", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659191, "uuid": "1cf1add3-d4fd-4cd5-bbff-f34df82abab8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659191, "uuid": "3fd20e4f-79f1-4795-a7f9-7b1fa1271b1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fa245b-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701528, "uuid": "f176a55f-03d5-4a90-922f-0cc315377a82", "comment": "Malware payload", "value": "2fc65db0fe8562de6570b7a9b60f1ce1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701528, "uuid": "ba998142-4a24-4b83-8c35-dc1e33e2e2c0", "comment": "Malware payload", "value": "0d92b771d91ff17abfe6f104cce2033e28dec7f37a621e2fc5ed23bde57e5d3d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701528, "uuid": "cf025eb2-7cec-41e9-b82d-feb75e43ce24", "comment": "Malware payload", "value": "07329ef129886b054900503047819bfdec159288", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701528, "uuid": "133f4b89-3c90-4843-a3ee-583109e056c3", "comment": "Malware payload", "value": "0d81f4d100e0657742058549f6001a9ccf00b2939565468d18ce7ea21c286810c5f4e344c4e0b8d3af006cfa3946db86", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701528, "uuid": "c8a55067-ce46-4f09-82ad-27e82dd688b3", "value": "C8330289C5C8D336A8F53931AC79C702D578AAAF481BC4A281F34AAB7D07995174FDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701528, "uuid": "afe65cc5-75c7-4eaf-bc39-11197d855dd7", "value": "768:9wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2M:cFugXVpoD8ZxhrLAuNS07MrxrKsYTnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701528, "uuid": "052569fb-cbc6-4d87-90fe-cd0c7a6c2e4f", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701528, "uuid": "7634eecb-c316-4f51-983b-66d8d91dd198", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701528, "uuid": "d11d6fc6-cdbd-45b6-9277-b673d72cda6e", "value": "catalog-450733522.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ff326a-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702206, "uuid": "9fdc8835-1d83-4e97-a8d0-85886c0eb779", "comment": "Malware payload", "value": "36080e3786b2d67db74c1a0e34d09f2b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702206, "uuid": "3757260f-87d4-4d5a-ba68-00efb4d91988", "comment": "Malware payload", "value": "0da49d5e6fd86cff97fc013f58d79443dc8e07f329bc8ba9ee2251c831a2e7d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702206, "uuid": "10773b4a-8380-4991-bfd7-91dfbbd11171", "comment": "Malware payload", "value": "2c60c0428e23f3289c39743322580fe6654c08a6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702206, "uuid": "a6e66a56-305a-4d74-b53f-f313b7aaf37f", "comment": "Malware payload", "value": "9e3ea30fb58cc2181e5b0324cbd2bd1620573a5fd455a8d10518d9dc3dbadd49efc143c1a918b9506299520a4d89381f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702206, "uuid": "00510377-1c69-45a5-a9d0-9d1412b2ca16", "value": "F2330188C6CDD335A8F67431A839CB01D934A9AB0817C46582F78AEB7D07D951B4E9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702206, "uuid": "a7821b83-6148-4a0f-98a2-28ece15ad07a", "value": "1536:D7FugXVpoD8ZxhrLAuNS07MrxrKsY+kE1a:DTq41rLZNkZLY+ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702206, "uuid": "fca4d390-f7f1-4a2b-a112-a1bae8486879", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702206, "uuid": "2d4b77ba-7711-49d1-b3c9-d288140a7a07", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702206, "uuid": "e3277463-ed81-42d1-bf0b-d536e06ba931", "value": "catalog-976731444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2686c1c2-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703495, "uuid": "d0cc4b92-843f-4845-a943-45da20f8b10c", "comment": "Malware payload", "value": "a277e8c9a1265f0846abc727ae9c06d2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703495, "uuid": "296b976c-f6fe-4d93-9557-e24557e35aec", "comment": "Malware payload", "value": "0dae18164981f8f01398d519b733c1cd8257fa1be19a3f7167d2756254d1524e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703495, "uuid": "074ea2a6-ee30-4a98-b393-af112b16959f", "comment": "Malware payload", "value": "9e43fe5ac8d750c2964e37c8bdbdb3cbb82e6323", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703495, "uuid": "9eba5c25-3306-4124-856d-b11a7f2cb40a", "comment": "Malware payload", "value": "6f00a7dcacc3205f5ed583ae331c3f0c9d652beb02d454dc8d5c5ef9e68723c976d213f45f28acd82d02d56301f604ee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703495, "uuid": "ca4f0f73-4794-4d06-b609-9d062a4c5e54", "value": "FE33022A4CAE3B2D637D10F08686C75EF50764DD386DC5811C98F4AAAC06AE9127F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703495, "uuid": "035315ac-1fc1-4382-9752-ffcef3e93fa6", "value": "768:V9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiC9XB:wP6z4+ADViS8CWoD94pUnQ64x11RiCTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703495, "uuid": "517bc4eb-86a5-4f5e-a0ed-bea53421a463", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703495, "uuid": "c4ff4847-7d22-4ce3-8bb2-d1fdb157cb25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703495, "uuid": "cfda7391-4410-45e2-aba6-2310c36c36c7", "value": "diagram-1954244894.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022dd7ed-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659196, "uuid": "966dc8d5-8aab-4822-bfe7-1a42008cb64c", "comment": "Malware payload (QuakBot)", "value": "754a1f7fff4f4d3464d8c48e98e3fd67", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659196, "uuid": "f5129fa4-c41a-486e-9393-da8b5a4a73c4", "comment": "Malware payload (QuakBot)", "value": "0dc523f56833d5a8acfb893334f34bedf9d38ffc0ffbcc5f419ff666fe1dde2f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659196, "uuid": "e71a084f-eafb-4b2d-ad27-1fa5b178bba5", "comment": "Malware payload (QuakBot)", "value": "4f7d7f52efade530d39ce883cb454f1d8ab9ed71", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659196, "uuid": "64c16813-e954-43ac-8334-d07922d6a5c4", "comment": "Malware payload (QuakBot)", "value": "10e294550add826ca6fa380bca72fb7345c078d4c9ceb35432b17e283373757984b3e9c8d3e8098429e24edfd2bc0b8a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659196, "uuid": "2475c86e-e49f-429a-9651-fc713f975506", "value": "2E74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659196, "uuid": "cd488fc1-d2d5-401c-8211-248fa9c1f876", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659196, "uuid": "8765dac7-b6fe-4c5c-aa63-488637f04896", "value": "6144:rnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuK:cFrkNK11G9AEtMxQyOi6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659196, "uuid": "c33c9051-a226-4407-879a-726fad5b21b2", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659196, "uuid": "29fc3830-b4d3-4863-83cf-10af4ac14c33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659196, "uuid": "fe117e17-9a24-49e3-847b-29bc0d12e24d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fc8f32-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659201, "uuid": "78a74e0e-d22a-4f7f-bf75-a0b482f9eaa6", "comment": "Malware payload (QuakBot)", "value": "cd8047343a67353f2def41c307d9e235", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659201, "uuid": "de984722-df96-4f41-bcbe-c178f08241bb", "comment": "Malware payload (QuakBot)", "value": "0dc5fc174e6a03cb7bcbbb0d61dac6ec0e6c45a41a4b5ef3b1d2cc77284fcdbe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659201, "uuid": "93631f87-3bdf-4c9f-9cb4-6a5b05c1fc39", "comment": "Malware payload (QuakBot)", "value": "91ab3c387e19d7ae9728cb12c63f3cfb0e75b3d6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659201, "uuid": "8fee2935-0fb3-4c9e-8a26-c45a88b49d93", "comment": "Malware payload (QuakBot)", "value": "4eab8c1b6adcd2789102985a82c90ae30516b8bb7dd36b857f3d7ddf54c4ba0142935d23a04770e43b582a1737d58ba3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659201, "uuid": "ae668de6-4bf9-43ba-b553-1daaa333e8e8", "value": "7574BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659201, "uuid": "6ce59303-d8e4-4b7e-9ed0-28f3f9458c47", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659201, "uuid": "0a4c32bb-e191-4190-a2b3-84341d0be526", "value": "6144:JTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuXj:Jbi7/xZrkNK11G9AQyOi6kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659201, "uuid": "e65c111f-f148-4655-9cf4-d6dc7b522c34", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659201, "uuid": "ffe888b5-5043-42f9-a850-0bc9e0835f16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659201, "uuid": "3c533d66-bd9f-4db0-bf4a-524c2b46998b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5672ed-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701436, "uuid": "a1962ec0-5983-478d-be20-4842077b8438", "comment": "Malware payload", "value": "88eb7d81cd165a642899585523640b94", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701436, "uuid": "0d8e082a-1e34-45a5-8834-b8db1b344acc", "comment": "Malware payload", "value": "0dc90eac475b86cadfa485069979c076fad589f1354927d1a98ec39e402b7d02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701436, "uuid": "67ec39a3-81ce-4b8e-90d2-2f449191a77e", "comment": "Malware payload", "value": "d49c7f2b953129fdc40f20bd5c91bf987c809a30", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701436, "uuid": "9f6571d6-1daf-4c1c-8b7c-3d5329a5e516", "comment": "Malware payload", "value": "273ec824f6c529783783defdf09ce4995fa2eaa433f311093b1540416ad7611d283e5f075db671c61f2a1c7327804d2b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701436, "uuid": "78c4ccba-af20-4f6e-a3cb-6d4d87a0a0a1", "value": "D433F188C588D372E8F63531AC79CB01C5B8A96B4816D5A1C2F78ADBBD03ED5170ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701436, "uuid": "e6e190a6-82bf-4aea-a976-fb6dd23af0e0", "value": "1536:VFugXVpoD8ZxhrLAuNS07MrxrKsYl9hmp:Fq41rLZNkZLYlvmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701436, "uuid": "8683bb66-ca6d-40e0-bd5b-2c83bfa07e07", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701436, "uuid": "75f2dd4f-80c7-42fd-85f2-da1dbb725bbf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701436, "uuid": "5c5aa458-e168-4add-8e25-5025b6f826c7", "value": "catalog-380387980.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16816e95-a928-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619727520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619727520, "uuid": "f3292d9e-148c-4606-b606-ec20edf88ed5", "comment": "Malware payload", "value": "036ea918fefcecc450b92904a0d77d35", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619727520, "uuid": "528dec3b-574b-4a24-999c-568344c7158e", "comment": "Malware payload", "value": "0dcd4243c0fe00bdc98370380135f406d51a2f948bc6b57618690a974124a97c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619727520, "uuid": "a5e34540-a543-48b0-92f0-4bba57f77130", "comment": "Malware payload", "value": "959a49192a55773ecd300933e0e9389994d69236", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619727520, "uuid": "8a432a19-f812-4878-8ed7-d3107d33b980", "comment": "Malware payload", "value": "4727a2172a6c90a6d35ab51405c6c45ef7ff38f75d5241bcecda5786b2f9890ab846ac952f05b7fc1f0458864b26002d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619727520, "uuid": "16fa0933-bb79-412e-886a-984714c1a9b2", "value": "27862342E70EE523E477983746B70A6211864C455A45EB220A5AF33C7DFBEC09BD9FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619727520, "uuid": "0938235d-e801-4d91-9e95-c01ed8abef91", "value": "196608:l4g4gFTp2dIIb55kuWfbnLvVW0HIry3hJ7jIIry3hJ7jiIry3hJ7j4ICN:ljbF9CIIsuWfTL5o23z23923If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619727520, "uuid": "66ab41ec-8daf-4259-adde-02015387e86b", "value": 8004932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619727520, "uuid": "492ff964-8341-46be-b022-f622bcecf997", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619727520, "uuid": "e1114b11-4d0d-4ad4-adc6-dfc31a3fe66c", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c70f61-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702279, "uuid": "5eeab4ae-cab4-43f4-be9e-4a30496cbfe1", "comment": "Malware payload", "value": "8f0743b95a14f8d11109e8a07d8a464a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702279, "uuid": "fa9a1434-2279-41b0-af3c-131144114661", "comment": "Malware payload", "value": "0dda2198649b5d60ed63da6690f922f2096950fef7eaf9309de60d5c62ddee5c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702279, "uuid": "b879cfe7-74a8-4106-beea-f66877a32e47", "comment": "Malware payload", "value": "cfe5715cad24f6ead834eb8e93662f5865cfc66c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702279, "uuid": "ca318c93-7ccb-4a73-aff1-19b11ab8aece", "comment": "Malware payload", "value": "8ad85ee95b765da7eb3011cb69beaee95bdd60144e449791fff6b878492bdd0483b8b0d56da1296d7dd92e4fd7fc24a5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702279, "uuid": "a2a364cc-59ba-439d-be17-6a5a1f9854c9", "value": "6033022A4E6FBA29172D20F08588C74EE54B689D387DC5D11C8CB476EC0579A063FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702279, "uuid": "1a741e28-6777-49d2-9080-1a796d8433a4", "value": "1536:KP6z4+ADViS8CWoD94pUnQ64x11RiCX/N:EPZBiS8jopkUQ64xl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702279, "uuid": "c97f26a4-03c9-45aa-a450-4b198287615b", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702279, "uuid": "eed9e25b-8c86-41d7-8d13-b3a39aa4894e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702279, "uuid": "c10d1e14-462b-43b7-ac0a-15583c0070f5", "value": "diagram-1029565263.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5045a21-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699896, "uuid": "0a9c746b-c1fe-4d14-8e9b-7dd777e518b6", "comment": "Malware payload", "value": "843b2dd62462cfef235bdd3f2eba3b80", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699896, "uuid": "a3ed04da-6be1-4f90-9d31-6caacb91a77a", "comment": "Malware payload", "value": "0ddbb0973d78e2163ecb357a2f43ee390d51b71123c9364de178fbad0342c67d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699896, "uuid": "404a8fa2-f14b-44d0-b060-f78518dbf886", "comment": "Malware payload", "value": "0d275db1afd1ed29f5c8a67bf62ccb59ec002ecf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699896, "uuid": "d89ac617-f86e-4252-a847-e805e8019a8a", "comment": "Malware payload", "value": "8ee33c5828c80bfe71c61f528f8e584998f4a22514e0e25375c565b69d1ff5efd4d5ebd8323cc3b9eb410e438ef817f9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699896, "uuid": "4e90915e-f5d3-4344-9e1d-7b8c07fd8c4d", "value": "FE33F188C6C8E376A8F17831AC78CB01D578AABB4416C5A381F74AE77907DD11B4ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699896, "uuid": "27c6fe55-178f-4802-803f-b2efaa4d2058", "value": "768:3wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2f:OFugXVpoD8ZxhrLAuNS07MrxrKsYqUPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699896, "uuid": "bfeb53f8-d0cf-4c6b-9cb2-091500045970", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699896, "uuid": "199b3ec3-ae36-418f-8b51-a5e252b97741", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699896, "uuid": "db339d41-768a-4251-b8dd-dcefacdc5c5b", "value": "catalog-1146512737.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038fe27d-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703007, "uuid": "08fbb5e4-808c-46df-88d9-99da3247a52f", "comment": "Malware payload", "value": "2b677e968b50bc8f8003c995e1d506f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703007, "uuid": "632b3e75-e7d5-4eea-8c62-189b8cb90269", "comment": "Malware payload", "value": "0ddc9611fe29b2b7dd8106c71bd09329543c65450223aee63cef7d47bfd10a55", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703007, "uuid": "cb5b82c0-172a-4738-8db6-aa36d44052cd", "comment": "Malware payload", "value": "205b1d30e79150ec4f538a804b194f1dfb5229e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703007, "uuid": "3cc85b2f-8e26-4f8f-8cca-606bd718e4f0", "comment": "Malware payload", "value": "48cbae83d302d36f9dd8122228c3247b909430a111d95111ef3d5419aafa3c18bd234559ae775a6cde21420a70f0964f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703007, "uuid": "475e8b33-bafe-4788-9940-10cd0f44a9ad", "value": "ED33021E5CAE3A29572E10F085499B5EE51718DE3C6DCA821C8CF4AADC052A5127FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703007, "uuid": "722db3d9-84f7-455d-b960-28393016d272", "value": "768:69cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCPgj:jP6z4+ADViS8CWoD94pUnQ64x11RiCYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703007, "uuid": "02cf7370-ac78-4ee4-bea5-6e6ea435576c", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703007, "uuid": "fd82de46-22e3-41b1-8b38-ebf8d40ea530", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703007, "uuid": "10367326-e825-4160-bfb4-74f2243f8b38", "value": "diagram-1651302801.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4129a6e2-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707405, "uuid": "e9b17f41-da3a-472f-95ef-284d0068d35b", "comment": "Malware payload", "value": "4f0a5ad462ee862a791c38186aa68753", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707405, "uuid": "d1d82541-5cb4-48af-bca1-f5cf57d05c74", "comment": "Malware payload", "value": "0dfaf86f493c1b259eaaa280254d44dcb0e5abada7e0981fb1464dd25a44c8c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707405, "uuid": "a8638ddb-3e49-4a61-9d40-a7a56c1e4adf", "comment": "Malware payload", "value": "6abe6a1899cff3bb04f88e671823aee9e937ec5d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707405, "uuid": "dbbe2fba-7cae-4717-b32e-94cfae814218", "comment": "Malware payload", "value": "90c58168dd045799609f4a1feeca3172051c2ac386a9b6cb09be7b727d0a12afe403505bbea840b69775ed6bc403a767", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707405, "uuid": "5a988a65-b2a8-4eb5-b341-fb50ce9710ef", "value": "2A3302195C6DB52D473E20E48584CB0EEA4B58DE382EC5421CCCF4A7EC02699253FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707405, "uuid": "579081e2-0672-4322-b55d-87ed10f0f488", "value": "1536:uP6z4+ADViS8CWoD94pUnQ64x11RiCLVxr0:wPZBiS8jopkUQ64xHxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707405, "uuid": "24608644-a8eb-4627-aac3-429b7a4e8e72", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707405, "uuid": "d872fffe-dc87-4afc-9701-e5d11ea7c775", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707405, "uuid": "5999dbe5-89b1-4e18-b884-398c54731a7b", "value": "statistic-952567113.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eecf2f8-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700637, "uuid": "30098c77-a971-4eb4-beb9-f112f14d2419", "comment": "Malware payload", "value": "53ce258d3f0717aaf0d98187dabfcf71", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700637, "uuid": "b66a4e69-815f-4c8e-bc2d-e0f82db04cbe", "comment": "Malware payload", "value": "0e0a2e4f19a8a90f4642dc518570aea9e6decd8ee33c54b29501b459e2cc7e60", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700637, "uuid": "9b63efcc-1e5c-474e-ae32-24420747453d", "comment": "Malware payload", "value": "bc12c950d1b698a868a5f89ac0132513b86fc595", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700637, "uuid": "0110943d-f833-4efd-8d15-e7eab07a979b", "comment": "Malware payload", "value": "a10802a4d78bfa2aa601943ceced0e4471e3e0b3262efda763a2cd0eeedacd77857245328109923c3fdcbd16ddfa1e2b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700637, "uuid": "f6d9278c-6749-42c2-aedd-515e0d6773c8", "value": "8C330248D6C8D372D8F639319C7AC702DAB89A6B0406C95182F387A77C07AD5274EDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700637, "uuid": "0c23328d-1add-43a9-8072-757cee41f133", "value": "1536:UFugXVpoD8ZxhrLAuNS07MrxrKsYS3DBu:+q41rLZNkZLYc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700637, "uuid": "e33e7299-f6b9-48a1-b6e0-e45c9c35335e", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700637, "uuid": "fdc5ee76-5356-4430-9a13-4408f8294eed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700637, "uuid": "d8ff9264-f19e-4f5f-8c3a-bbe14eb8d504", "value": "catalog-1685949916.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fb9991-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704565, "uuid": "391aaddb-ae92-45b0-bee4-618bc0ebfd02", "comment": "Malware payload", "value": "0d45308252d732611e65f75bcdb81c38", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704565, "uuid": "15212c84-52c9-4f3d-bc38-57cd349a5a39", "comment": "Malware payload", "value": "0e151ddd23e21a2be1cd57290ae87b0c2a32dca46d3612ff5f610c6aaf62c7b5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704565, "uuid": "f81deab1-7534-4d82-bae9-2f4852c55ce5", "comment": "Malware payload", "value": "a50362b4316c642825db13a512932b6dd8bd5a4a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704565, "uuid": "f15b0be9-97f0-483a-aafd-8e8b96a5263b", "comment": "Malware payload", "value": "7200f49d721edf968b874d9a13f4d30899a53bd94fb9a6382b0434cdbf5266bda923e28064257e37c20d45de7c0f649a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704565, "uuid": "c0436ee0-af04-464a-b949-1a1ea29b35cd", "value": "A033012A48AEB638172E50F08549D75EE61768DD385EC9812CDCF867EC066B8113F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704565, "uuid": "9ab8e6e6-d94e-47cc-851c-8814989c9c49", "value": "1536:DP6z4+ADViS8CWoD94pUnQ64x11RiCleo:zPZBiS8jopkUQ64xeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704565, "uuid": "232df4d8-0e9d-4961-8080-3970d565b615", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704565, "uuid": "241decc8-6019-44e9-b740-83c43407016b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704565, "uuid": "559c7523-c66e-4a34-a45a-3e52db005005", "value": "diagram-833194557.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13782991-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701745, "uuid": "f4dd69fb-cb25-4e5f-8c99-f2f7c963c332", "comment": "Malware payload", "value": "38f3396925a132e921cc49d422b469cf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701745, "uuid": "99f59a59-2705-4792-8367-ce93430ce1f8", "comment": "Malware payload", "value": "0e16f28d5863aed82b1595d004a35dafc2b208c0323d0c5aca4ce2565ce7955b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701745, "uuid": "0369c6b6-b1f0-48c0-a304-5c1f2a1a3b43", "comment": "Malware payload", "value": "9ff080764a0bdd6f8622518dedc3ab02c381647c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701745, "uuid": "7b3f878a-a396-4821-9a28-b505d3dd7b26", "comment": "Malware payload", "value": "81796d94445f6588406430b66cac7f5e22d9682e94df659b433e7ab802b31b3aea241df8e6fbdf00c1db27231b58c35f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701745, "uuid": "0cfa432b-5dd7-4ed4-b083-29188e0d8cc5", "value": "ED330188C5C9E335D8F47431AC788B02E478AAAB441BC95581F78AE37E06DD1174ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701745, "uuid": "d861603a-c65e-45fc-b313-3cc4b5b3315f", "value": "768:twnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2V:MFugXVpoD8ZxhrLAuNS07MrxrKsYUJze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701745, "uuid": "2732cb57-6ed5-40b0-be3e-a2b3aa20fae1", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701745, "uuid": "9c67ca89-f590-4e23-855e-e0948caf93ef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701745, "uuid": "dfb22b5d-22f4-4ba3-b74c-95421865ebef", "value": "catalog-641885769.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d4d5c3-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659206, "uuid": "3e0b858e-67f6-41cf-a9d4-db50be27f991", "comment": "Malware payload (QuakBot)", "value": "3c9dbe35ad966cc92f6b747fdbc61b26", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659206, "uuid": "63c51400-8866-45b7-a797-7a3b12d033f3", "comment": "Malware payload (QuakBot)", "value": "0e1ceb3159bf9118f11ca37bc4fbea29c53e2650c981d53430ca60e98eca28fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659206, "uuid": "4fd6f048-15d5-44df-acc9-e404b0438220", "comment": "Malware payload (QuakBot)", "value": "f2ab6b30a562c55d3339b3069ef166c5f76d6af9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659206, "uuid": "08b93cf2-ce72-484a-85cb-5b6867f94e63", "comment": "Malware payload (QuakBot)", "value": "f0de3654507ded0e40966deff5cf93aab6eaa142fd217d3c837b7fb87c08fe746e4af5ff6476d3fd042a7b81c155906e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659206, "uuid": "bc3c5ac1-1da6-40d8-91fe-a567c2a952df", "value": "F1549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659206, "uuid": "3193d605-692b-4055-bccd-955574a253b8", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659206, "uuid": "43f43ebb-6ae6-48b0-b51f-757198529b52", "value": "3072:X3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZLR:Hvv9sMoXBaRmr/dukbvuZ/7fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659206, "uuid": "bcf1c7d5-37d1-4b6d-946b-b13dd16383d2", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659206, "uuid": "e16210b8-82de-4920-af12-564f11fedcf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659206, "uuid": "e60fb9ab-2c15-4287-b68e-eef1b1f5371c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2fee4a-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700978, "uuid": "6c9e8d1f-db83-4735-b376-2b76ad2c8b7d", "comment": "Malware payload", "value": "e140fb9c2f50ffbfcbe361d0638557ff", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700978, "uuid": "57a96859-5d4c-47aa-bcb1-c212804ca0f2", "comment": "Malware payload", "value": "0e2af50c58d16556a2ad7018aa1bd9f1d4fe288363aa9cbf608f7491dd57f864", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700978, "uuid": "4585268d-b609-4756-83fe-305f49ef01f6", "comment": "Malware payload", "value": "d7862c14291b4055a4fe3d4e59f48987c96fbf70", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700978, "uuid": "a0ffc4cc-cab7-48ac-bd4f-dadbe2a5b56f", "comment": "Malware payload", "value": "5c1427d3deeff39e2a16f535c806c3b5612e7bdeb7063eb1e118e279dbb0fed570de6baba1fc75b5d9c3fcf2db806d91", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700978, "uuid": "d94e464b-3923-4d06-8c09-38e42e60d086", "value": "443302C8C689D37698F57835AC7AC701D968AA6E0817846183F74AE7BC07D901B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700978, "uuid": "76f38a39-188a-4795-aace-e85425bd8116", "value": "1536:VFugXVpoD8ZxhrLAuNS07MrxrKsYAh+WTt:Fq41rLZNkZLYG+WB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700978, "uuid": "2182baf7-3cbe-413b-862e-85b79347ba28", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700978, "uuid": "50e69120-77c4-4b31-a77d-f828e5896b5c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700978, "uuid": "1d54c729-30d5-4a3a-b046-b4625f6b4b5e", "value": "catalog-1985020701.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aba1a61-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659210, "uuid": "93d4a477-e160-4488-9e7e-3f5100cb9a8a", "comment": "Malware payload (QuakBot)", "value": "75217fd28388b12a15d0d92c9f145561", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659210, "uuid": "2f872755-b1f2-4160-a8f6-5735e806ae46", "comment": "Malware payload (QuakBot)", "value": "0e56e11053bbe16423fc1f3edb99a36a300951258127c132ce82ac3d1596f515", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659210, "uuid": "9c59d2d9-5130-44fe-bd59-1cb93ca5ccc7", "comment": "Malware payload (QuakBot)", "value": "f432dc881082d312ecbc77fb9b2e30bfd705ddda", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659210, "uuid": "6f0315ec-73a4-42fa-a15e-96e60e239147", "comment": "Malware payload (QuakBot)", "value": "4178b8867616e6b37598b9e88a569e2465b624a76cf26b5a96875e39db074aca892ac8af2bdc8a4e6fc4b0a100df73bc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659210, "uuid": "c0138386-46cc-4072-a3e9-7abf07ea3767", "value": "70549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659210, "uuid": "28d23f00-17ee-48a7-9487-283fc187fc8b", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659210, "uuid": "9180f4ed-a4dd-4d0b-bc73-5a7637404ee3", "value": "3072:/3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZvf:vvv9sMoXBaRmr/dukbvuZ/7f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659210, "uuid": "3f9d5c8f-2bf2-4171-9999-1e40240dfb4d", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659210, "uuid": "ac16230b-d09c-40b8-8926-d3008c008508", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659210, "uuid": "d2f2cf96-febe-40f0-95ed-df00ca0e4f76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10666330-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703888, "uuid": "cf0af11f-2656-45a8-afe3-e496ef76a784", "comment": "Malware payload", "value": "627f37c33803323984db5f263cb862f0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703888, "uuid": "44ed2ddf-1a2b-4ecf-9f61-9ffa52577b22", "comment": "Malware payload", "value": "0e60bb53562da2a379698b782254b899f122d04252809b8b939c9207ac1f26d1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703888, "uuid": "4ff7f7bd-aade-4f50-b94b-d3a379f32a65", "comment": "Malware payload", "value": "5f876a527ec2ce1bbfe1ca638f43d059b69d6279", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703888, "uuid": "c3a751b8-7cdd-4372-865f-eafc3d3e7350", "comment": "Malware payload", "value": "c2a7d1dd66b847d47ea91dd4268e505347f63a18fe966e248bc8edaf3a0f08e66be0314b20318f9ba5aca294282fbd47", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703888, "uuid": "c05c8bbc-fd61-486c-be7c-ce8f2f9ee4f9", "value": "84330129889D7A29933D20E085859B2ED153749D3C5DC2956C9CF4AAEC06AED027FB3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703888, "uuid": "589f3c19-9c1d-4eaf-b7d8-4b2155fe24c5", "value": "1536:LP6z4+ADViS8CWoD94pUnQ64x11RiCKhDpR:bPZBiS8jopkUQ64x2pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703888, "uuid": "dcf6abff-940a-4886-96a0-e259fa5c1a4c", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703888, "uuid": "4f2fface-b4d6-4750-98fe-91c8c07ebb96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703888, "uuid": "4e08c5d7-2a55-497a-b722-ff91c1da8688", "value": "diagram-308783782.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05debafe-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702152, "uuid": "9fdb17ff-9e10-4339-a4ca-d3a3726b3547", "comment": "Malware payload", "value": "47a6ba41bdad080722bd3e813f443e11", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702152, "uuid": "a2257040-eeb7-47a7-be2d-9079022da93e", "comment": "Malware payload", "value": "0e996c79541ce8723e974fd3799b1f1949a4407ef4017e33a90ef391b8bd0bb1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702152, "uuid": "60927bde-d582-4166-92ee-63aeb502f3aa", "comment": "Malware payload", "value": "d256de63a823935f08ac9eb9739791aaf01c6fe0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702152, "uuid": "125c59cf-8585-4568-acfb-394ca19b074f", "comment": "Malware payload", "value": "3821681ba6d0e173f7732b54be8ed318cd5336ae526e698b4d2cbf89821076ce46a49ea3d2c90be898954a01a66e49da", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702152, "uuid": "126ca7d7-26b3-4581-bdff-d19b5dd989aa", "value": "8233F148D58DD33294FA34355C3ECA01E9BCAA9B4416C56281F78ADB7D07E941B4BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702152, "uuid": "38d79286-e97f-4d29-9b77-44a23950a729", "value": "768:3wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2R:OFugXVpoD8ZxhrLAuNS07MrxrKsYMWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702152, "uuid": "5b6a419b-dcc8-4e5a-aae6-ee552e98a090", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702152, "uuid": "44899d9f-4154-4ed7-bbe6-edfccdcc7110", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702152, "uuid": "39940b87-5db8-42f7-a53f-5978c2bb9d7c", "value": "catalog-948540924.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b216cd6c-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702441, "uuid": "842cc16b-fde4-4421-9d87-21384e164673", "comment": "Malware payload", "value": "5cc75221e49392d53d719e5e1fae6bf3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702441, "uuid": "0a4551ca-a273-49c6-b180-165b17a437be", "comment": "Malware payload", "value": "0ea3caf57a81d213afe3c92b2359e13a8c9cc4e2433dc8196b491a2bb867171c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702441, "uuid": "05fb02ab-e323-4b81-ba6a-4c479ab8c587", "comment": "Malware payload", "value": "70aff87931eab8a16a2caa336e748e49b103bc5f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702441, "uuid": "93079e27-4fb3-4077-b946-84b15410ed0e", "comment": "Malware payload", "value": "6252ba24e205e3be72895781bc7ba9c5a7909eef27c9e36028eca198c33cc92590448d06de35df37fbffb1e67f811b9e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702441, "uuid": "1287fa1f-a0de-4130-8a4f-b492a6a866b8", "value": "AD33022A886EB639173E50F08549D76EE61768D9385DC9812CDCF867EC066B8013F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702441, "uuid": "9ed01e70-12ce-4f94-9d6c-716e53726771", "value": "1536:eP6z4+ADViS8CWoD94pUnQ64x11RiCUeH:APZBiS8jopkUQ64x/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702441, "uuid": "daac840c-764c-4d37-8492-fca5e74eae9b", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702441, "uuid": "0b9c7776-aa32-49ee-9e33-9d19a226ac7a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702441, "uuid": "cef28381-a430-4deb-9211-128b4316e26a", "value": "diagram-1169261800.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900eb849-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703672, "uuid": "c51a9dbf-80e4-4453-9029-8dfd35e7a03c", "comment": "Malware payload", "value": "82d90b9dd8726ae1b187b56d50fec853", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703672, "uuid": "0341929f-0e84-4901-87ea-225726d90471", "comment": "Malware payload", "value": "0ea8601d69e27a5d60d71097f9b56d2ca9fece7e1ba8fec5ee96c1315465907f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703672, "uuid": "4fcce5ea-3427-42fc-bdbf-23190024e3fb", "comment": "Malware payload", "value": "389a55fd540e2562485bbde65e76394b97b0bb01", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703672, "uuid": "9dcc1dcd-3a1a-4da6-b8c1-4f448625796b", "comment": "Malware payload", "value": "db512c8e0b2c36e560ba0a6e2e3d9bcc0e13de007c244cd0c6870ecc348f11ba424239cde5845a3cc80d724340d82003", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703672, "uuid": "305ea17d-895a-4d25-b6ce-bd770703909b", "value": "D2330129495E7719672D20F08189DB1EE51368DF385DCA8218DCF4B6AC093A9123F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703672, "uuid": "f8a2e044-8289-4c98-b63f-78cebff6abaf", "value": "768:Z9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCtk:MP6z4+ADViS8CWoD94pUnQ64x11RiC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703672, "uuid": "368c545c-0e72-4254-a93c-2005dc01c75e", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703672, "uuid": "1c52486f-73cb-4fdc-9c38-7ecfb3c11e6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703672, "uuid": "917d5699-b210-4143-ba1f-2a0fc0e4cf29", "value": "diagram-2066291423.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052ce8a3-a8e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619698715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698715, "uuid": "747f1d6b-24f8-4eca-8b22-cdde890b01bb", "comment": "Malware payload (AgentTesla)", "value": "138c2a5e33bf947ddc7c971a884a77bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698715, "uuid": "ca5ccb97-8021-4fdb-b36d-fbf357b0cc1d", "comment": "Malware payload (AgentTesla)", "value": "0eac914906ba0b33c1cded6a4675ca21afde0a74d587c06d16c9ed989836469e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698715, "uuid": "4ec5424a-b78a-4010-a638-8b8a42c66eba", "comment": "Malware payload (AgentTesla)", "value": "7d32731878ce9f3e911bded74f2c920ce44d20be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698715, "uuid": "dfc9d1a9-d8d8-46cf-9701-e0660c93c723", "comment": "Malware payload (AgentTesla)", "value": "62c2363665696be75a57be7b5d402a3e9382ad88352b60552c0560d8be22de377b18b3836d744f4fe50a21ea0cf1e6c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698715, "uuid": "d89de593-70ed-4710-a7ad-b3391fdfb772", "value": "7EF47A2413ECCAD6E0AA563430931B1077F3AC16BE67FDA8EDC851AD55326C1B583E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698715, "uuid": "700d1fdb-03bd-4b8a-b41e-5deefa93719c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698715, "uuid": "b32b2ebf-9984-4d37-83a8-14341dba5467", "value": "12288:AKIbYkK+I0BaHpWP2myaU/SQA/sTR3uNOHCA+OKLUNdYpdN:AKIbYfEm0nC/Sf/cuwGKdCdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619698715, "uuid": "e893df03-4d39-4b2c-a7fe-580d60507410", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619698715, "uuid": "8850ac72-1a64-45d6-a9a0-918714ffbfb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698715, "uuid": "94f26897-81e7-4996-893e-3649c7dcf2cb", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9faf04-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659215, "uuid": "920e0f1d-1ebe-4fd9-adf9-0dc41f3d8a84", "comment": "Malware payload (QuakBot)", "value": "ffa0ed5986c9e027ee996504b6ed90d5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659215, "uuid": "707f03b1-08d0-4456-9c73-687f63ff0ce7", "comment": "Malware payload (QuakBot)", "value": "0ebf435e023b80d8266b61cfe5f4575bb78b9782390c737accf54a91e8965906", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659215, "uuid": "365bf77d-1fd7-4fcf-a274-070395d5d334", "comment": "Malware payload (QuakBot)", "value": "c5fb0d6e1608a45be3257c6841280273a739a1b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659215, "uuid": "9df978a1-0199-40db-821f-37beeec099c4", "comment": "Malware payload (QuakBot)", "value": "7cefd407a01eabf58b6113a9b1e3e36506eb503c39f497cc44272e82bacbc17895070a04d9d4dbf742711bafda8a11a6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659215, "uuid": "4d2ba06e-1282-4d18-b11f-a5fad4af29b3", "value": "7274BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659215, "uuid": "baad61a8-6a0c-45f1-a540-9cc8fec365c8", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659215, "uuid": "1856331d-8d67-429c-bb24-cd9e759c5f26", "value": "6144:/nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu0:IFrkNK11G9AEtMxQyOi6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659215, "uuid": "b6682dc2-4581-44c3-b16e-6ec561a28d18", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659215, "uuid": "19f13d64-e0b3-49a1-9be8-6bd6f6ded841", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659215, "uuid": "d9f63d03-899d-444f-9a5f-591376034a47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106ddf64-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659220, "uuid": "06da3838-33a5-477c-8c9b-65d217012b14", "comment": "Malware payload (Quakbot)", "value": "fc03929196c293cd744d683f8a4dbdb0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659220, "uuid": "95501ee7-3c85-4892-bd73-c2db4870b5b3", "comment": "Malware payload (Quakbot)", "value": "0ec10d84044c4e5ce1e7a15be0a9aaba366771f66eb55aa0c33cace47d69b87c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659220, "uuid": "553c2cf1-e5e4-4f53-acfe-629c5296be8b", "comment": "Malware payload (Quakbot)", "value": "0aa8f87f1f56fa9b92e7137eb6ae3597efc35752", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659220, "uuid": "3aed1cef-725c-433b-8240-27ac155203df", "comment": "Malware payload (Quakbot)", "value": "2ef4bca5e17bb95dfb70f494fae0bfde394e65c082bbe5be821babab92b809db10e99c3e9259d0ce27107e5492de40f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659220, "uuid": "4097a90d-ca19-4d18-9281-35d2039fb75d", "value": "6174C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659220, "uuid": "e05379a5-49f6-4320-89cf-f10d0c3f532c", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659220, "uuid": "ebdf9342-e4a8-47d5-b757-7f98d9719d75", "value": "6144:aTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRul:abi7/xZrkNK11G9AQyOi6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659220, "uuid": "74f1ea0b-6160-45da-9dba-255a9853ffa9", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659220, "uuid": "3d50c64d-3559-46e2-9fd8-9ea1e4979a50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659220, "uuid": "66a1e2bf-5e88-4818-aa22-d410256e89c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963ef330-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706260, "uuid": "19503c55-98e3-4391-9c4b-045aa69915c8", "comment": "Malware payload", "value": "c7406465ec3fdd7aca1430817affb9a5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706260, "uuid": "935a7d7b-46ab-4b96-8e3a-dd4bc328acd9", "comment": "Malware payload", "value": "0eccc7449b276190f5a749476f734c55cd3d311159a774900d3f7ae71fc17621", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706260, "uuid": "426a4ff1-e229-47f3-b704-24a2ac0a5885", "comment": "Malware payload", "value": "559f4b071b4cdc0cdf02f8fb6ef9ca2c68cb8256", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706260, "uuid": "e429db38-7bcd-46f4-a207-41db4d9a7b28", "comment": "Malware payload", "value": "b94cb824a0cfd83a37971a7d38a79c64a642a20301891f31206f86cf8bd48e8a35ba8b004e0df897d721c12a00b7867b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706260, "uuid": "cf57eb2d-2c15-4c3b-8147-b1f0f7accb8a", "value": "FE33022A4CAEB62A932E00B48588DB6FE91364DE386DC1515C5CB075EC067E9077F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706260, "uuid": "a641afc0-64fc-4872-908a-3822cfe84c1a", "value": "1536:/P6z4+ADViS8CWoD94pUnQ64x11RiCYNr:nPZBiS8jopkUQ64xqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706260, "uuid": "6defa941-e82e-46ab-8198-f382c4b1a8f1", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706260, "uuid": "f9c3c338-9904-49ee-880b-1305906d289f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706260, "uuid": "efae6805-bf3e-4b96-aecf-60756e9d7f2d", "value": "statistic-229614854.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13338eea-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659225, "uuid": "50a807e5-c57f-4d17-af6e-31812665612f", "comment": "Malware payload (Quakbot)", "value": "8fba170f0c2b40ce545252dd2b42917a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659225, "uuid": "7bc48db4-d828-469b-93bd-9969636eba12", "comment": "Malware payload (Quakbot)", "value": "0ecda6b8292d2dac60090799a59999890c4526a58b2aea58974fb08b0d9e397e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659225, "uuid": "d9d43016-f0df-4a74-8d6b-5902d1083268", "comment": "Malware payload (Quakbot)", "value": "d0200e304b724fbde7126daa5063075c222eef9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659225, "uuid": "c9d78c0d-29fd-4ec4-b2ad-7ede6c748a18", "comment": "Malware payload (Quakbot)", "value": "1efd778994df294101747850c31b519d37a3c9f35d6742a8bf9f08583bb0867e4e4a63cc20a683212d9a2596f2a10c69", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659225, "uuid": "c882cddf-648b-4a5d-bcd8-c7b2a05ba6a3", "value": "7474C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659225, "uuid": "abd205e0-714b-4720-b118-3e4b6404c8e0", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659225, "uuid": "6b8da5c1-0f44-4aee-b30e-496cc749db10", "value": "6144:dTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuD:dbi7/xZrkNK11G9AQyOi6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659225, "uuid": "2eb2b7ae-51f5-4401-87f7-9e96187fbf09", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659225, "uuid": "5676de4b-8250-4a2d-b3a0-af7f781836e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659225, "uuid": "19f381c5-620a-436f-ace7-a0a9c1ea6dd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d50e02-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700726, "uuid": "bef8d588-8964-481d-8e58-45144d7d9ac0", "comment": "Malware payload", "value": "1ed426045009b5098857b27664d6bda6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700726, "uuid": "5e20a7ef-591c-4653-8b65-ed1f8bbd593f", "comment": "Malware payload", "value": "0ed2853a3d62aa9b11cb0f48ead1df30c770ce01ffcef736a27fdce29dd6c980", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700726, "uuid": "5e67bcce-b60d-4315-bd0e-450c4f35026f", "comment": "Malware payload", "value": "7e87fe87f1fe71f12f5aab4376438f850963643b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700726, "uuid": "533b754d-e4c2-432d-bf3e-4878a4d75f3e", "comment": "Malware payload", "value": "a18703a9fe3fe2e7b95e78432eb9047a9b7cca264fe47015f688030866103e18eda4b00766affcaaafa584ce35db4682", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700726, "uuid": "d3907129-7107-4032-b1bd-902c1e128b4b", "value": "443301C8C689D37698F17835AC79C701D978AA6E0817846183F74BE7BC07D901B4ADDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700726, "uuid": "9f0d5589-b99d-4391-b78f-2936400ff398", "value": "1536:XFugXVpoD8ZxhrLAuNS07MrxrKsYSh+WT3:/q41rLZNkZLY8+Wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700726, "uuid": "22b2f227-4b16-41b1-84b6-597fe7e0c696", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700726, "uuid": "29142af6-9e5b-4308-89ff-64c371003957", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700726, "uuid": "7504d9bf-88cd-4147-9925-c68f6242193e", "value": "catalog-1774738093.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c098117-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703880, "uuid": "e86c3535-2219-4e86-8a90-af3d3e6ba4b3", "comment": "Malware payload", "value": "e685479d76523170020961ddb5f37ee1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703880, "uuid": "e40315d9-c8bf-4b84-92bd-0e7c1272f1e6", "comment": "Malware payload", "value": "0ed3d314f6dc23643002095873f2d2b8f12c72507dc194b757894554959e884e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703880, "uuid": "77927b03-5b61-40bb-a78b-81dcec8ab9c4", "comment": "Malware payload", "value": "4ecc9c708571afc6baa1d2ce9783a9e0d7135b6a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703880, "uuid": "cee05936-b521-491b-83e0-3bd836a33691", "comment": "Malware payload", "value": "8067aecc123ac4bc385f607163b439d100e59830699bfbd78133d631fc2e9750a2784e8d56fd67d5c49af44b0346f4ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703880, "uuid": "1247a222-abcd-4944-a54d-16f7515d372c", "value": "B633011A88AD3639533D10F059949B5ED25778DE3C1D86822CDCF46AEC016AD163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703880, "uuid": "a0376c35-e351-4814-a95c-73ff374bb6e9", "value": "1536:gP6z4+ADViS8CWoD94pUnQ64x11RiCBKFmr:WPZBiS8jopkUQ64xuEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703880, "uuid": "7fbb749e-4366-430f-a38c-146110a11a0b", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703880, "uuid": "734092ff-6c81-4651-bea6-ecbc9eba9426", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703880, "uuid": "7a25d34e-433d-467d-9507-9d1b3c5e70e6", "value": "diagram-304494814.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161dbcb8-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659229, "uuid": "bdec3917-844e-4799-9c73-9fdfdac74c20", "comment": "Malware payload (Quakbot)", "value": "600424936e1fa4882972d7ba63d470a8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659229, "uuid": "c6adcdd2-b99c-4db6-9fbd-7ea86f20b97c", "comment": "Malware payload (Quakbot)", "value": "0ed5d26a30cc47889590e5c53a3e53c5a856d7b58d7db22197b960f73c9f7c8d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659229, "uuid": "92c2fdc3-4dfa-4160-bda1-d3639d284316", "comment": "Malware payload (Quakbot)", "value": "ae10c42ef8f200962b6099d826c0178bf6300604", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659229, "uuid": "9dd64dcb-8696-4f21-94fd-eb634a298cc4", "comment": "Malware payload (Quakbot)", "value": "236ea3e74b8ad46d9d1976ae905842cee6da94b5cf56ff02cbe696025d51c41d9a13c5923eff5cf649fa062015cacbb9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659229, "uuid": "837d4339-f49c-497f-b169-731fcca56e5c", "value": "FA74CF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659229, "uuid": "2c767032-daa5-41d2-9a25-42d96796c93d", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659229, "uuid": "19885ebf-766d-4205-8cdc-c6d2e09fc0c7", "value": "6144:MTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRu3:Mbi7/xZrkNK11G9AQyOi6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659229, "uuid": "c6a6c509-735b-42b6-a64a-2c1ce4722d08", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659229, "uuid": "9f0c09ef-c1d8-430c-a381-404707ddd855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659229, "uuid": "ebf3f536-a2bf-43b0-a47e-a06ef143a4ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955172b6-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704540, "uuid": "56f02d58-15f4-41e3-aab6-081ca5d414cf", "comment": "Malware payload", "value": "59552227dcf931e0de0615180bdfd624", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704540, "uuid": "055b1c3b-6c25-4bd0-9cb7-1ec9beb11fbd", "comment": "Malware payload", "value": "0eddd23163f541947d158a099654c265ff8e75159b5b1cff0a76d60a7683a7b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704540, "uuid": "17762030-1d74-477a-87e9-68a72863a008", "comment": "Malware payload", "value": "f959d45861481a9aabf6db09b9db652bb34929c3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704540, "uuid": "bd9d1a9b-f890-4e91-8e3f-426f650161cf", "comment": "Malware payload", "value": "612a86bd550a07d03569414d2abf9d1a4c894eb1a54645f4cc99599058d3208a1f53503bc765c7e857bb8176622b670c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704540, "uuid": "f2d1f0e3-548d-40f0-b49a-170057ecdf2f", "value": "9B33022988AD7A2A533E10F04549871ED65B5C9D387EC5912CCCF8B6EC056E9053F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704540, "uuid": "4dac0566-b04d-454d-a7cb-d03dbe6e733f", "value": "768:X9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCzk7:iP6z4+ADViS8CWoD94pUnQ64x11RiCg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704540, "uuid": "493dd508-5d1c-4210-8ba9-ed4d6a221c2e", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704540, "uuid": "ccbc8993-ad4d-4ef7-8b52-c45587bc63cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704540, "uuid": "99b5e802-b8ad-46de-a28e-410da0e92ff2", "value": "diagram-821753501.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717deea9-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701903, "uuid": "68d18bd3-785d-4634-b4b6-4e674545fd34", "comment": "Malware payload", "value": "cd45e5783399436ec033fe1ca19cc966", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701903, "uuid": "f41c5a14-dafd-45fa-a995-0fd4f2f0cf4c", "comment": "Malware payload", "value": "0ee254775f97ca36464d0ac38e72a51eeca16bbbe9c7270bc13a123cde113a76", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701903, "uuid": "5633fd90-6e54-45d4-9e66-85f005a18406", "comment": "Malware payload", "value": "087946ada0232d82bbf91c92677b7bfde9a566af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701903, "uuid": "787347ec-2c78-4cf9-9162-5227fc6e531e", "comment": "Malware payload", "value": "2642bc99e3d17d26ba7d953413fa7f7c624be62fbe3d108f4bb2f0eb5de9c9cd125701c1b4fb36a84e76663f972ec795", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701903, "uuid": "5994a370-2731-4455-bc56-fe921659b220", "value": "7333F188C6C8D331E4F57535AC79CB01D97869AF082AC5A280F78ADB7D07E85574ACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701903, "uuid": "c6a7a24b-00f3-4d23-859a-f46d7837c966", "value": "768:BwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2t:IFugXVpoD8ZxhrLAuNS07MrxrKsYBIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701903, "uuid": "cd2c585e-e0e0-47e9-9f75-9f334a2a2470", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701903, "uuid": "8e14b9d8-6c7b-4aee-9f3f-6e9ceb797e4f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701903, "uuid": "73858725-6417-4a4a-ae58-81890930eed6", "value": "catalog-748224433.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f56b1e-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659234, "uuid": "0e1b1d23-0b37-4d07-9852-a48125c51c50", "comment": "Malware payload (QuakBot)", "value": "4463afaa1761eef1e844cb201f0f2145", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659234, "uuid": "01052fc6-2425-4399-88f9-0dbe32e0f664", "comment": "Malware payload (QuakBot)", "value": "0eed9b32a84e395663099c21d9d83ec030d9802652171d492174611a88754d2f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659234, "uuid": "faa68534-a88f-41dc-9228-7e6fc9c453e6", "comment": "Malware payload (QuakBot)", "value": "68ec1c7362c6d41cd5d33babc29173195db1f953", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659234, "uuid": "4a64b2e3-08f5-4ae9-a62e-068226616448", "comment": "Malware payload (QuakBot)", "value": "1f91949f32e8eac9545cfe7d8964bdfeb6ca7a8eae20c7d4b5e2116c6194449d07a88ebb47a43e3c68f4b768db739c0a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659234, "uuid": "63b86549-1edb-4456-b1f2-49d22271b03e", "value": "4A549E7AFA12DC02E7A82BF023C36F581A579AD53120251B55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659234, "uuid": "892b43a7-e425-44d8-b613-8eaf80045110", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659234, "uuid": "7ebbc401-57ab-4616-a1a5-615c919c30cf", "value": "3072:A3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ4D:Uvv9sMoXBaRmr/dukbvuZ/7fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659234, "uuid": "a6572061-9094-47de-baca-3c4fda4b180e", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659234, "uuid": "ad70b616-13e2-4f25-af9c-2b4ded679894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659234, "uuid": "6e09564c-e4ce-48ad-b69b-9251e7e35048", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65781d1d-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703171, "uuid": "6f026c41-f4ba-4fea-bf3f-617c6a4589d0", "comment": "Malware payload", "value": "bdf785314f87946b02026d6b40930bd9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703171, "uuid": "381504c9-52f9-47b0-af4a-a01b7f0f281f", "comment": "Malware payload", "value": "0ef797c09dfe8acdb82d15dc7edeaed6128e4ca7c633b1d166b3bd808638bcaf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703171, "uuid": "50170925-9af8-4483-8130-739b171930f0", "comment": "Malware payload", "value": "d62f20d77c0cb34a3c3171b1772c21fb3517a903", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703171, "uuid": "25c67fdc-3184-43e6-bc76-f5012af599af", "comment": "Malware payload", "value": "f16d7be604139f54cec5bad60f07ae43a0516667070b64ffa89637e6781b4feda7a775343aaa5e12461a06fb36a11456", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703171, "uuid": "cb3f6e90-d733-401f-9adc-44cbb7f4a8ea", "value": "313312298C6E761E572C14F08585D74EDA1728DD385DC6831C9CF46AEC056A9123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703171, "uuid": "59334523-b7de-4bb4-83e0-382f8dd45734", "value": "768:/9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCg9U:qP6z4+ADViS8CWoD94pUnQ64x11RiCgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703171, "uuid": "77f3cfe7-0065-4000-935f-1c9e6e08f4ef", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703171, "uuid": "5b617492-31e7-4c79-b25b-f4b1b126586d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703171, "uuid": "27d9c6d2-0d1f-4ddf-89a3-416c12315d40", "value": "diagram-1786154351.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c31d99-a93f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619737446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737446, "uuid": "cd9772d0-af02-41c0-a6f0-1155db96b5f1", "comment": "Malware payload", "value": "64de6d9b108dd2a27f186d743799e89d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737446, "uuid": "914bec07-0162-486b-b68a-6443d3d500fa", "comment": "Malware payload", "value": "0ef7b0101abe1aa554e0d2243f030b8662dcefe5311f07b925adc81408ec4cf6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737446, "uuid": "f1577558-ac56-42a9-8282-abb14b9fbf89", "comment": "Malware payload", "value": "915f5bef43115bf2a1deb2efb91c26e5a35cddb2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737446, "uuid": "67cb9bc2-4064-4cd0-9ed0-6e4eae9965f6", "comment": "Malware payload", "value": "a3a665d1a567f799b48dd491bab6ff5bc4cf540efdf1f61cffa77dd8a29eec1b2a926b16b56a0527f0cc617c60ce1297", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737446, "uuid": "2ebb1ab2-8d14-496d-a5b0-0936d92c43d3", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737446, "uuid": "a5165283-79ca-40eb-907f-8e90be51d1a1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737446, "uuid": "ec420f71-bbc0-4238-a562-b8fa0f094412", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619737446, "uuid": "a958ff7d-b33f-4269-8f3e-6204117943c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619737446, "uuid": "aa8bd7f4-85e3-40ff-bea2-a9ffe8086378", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737446, "uuid": "2961998e-8487-46aa-82d7-80aa15ff777e", "value": "64de6d9b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e773c486-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707255, "uuid": "bd1fd73d-3034-48f4-a523-0056ce596575", "comment": "Malware payload", "value": "a329246c24f0018f223fae740ac6794c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707255, "uuid": "98d20c0a-cc48-4204-8d51-7f75ceead03a", "comment": "Malware payload", "value": "0f1648dafbb67c642af0ef97bd69b54c3403ce07dd9a63f3bb586ed778f44b26", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707255, "uuid": "aa134c91-5190-4451-80b7-324ddf7bfbab", "comment": "Malware payload", "value": "92a5bb097b5cdfbd85a741e05058d2fc5f86df44", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707255, "uuid": "9b8bb0e6-7753-4078-8bb4-b5e603e8c389", "comment": "Malware payload", "value": "beea00e5952fa0ab2d2ff2805c7729be1df7b233bbbc75b03f6c334101276deb368210aeef06205c827a3a2026b0ef3f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707255, "uuid": "10daac66-d168-4a16-a269-3c657649c103", "value": "F333122A5C6EB629877E00F481849B5ED913289D3C2DC2825CCCF4A6DC0A9A8157FF7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707255, "uuid": "e099d276-740c-435c-8806-9189fb504fee", "value": "1536:rP6z4+ADViS8CWoD94pUnQ64x11RiCQS+qMrh:7PZBiS8jopkUQ64xuS+zrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707255, "uuid": "a5d0ccef-39de-457b-9a97-ef845d84d11e", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707255, "uuid": "f98352c5-b5b4-43af-9349-71f2fbc39c00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707255, "uuid": "acb603fb-1f33-4448-8a54-681bc2def905", "value": "statistic-848686270.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be1897b-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659239, "uuid": "e8b09157-07f6-4d2b-9b07-46886869dad2", "comment": "Malware payload (Quakbot)", "value": "4026ac89b515c9382e05f6b6ca669e2f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659239, "uuid": "7552e69c-befe-43b2-bd8e-2d1d85d286d0", "comment": "Malware payload (Quakbot)", "value": "0f1d3577aa4b29dd0914d0d9c16fdc8ea95b10bc942cc915508173a76959eaa8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659239, "uuid": "a676ec37-7081-4fab-9de3-61df2d745ca8", "comment": "Malware payload (Quakbot)", "value": "9c8a1acc5661f9f4446d2210d8bbbdf731505954", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659239, "uuid": "383b9b54-a4bd-4258-989a-e65c45683a55", "comment": "Malware payload (Quakbot)", "value": "13eddb32b60843874f65b5b45ab7b31091d5b746418cea17ebff1cc8e0d7f0d4b98d56d65fcc9d3064c1bef4838fa4ee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659239, "uuid": "76bec37f-d9a6-4628-b314-72e7562ca661", "value": "A274BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659239, "uuid": "660d720b-fca5-427b-9e21-bf72339582d5", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659239, "uuid": "307e37a3-8f93-4ed8-954d-a18e9b1176bc", "value": "6144:hnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuF:+FrkNK11G9AEtMxQyOi6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659239, "uuid": "000fc2ee-bee9-4f1e-a991-10d27c75ad27", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659239, "uuid": "0bd35e71-6613-42d6-aee4-cc9bd0bdfe18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659239, "uuid": "e6f84528-7d7a-4752-a1fb-6fa7e8e0e32b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363a0128-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701804, "uuid": "e520c2a1-4af5-44c7-a784-ea67698b1f46", "comment": "Malware payload", "value": "4be1bac75326ad9ed1329d4a26596b84", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701804, "uuid": "3b94944b-13ad-478a-9616-6e0947fea497", "comment": "Malware payload", "value": "0f1f6e163f821d88e6f3a10eaf6e0ced180bdb3fcf9354a9d6eff2cc70acc733", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701804, "uuid": "a40331f0-04b6-409a-a54c-a2b0c6139989", "comment": "Malware payload", "value": "7bd11a3c32960e2c937e43e9bf7e127e648d2d60", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701804, "uuid": "1607431c-f2b9-435f-ab8e-7ca28e507681", "comment": "Malware payload", "value": "0a4112a545a89ac3fcecd8efe8c2fce0a31633922602cb64479ae6de81c33f073a6635374c614c43c1c4d845c39abfa1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701804, "uuid": "54aa73fa-24fc-4c02-8b2f-62a7ca523490", "value": "E133F1C8C5C9D372A9F678319875C701D478EABF4816C46282F786E77807E946B4A9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701804, "uuid": "6c020393-e2e1-4adb-af2b-44dbb36d9b7e", "value": "1536:9FugXVpoD8ZxhrLAuNS07MrxrKsYoR+7/m7:9q41rLZNkZLY++7O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701804, "uuid": "496e900f-0871-4683-b548-2672e51da151", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701804, "uuid": "ab376a0f-5e7d-4f87-8715-30b04f269c15", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701804, "uuid": "7bf188a6-e486-4e61-976d-82a92a90d474", "value": "catalog-680066791.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631626c1-a8a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619672244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672244, "uuid": "f73287e7-938c-4194-b1b0-239f82dbfc51", "comment": "Malware payload (Dridex)", "value": "417e64ca89f604cd1b985ffba2f8b054", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672244, "uuid": "85eff078-bc95-451f-a4e9-767021a0bf52", "comment": "Malware payload (Dridex)", "value": "0f5596147fd1c2cfcde24572217fc54935a634a19a0a3331ce45fd94cda69c71", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672244, "uuid": "94165e31-03c0-4e1d-8a6c-f133ff370f5d", "comment": "Malware payload (Dridex)", "value": "0e2e2e70f94e13433c76bbc8eb8cd87ad04ec77c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672244, "uuid": "36a10ad8-6e10-48f1-a415-2f8a48fe9b36", "comment": "Malware payload (Dridex)", "value": "bb5f9c5e8115b238a3805c29660f72a5ca1b13fccafd13177c03091be3c8d44bd675718bc6bdf5875818e0e9287a1047", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672244, "uuid": "ccabe22f-9dbb-40f2-a2d4-efee883313e0", "value": "ADF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672244, "uuid": "65104fef-64ad-431b-a51f-f70405d9e269", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672244, "uuid": "2d0ea52b-2b0b-4592-8618-2a3aa60f5f99", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619672244, "uuid": "3af4d72f-1380-4db7-9bbd-def946a557a7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619672244, "uuid": "746f5486-845e-49a5-b7d0-2a012dff5701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672244, "uuid": "6dac0bc9-4c0b-48da-a07b-7ac10820fd28", "value": "417e64ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea55ed6-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659244, "uuid": "6fab4f72-af45-4f70-be07-fc97434ff07c", "comment": "Malware payload (QuakBot)", "value": "eb3cb6d67db93196843b0bb16333e837", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659244, "uuid": "22ff744b-20c2-4470-8913-414451c71495", "comment": "Malware payload (QuakBot)", "value": "0f5dbdfd73241d535bd0cc80744d6a935451be4be15502ce8622864cfb3d7200", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659244, "uuid": "caddb7a5-dc42-46b4-8bd5-4a166916cf91", "comment": "Malware payload (QuakBot)", "value": "3b459b278c29634aa71e6b0b5b19f7f3ab4e6d74", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659244, "uuid": "945bbebd-b1eb-407e-aa12-c03abd5e12fe", "comment": "Malware payload (QuakBot)", "value": "28c33dda19efdc8f33ad82f6576031a00374516b0bf9f25fd0e60cce627e6cbf995e965047361d9fab7d094e3c7add8c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659244, "uuid": "40fd2693-3eb5-4507-a497-2d631095bcd6", "value": "47549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659244, "uuid": "8e17bb5b-94d8-4fdb-a39c-71805f02dc9d", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659244, "uuid": "3d9e03bf-ee29-4eb5-922b-6c84f271e157", "value": "3072:m3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZZU:Cvv9sMoXBaRmr/dukbvuZ/7fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659244, "uuid": "a02a1c94-bce4-4bf1-8e96-889dac947e7a", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659244, "uuid": "919e889b-772f-41b8-863e-a4aa9ab74186", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659244, "uuid": "bc94c2b9-7888-465c-9d83-21ba7ed5d393", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "381dcfc4-a8e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619698800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698800, "uuid": "d3c91b77-a93d-4846-86ff-b31562cd41a9", "comment": "Malware payload (Dridex)", "value": "6b50d4a0841f852600a670c09c7d3e2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698800, "uuid": "be996f6a-0c37-453c-80b1-7e43aa72021b", "comment": "Malware payload (Dridex)", "value": "0f612adea3efabc81d5854e85001b05b651b2a5e219f0aca013d324ec5958275", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698800, "uuid": "2b552a62-bf4a-403c-b7e6-cd943e0ee458", "comment": "Malware payload (Dridex)", "value": "ecb2812e9edee665ef13b2d497ecc3677c40bc61", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698800, "uuid": "5d0da944-89d1-465c-8706-8f5eaf9fdc04", "comment": "Malware payload (Dridex)", "value": "e72b20f07cc4900922aa7e3c85d735897e5a7a211c4d8f5444df871eab4c5e0238cf94e268311863b3a23d67d6b2df26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698800, "uuid": "96132610-2427-4771-889a-da66741f4310", "value": "8BF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698800, "uuid": "c74c6c05-125b-4503-81cb-9c5727ba5a1f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698800, "uuid": "b9874446-a266-4b15-a579-a955f55aa2f8", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619698800, "uuid": "f13b6406-cd9b-4d75-944f-9e1a865bebf1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619698800, "uuid": "1613e8b1-aa42-48bb-b8b0-43036242a1a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698800, "uuid": "c6efce88-cc74-4485-affd-3cb97f98918b", "value": "6b50d4a0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01118921-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701285, "uuid": "54b6b2c8-5137-4cd1-81c0-7f64f17e7c93", "comment": "Malware payload", "value": "5e70d51ba02079b304a01be264571884", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701285, "uuid": "ca3eef2b-0da9-4d76-98fb-396e9376818a", "comment": "Malware payload", "value": "0f7ce6a1b114243b396d61977b37d747dc33672e0c5a02a00b803d628769447b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701285, "uuid": "cba146f3-a354-4531-b339-35a467ab32b7", "comment": "Malware payload", "value": "d05a3a65b76372a2e7c7472ec1950d4b5e2a7827", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701285, "uuid": "0caeec67-9eef-442c-9289-44bfe0cf30f8", "comment": "Malware payload", "value": "73b281e69ec308ff20b95945ffe0077d3a4dcfe422c7d7a5b7c571a142dd89473bbff0f05df7ad9f3aafd4e8aa4c9676", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701285, "uuid": "3ed1e7ec-9f58-4b89-a089-539a649f1986", "value": "D63302C8C688D37698F17835EC79C701D978AA5E0817846183F34AEBBC07D901B4ADDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701285, "uuid": "f6fe590d-b773-498d-995d-cc04b02da784", "value": "1536:qFugXVpoD8ZxhrLAuNS07MrxrKsYMh+WTQ:Uq41rLZNkZLYC+WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701285, "uuid": "159d07f5-3c5d-4d96-8ece-f47f94cec0cd", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701285, "uuid": "0cd4ca70-1d6d-4ede-bc3c-9302b7c7d9cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701285, "uuid": "2d652a00-f8d7-4415-ac57-2e51e5c6f388", "value": "catalog-265854270.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1acf0ab-a8a8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619672832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672832, "uuid": "b9cb0513-4b96-416d-b524-c62cc318c5af", "comment": "Malware payload (Dridex)", "value": "00f5b85b82dbbd650ad42326e7fa87e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672832, "uuid": "353a4e99-b212-44af-9c8d-9950e0de4737", "comment": "Malware payload (Dridex)", "value": "0f82232c4adb70ae6ecef776904ffc612e6f558ada259a7803f0298dd279ad41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672832, "uuid": "937649de-be99-486c-a2f3-8f77305b9dc7", "comment": "Malware payload (Dridex)", "value": "52b78f5e08889dac3dd59d5327f24d13f5367fb5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672832, "uuid": "6f1579b9-c6c9-460e-be9b-267994d422a1", "comment": "Malware payload (Dridex)", "value": "75eabd9b7da1a34aa0fb108a686f1333fb238010a5e69d5eac5a0d840bb632df7cdf2363a807948322dd3e5f2bc9a019", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672832, "uuid": "fbb0f41c-6203-40f8-bb37-663271cdd467", "value": "58F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672832, "uuid": "fc2b51d4-b329-4998-9cff-5c74896a96b5", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672832, "uuid": "c061eb55-2786-48ae-a2b6-c55438ddc4a6", "value": "3072:h98CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYYkZwd:QnClX8WZ7/HrRCADTR0Vl2Zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619672832, "uuid": "0f1b0ff3-45ea-4ae2-a963-e3d5557f1150", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619672832, "uuid": "860ab42e-2264-4631-8f91-ec5cb2ba84a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672832, "uuid": "046765e2-5113-4abe-8920-2a8fd4552afb", "value": "00f5b85b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793ef836-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704063, "uuid": "14edfb79-4acb-419c-93c7-fa0ea6f1681f", "comment": "Malware payload", "value": "0c08fe4b078917c1e1143e95c08727a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704063, "uuid": "a0048bf3-3e49-47b3-be65-c3ac0a548d1d", "comment": "Malware payload", "value": "0f94fe4b44bc81d86f0e1a51e71dfce207de8426968e2e007b9fe7ac3e196018", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704063, "uuid": "846fda29-a9a4-4a7b-844c-94a2f313cdc7", "comment": "Malware payload", "value": "277eb02ea598b85a365ef8b6714dfc42c66d10ca", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704063, "uuid": "b7048312-746e-499a-9846-7a393b3ba0af", "comment": "Malware payload", "value": "eaa4fa5abbf78f6b8df265cfdb01ba8d8806d61ca54d49e20b6d3da1a72e3fc2e01d422ea18acdd14c4b0a5b06fa3103", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704063, "uuid": "348be10b-c210-4410-b0bc-e025f2dd345d", "value": "8B33012A886EB639172E50F08549D72EE61768DD385DC9812CDCF46BEC066B8113FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704063, "uuid": "b8ef230f-9941-4097-a652-0883d811fb89", "value": "1536:XP6z4+ADViS8CWoD94pUnQ64x11RiCzes:fPZBiS8jopkUQ64xks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704063, "uuid": "66634867-0f3a-4c52-a7ab-7b56538f394f", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704063, "uuid": "65a28dbb-eafb-4ae5-8b6e-3a9e38a624e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704063, "uuid": "5a3b74b4-9a98-416a-aea9-82799784fccc", "value": "diagram-454267814.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc83c0bc-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619704230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704230, "uuid": "17185b34-fe23-4e0a-8b78-4f780bf69d21", "comment": "Malware payload (AgentTesla)", "value": "4d17e2a8f29b7ed50573823b09184fe1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704230, "uuid": "a641909b-cbae-47e6-a7ee-f0d3633893a7", "comment": "Malware payload (AgentTesla)", "value": "0f95895a5ea5227304c10231e948c8f463d02a5d7d11097c25713d9672ed3c4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704230, "uuid": "aa9a25ba-6975-480d-a88f-e0f50d630431", "comment": "Malware payload (AgentTesla)", "value": "fa71f2c5506d76e93d9ff420ebcded5ee1844175", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704230, "uuid": "42e88ca5-7f2c-4de8-8c7c-960a73b60f89", "comment": "Malware payload (AgentTesla)", "value": "e825c33192ccd8807d84f3adcbbb2d1789b2d314221407f1deaab6f216feadd3e6058e41276a6d923671592734c0dd90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704230, "uuid": "6c715947-74a7-4794-84c3-8da479c883c5", "value": "40256CAC721075EEC2178C3397CE1C11821025756A2BEA0B972333BD6A2FE976F355D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704230, "uuid": "0ce7ad72-d33b-4977-b890-59a02e445b96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704230, "uuid": "3b649563-29a9-4937-aa63-30ec2fde5a90", "value": "12288:8KEaURIh5Ux6moLLoS60/K7yh0e8Mu28/feTE3bJZ4JG09pXL+AiPW0Of9XxTpHP:8taUroLAnp/mA38p7+At0OFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704230, "uuid": "3ff16063-9576-45d5-be11-a6a445f478ed", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704230, "uuid": "38d681a1-c7dd-45ec-a0c7-c9ffc963adc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704230, "uuid": "e1790e88-bd9c-45a1-9487-8761723cfedb", "value": "DHL Shipment Notification Status AWB811470484778202129-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3855d0d4-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701378, "uuid": "94f3d7b5-06d3-41fe-b3f1-f1e67136357e", "comment": "Malware payload", "value": "cfb17a72607d6b756d71e3c7d55f5142", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701378, "uuid": "7b26464b-05ea-4a8b-b75b-4169085a49e7", "comment": "Malware payload", "value": "0f9c086b810579dfb6421fedb98b9c616b382da25d6f1f4fef146e6416ec5e01", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701378, "uuid": "f770e7bb-2175-424d-8805-3f3c32ffb131", "comment": "Malware payload", "value": "baa0b65b2e857b9f882c4c9252052f1c12a593fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701378, "uuid": "071a42a9-f13a-41ed-afe0-d22e9ade7bca", "comment": "Malware payload", "value": "c50370dfe9e6a907ee6673f17356944015e2663518a8dfa09b5df21f18611ae960b8ed17dc384a2dcb04e89705ecc788", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701378, "uuid": "bb15d5b0-485d-4b7b-8d6f-7738663aa6c1", "value": "1433F188D68CD371D4F57434AC798B02E978ED2F4816C8A281F78AA77D07DD52B4A9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701378, "uuid": "92135ae9-c66a-4c91-931e-2e73c2e40b94", "value": "768:RwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV26:YFugXVpoD8ZxhrLAuNS07MrxrKsY6aQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701378, "uuid": "74298bbf-e34a-4f8f-8899-665fe25dabe7", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701378, "uuid": "3b2454b2-1f18-46fc-ad3d-55364d67b03a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701378, "uuid": "4d6dc7dd-afe1-4f89-83d8-67ab054bc8bd", "value": "catalog-336021212.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15efbc1-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619701634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701634, "uuid": "83ad4a10-95e0-489a-b085-471622dac7b5", "comment": "Malware payload (Dridex)", "value": "a277bd82fe6ea22cad2b3735082656bd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701634, "uuid": "54fbbb5f-23f8-446f-96df-109c1b165d03", "comment": "Malware payload (Dridex)", "value": "0fa6a7fcd42f6721033a1d7adf7ea0679c7ddc4e018450d2987fe687afb279d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701634, "uuid": "eaedb0d0-baa4-4cd0-928d-f3a09c55bdd3", "comment": "Malware payload (Dridex)", "value": "264bb17f7fa7e30b742851b675c6d94ac95b733f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701634, "uuid": "dd562a5a-4d2d-462a-acc6-16263a8b8199", "comment": "Malware payload (Dridex)", "value": "3ebb5c1dc4b376b49c43f1d819cc5df0fbdf9459089699f50f656305cbae6e60932c9fe8eeaed20b166f2f4e6d182d1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701634, "uuid": "db1be7a9-6fb7-4eef-96a8-9fdb914732d5", "value": "D4F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701634, "uuid": "807fa5d9-8f30-4870-b11f-29a39981399c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701634, "uuid": "59a3679e-6361-44bc-b9ab-747505f424e1", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701634, "uuid": "8082ee2c-05de-477a-977f-5422302f726a", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701634, "uuid": "71646888-bfba-431a-a8e7-fcb7a7d9cf8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701634, "uuid": "404a794a-a609-4489-b6fc-06ea719607bf", "value": "a277bd82_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c84f36e-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704525, "uuid": "c6ddd75b-ea05-4919-9d4d-8e702994aedf", "comment": "Malware payload", "value": "77763d872e96ed2829ce9ab3598f1fc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704525, "uuid": "ac5554f4-55c0-45fc-9336-957a53e421e3", "comment": "Malware payload", "value": "0fac18ef58f91366ad80de9d4f0d67a389de21af541bd12f3d08685bfe72bedc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704525, "uuid": "ade11b58-49da-4050-83a6-9cc4bf5fb27e", "comment": "Malware payload", "value": "c7e10438976bdab4f9315aad5b2ee8d22031379d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704525, "uuid": "624fba3a-8cf9-4126-9073-1cb2c9f1d700", "comment": "Malware payload", "value": "8f7ad01a9e29d4ab5b108b892fd364f598e8b59a39ee2b23b5bd6e6af072d48b52f4969cc39723a2bcc8d0741711b7ea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704525, "uuid": "9fd80284-37c2-4dfd-a757-1154b0e3dd1a", "value": "D933022A4C9E7A29573D10E04985CB2ED107A9ED386DC5812C5CF4B6DC06BA9163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704525, "uuid": "089f5d33-af79-46da-b3bd-1d4e4cb12472", "value": "1536:lP6z4+ADViS8CWoD94pUnQ64x11RiCBKJsl:RPZBiS8jopkUQ64xuJsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704525, "uuid": "8f026d12-b2f5-477c-a694-3c1cebd14ef2", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704525, "uuid": "c13214cd-4ab2-4261-b1a9-c1541d68f78b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704525, "uuid": "57a99cf1-60d6-4d24-93c2-8ccedd9cebbb", "value": "diagram-808247828.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2172ac6c-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659249, "uuid": "915b2b59-50f3-4bcb-903f-96fd53e17b8f", "comment": "Malware payload (QuakBot)", "value": "f161c6555bd0b19ece7f83d4c1d5879c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659249, "uuid": "2bc70505-731a-4e7f-9f3d-5ead21a03dd0", "comment": "Malware payload (QuakBot)", "value": "0fc422efa7d3f9dfb8df58d37341eef79e3de79d79d181d5503123b3cbf0d7b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659249, "uuid": "b5e776b1-a6d0-467b-a545-3146cb2911ea", "comment": "Malware payload (QuakBot)", "value": "b043d666361616e18b948d95f7ab01df44bd05d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659249, "uuid": "bcc4d869-8c90-4bea-b350-fa2eea265fcb", "comment": "Malware payload (QuakBot)", "value": "6b064b6b0957c9e78174b8ed167f6c4bb7e21fb88d1c7763862926b9023b04f368ea5eafbaf69106f94535106219928b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659249, "uuid": "d780a4d5-d5c2-4e68-a617-598d0e111849", "value": "EF549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659249, "uuid": "f6838fc3-3857-4ff4-8d3d-56ff7c6006ef", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659249, "uuid": "b62bf8a9-e4d4-47ed-a4eb-0a4bef6e2421", "value": "3072:F3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZeg:Vvv9sMoXBaRmr/dukbvuZ/7fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659249, "uuid": "47091ba6-73c8-4de7-87ea-de347cea3733", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659249, "uuid": "0e664c05-263f-4e43-827c-4c854520afab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659249, "uuid": "1cec88cc-e07f-4148-a6e2-0e747b200525", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27dcd04-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704240, "uuid": "962658a6-6dbf-481e-bfd8-7631b5621d09", "comment": "Malware payload", "value": "fbdb969f13a6ea71c52d23aceb33a286", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704240, "uuid": "acb3988c-6631-4c3a-845a-6d508013c920", "comment": "Malware payload", "value": "0fc6cc5d68a1f34d3e0210d04f2d56c75a89ad83296bf83508ad11a0b4a11993", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704240, "uuid": "bd6cf268-a3f8-4591-867c-5a51c8ffbb91", "comment": "Malware payload", "value": "225ac1b1dc9ff8915bb477a1bbef6b85cc919cf2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704240, "uuid": "c89f5d66-6da0-4950-9a6f-90ad1790d6cb", "comment": "Malware payload", "value": "96d4beec636b7e3b358b3c75f59d7dcedfaff0b2fc4af1ee0d86c2c2706cc33dcaa23420d548a5931f1e5a879a1f34e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704240, "uuid": "6cf3c48c-6f6f-4b65-8479-29d6d7672cb1", "value": "B733022E485DB62A577C10F5C589CB1ED50B68DE382DC9825CCCB426EC096A9153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704240, "uuid": "4ce44cf9-cb03-467e-817c-fe9815a13364", "value": "1536:xP6z4+ADViS8CWoD94pUnQ64x11RiC+V4h:1PZBiS8jopkUQ64xcV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704240, "uuid": "a43a5517-dea0-47fb-8f1b-bad7acdf19c8", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704240, "uuid": "b08db179-dfd8-44e3-89eb-7efa2242d574", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704240, "uuid": "44d07323-c107-4302-a0f0-8de0563dc0b3", "value": "diagram-618581158.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdba077a-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702460, "uuid": "7c47ef4d-d8da-4374-9ae9-c9e65166b075", "comment": "Malware payload", "value": "4ccd123c01f5380ee370757e427732ea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702460, "uuid": "05eec1f3-8348-4380-a829-503b045f0f95", "comment": "Malware payload", "value": "0fc7aa90d4d769342a810fe2b78369dd97050c25f712dad7904223aab4f2870b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702460, "uuid": "0d97ef9a-f7b1-42f1-852d-6202b26a643b", "comment": "Malware payload", "value": "0749fedf2ca738908cf327048d8d207cb25f53f4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702460, "uuid": "9b38c368-26d5-48f6-b2d7-93dc1bc8ee82", "comment": "Malware payload", "value": "227c8eb2a081c204d58173fae5c247462563d73c89fd26db9430f4f6dd32e0400a5bd668adf62eb0e9e3afee2d422193", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702460, "uuid": "8dea9e25-c92e-4790-8be2-0b40be6e8c08", "value": "2933022F485DBA2A577C10F5C589CB1DE507689E382DC9825CCCB826EC097A9153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702460, "uuid": "77e09f0f-2e9b-44cf-b6cf-e7905055c5fb", "value": "1536:OP6z4+ADViS8CWoD94pUnQ64x11RiC+PTK7:QPZBiS8jopkUQ64xcPTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702460, "uuid": "ee419d8c-eb9a-49c1-83c9-bb6e319a6e24", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702460, "uuid": "59e6f5fe-db66-43b3-8f5d-535d41e0b9c9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702460, "uuid": "643d193d-6fa2-47ec-af38-99a23707a303", "value": "diagram-1180628309.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f805df-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706628, "uuid": "a46217cc-6eb5-4b6b-941b-b637ff2492f7", "comment": "Malware payload", "value": "c9a8a11470f5fd804dcfe7b6df25448a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706628, "uuid": "b0a75b72-98ce-44b5-9170-5b0a6ad5147f", "comment": "Malware payload", "value": "0fcd1d675938e6ac664d58ec11ee9f0072594a2574c6d5684499217faeae150f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706628, "uuid": "9467b0a0-6869-4451-b434-473a267807f7", "comment": "Malware payload", "value": "33078b3758b34e8b2b8e8b7762ea877254f8a764", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706628, "uuid": "62ce9ee3-4c87-4a49-8ca7-ad7f25225e7d", "comment": "Malware payload", "value": "128d8d4c9cfd44f9ffeafe36b71828b239cfd920009cece994adac637f95cd7c7276fc2db76424c654681762be423476", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706628, "uuid": "5dca9a16-aa1d-42ae-86d3-eb57648965fe", "value": "D23302198C5EB62E536E10F489849B1EE6975CDE382DCA821CC8F4BADC056C9213F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706628, "uuid": "ebf253bf-4444-46e9-a9c6-d87102273047", "value": "1536:EP6z4+ADViS8CWoD94pUnQ64x11RiC7T2:iPZBiS8jopkUQ64xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706628, "uuid": "9ed855dd-d30b-43bc-983d-0ef244b7659e", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706628, "uuid": "dfa96a32-58a0-4f03-91cd-6334668a1e36", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706628, "uuid": "498f228f-9828-447a-9830-168e1a207160", "value": "statistic-474970473.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a68a8a-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707435, "uuid": "189a3433-3131-462b-a531-330c526f6699", "comment": "Malware payload", "value": "f439444ecc1bf4709061c40b3afb128a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707435, "uuid": "f68bce32-464d-4edb-931a-ae39eb54ca12", "comment": "Malware payload", "value": "0fd04da433f527d9e9308d852233d479dce749a0639881f5caf20129ff4729da", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707435, "uuid": "bf2d413e-591a-4009-8639-a01d1f1dc490", "comment": "Malware payload", "value": "5e00303e5b139e481a9a44febb390ebf41a4eb7f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707435, "uuid": "a8f50456-4a71-4cc1-a87c-0f506021a93a", "comment": "Malware payload", "value": "1dc6b8018c81481b015ab26119777f2867be8e095a2aa9f652c960fbdcdbc830758fade9a9292c2cabe472136a310fc4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707435, "uuid": "dee86f82-6d28-4984-af07-1283e949374b", "value": "D63302299C7EBB2A677E10B04585875FE51369993C6CC64208DCB4BAEC093E9063F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707435, "uuid": "0da88877-583c-4533-aed7-f36d8f6b1006", "value": "1536:JP6z4+ADViS8CWoD94pUnQ64x11RiCU09:tPZBiS8jopkUQ64xWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707435, "uuid": "67baedfa-8195-4c28-a318-1796c9826725", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707435, "uuid": "f8e31a08-bf10-4385-8da1-6eb184c1e9c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707435, "uuid": "0d560941-6332-4f92-ada7-676ee1217524", "value": "statistic-977361299.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243b7c9f-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659253, "uuid": "b21e17bf-b2c4-4618-bb5c-446cffc94bf2", "comment": "Malware payload (QuakBot)", "value": "fc3ff393b16b225d5dab92eae98b2138", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659253, "uuid": "44bd8075-cdc8-43f8-923d-154dc7941579", "comment": "Malware payload (QuakBot)", "value": "0fe6c2e383d01ce149ff713a64f0475664e4095aaab8677e05140abadaf3f11f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659253, "uuid": "fbb1d4e9-a69a-43e1-a2fc-b55a083762a9", "comment": "Malware payload (QuakBot)", "value": "e664a065b21779d7d88f527028f2d775e842ab90", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659253, "uuid": "4dba273c-4bc3-4e97-be86-3e847235f60a", "comment": "Malware payload (QuakBot)", "value": "b32ba9d63369ef5fad731f8c75dcd494597b520ad58cc61c499e9369c5160fb001740b0e0048f65145f4d3b158af9920", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659253, "uuid": "03d531ea-c333-411a-a2d7-d3564298aebf", "value": "8F549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659253, "uuid": "67814b62-9286-4d8c-a845-07950c7e4ede", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659253, "uuid": "d1f14036-2fa3-43c3-83aa-7a0a9f3331b3", "value": "3072:t3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZJV:dvv9sMoXBaRmr/dukbvuZ/7fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659253, "uuid": "bcd9067f-aad4-41de-bed5-fc10bfe3808a", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659253, "uuid": "919fda1f-6424-420e-845a-1e09ee1f7242", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659253, "uuid": "03aff7d6-3028-4285-9c66-dc5ce7c0d731", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482eb419-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619659313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659313, "uuid": "234aefed-d51f-4dde-8d20-70f06d472382", "comment": "Malware payload (Loki)", "value": "14958e2b8f4c94b9e68d7f49c39b280d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659313, "uuid": "f688055f-1196-42db-9ced-318d98847aaa", "comment": "Malware payload (Loki)", "value": "0ff48b0aa04d33a036b4dd3cf4eab9ded7ec2f14d40b1e135c96fbe965312160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659313, "uuid": "61d24cb8-9ce5-4a95-a691-4ae1bd3f3e81", "comment": "Malware payload (Loki)", "value": "48d4a65cb69d76285a337abd30bfd22556db74df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659313, "uuid": "1e98ed1d-0b86-4806-b089-cfa8606c4235", "comment": "Malware payload (Loki)", "value": "2b151d3f92665cce0c318e27528467878a43b1a4d4f6e3fccc17ffe7de955d1e2f6410c12c7ad14bbce6577ded7f5357", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659313, "uuid": "50e86009-d904-446a-b708-ecbe2b2dc8f7", "value": "08256BEC761074EEC6178C3397CF1C1182202975662BA60B932327BD5A3FE576E359CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659313, "uuid": "1ead3722-c15a-47ad-b307-6ff9bbeaedcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659313, "uuid": "f4b26960-fcb3-4e79-bb69-5e690be0328c", "value": "12288:wGvLm+ooLLoS60/K7yh08GgOTWgASIwzjGiwsR6Y987DzpBtWvHmgxQu0d8TcM4C:wGvdooLA8GgxDWcsgPVIHmwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659313, "uuid": "12857168-beeb-4beb-bc1d-9ad8c6b36d72", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659313, "uuid": "9afc2d4d-06f9-40fa-9287-f67441585aca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659313, "uuid": "4b8144bf-0841-4dda-b5e9-43090bfae418", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be410426-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700743, "uuid": "332983b9-4c0c-4c3b-85b5-cef6532134bd", "comment": "Malware payload", "value": "a4d15a5438b9e06c17b454731caa425a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700743, "uuid": "2edeeded-8ab2-4186-919a-4b9edd213a12", "comment": "Malware payload", "value": "0ff511482a009f04c7ad230596a4f0e9786aed0b0e8d88b7b4b544e313bf120e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700743, "uuid": "d428e02c-36a6-4773-87ba-ee5e69121118", "comment": "Malware payload", "value": "79e30f99fac063fe38c74fff1d016457157ed4a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700743, "uuid": "bd127c7d-20ca-4a9d-b3ac-7560f1cbed13", "comment": "Malware payload", "value": "c2a9b00ae9ca7d49f474aeb8eb10a09617d239fcf96779edbe10a42f8b4ab7cfcc291f889d5e0b7dbeecebb3a1497544", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700743, "uuid": "4b4ea486-a9cf-4eb0-b315-ff788af4b601", "value": "D3330284C5CCD271A8F17535AC79C701E474B9AB481AD5A282F78AE7BD079C10B4EDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700743, "uuid": "f6e780a0-ec05-4eec-92cf-31e83912c349", "value": "768:IwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2B:lFugXVpoD8ZxhrLAuNS07MrxrKsYOmQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700743, "uuid": "e72882d3-61b4-4dc5-9cef-0a20d57b3d0d", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700743, "uuid": "9c52a2c1-c561-4a60-9092-201dbe2c1f8a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700743, "uuid": "c1ce4b6b-cd3f-4fd7-84e9-cc3963f539af", "value": "catalog-1783044846.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5f61db-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699881, "uuid": "9478ceb2-5c5f-46a0-891f-78c79514dbd3", "comment": "Malware payload", "value": "34bbfe01d4a9846b92e3d57befe6fd21", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699881, "uuid": "0d384756-30da-4e2f-903d-f5b885466f09", "comment": "Malware payload", "value": "1001f984e85c005cf4cc50a8ac2d0b7c7b266768560fff8d5ca4ac93ffb2f0c5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699881, "uuid": "eca4c1d5-c542-470f-b261-c9c0eb076a8c", "comment": "Malware payload", "value": "633fcb728aa0870c743cebe25a16937e4c1d673e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699881, "uuid": "5b334d6d-391d-46e2-9624-3a86e911ad19", "comment": "Malware payload", "value": "93306cd72ceb9574dd7472271d51df557ee2426bcc58562bf9f990483185c91bf32c43fc61e1252b3c5104f322badfdb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699881, "uuid": "14952d55-cb1e-4ea0-bdb4-6017e1d62884", "value": "B0330284C5CCD271A8F17535AC79CB01E478B9AB481AD5A282F78AE7BD079C10B4EDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699881, "uuid": "57131b20-aade-4a3d-9539-1f24cb15b9f5", "value": "768:OwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2x:DFugXVpoD8ZxhrLAuNS07MrxrKsYOvo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699881, "uuid": "58779a7b-64a7-43f4-b30a-1cbb5aca0e3e", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699881, "uuid": "9218ebff-30aa-417d-b0b6-a77fb0105614", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699881, "uuid": "6ae13528-a63c-47cf-812b-77a19d3888f2", "value": "catalog-1126826308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ae1b92-a8e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619698930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698930, "uuid": "b28d484a-a4ff-4084-9cd9-f49f273ea075", "comment": "Malware payload (AgentTesla)", "value": "40f9f17937ce351d6029d0bfce227b12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698930, "uuid": "3fe5ac75-6797-4a60-89a5-2841ec64dd9e", "comment": "Malware payload (AgentTesla)", "value": "10043644a25b01c6dc14d1cb146c384eed12c345a951bb1573c6ac57ff2c03ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698930, "uuid": "ca09cfaa-a1ed-4914-bb9e-d679c1406f01", "comment": "Malware payload (AgentTesla)", "value": "0e8b2849712c2f7d0ed04bf26476df5d20514902", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619698930, "uuid": "d584fc71-7349-4c84-8194-ce1b2ed45374", "comment": "Malware payload (AgentTesla)", "value": "02cc410c2c422581753891e1ce5b289fa430f1c920f2aed1ff5fd47bd13c846bbf0eb0ad98447c5450e3b5c2271ca96a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698930, "uuid": "29ba98d8-285d-4145-9603-068547314554", "value": "3C15026633989A18E07E5BF518B0418117B5FD406A32D31D7E99235E0FB2BD2CB6B3D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698930, "uuid": "f6cd4788-acd3-40b8-9735-a80735339ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698930, "uuid": "f3c5a9b1-90d8-4f91-a4d7-d6eeef8cc8bf", "value": "24576:SHWnglaQj6+r2cd1tdewt7Z9ZLLI6Lwn:Lj+r2c1deY9JIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619698930, "uuid": "1611edd7-8916-4c2d-9a9e-26d117cab12d", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619698930, "uuid": "c82c9258-679e-43f8-8494-1aa94cb98fe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619698930, "uuid": "06ee6023-5525-433a-90b7-a1cba725a186", "value": "Payment Advice - Advice Ref[GLV427762900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d8b42c-a8d9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619693594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619693594, "uuid": "24d80f5d-9ba5-4ee7-974f-603006ad521e", "comment": "Malware payload (Loki)", "value": "2af49a1a11b912f47a1f5c48ba164ed1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619693594, "uuid": "0d21d6ff-0cbc-4d52-81ed-65eb6d447762", "comment": "Malware payload (Loki)", "value": "100636e87d7ac9e5f4b98ad3028b942e04956284f3fb57d7573c6af6c8316d79", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619693594, "uuid": "4c01687e-ba55-4038-a145-fb67eca5d634", "comment": "Malware payload (Loki)", "value": "ad0466cc2e11093139e94cf2ecd1ba0b0443eb30", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619693594, "uuid": "7e404549-b396-48b2-b52c-6ca90928ebd3", "comment": "Malware payload (Loki)", "value": "e0d61d4266ac4ba307599c34531f9b6ae571a9e652c5ff46df3b942a6ac2a64b3bc2f353f2fd8bcd1ee1f6e31ccfe82b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619693594, "uuid": "1521c0f7-d5fa-492a-b3d5-50a857a47a56", "value": "9B227B2CC650F42BD212187DD01941FAFB1C6067A183B4AE2459B2CE8BB06D6879F2FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619693594, "uuid": "4d4a9ccd-2876-4b91-b03d-71cb2aeb92f4", "value": "192:ScIMmtPOPF2G/bOFcge5SEzBC4vNqRxbS3tt:SPXm9FO6fhlqR0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619693594, "uuid": "ae9ee476-ccfa-432f-9e35-061a9eb9a2d3", "value": 10326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619693594, "uuid": "70ad0dad-10ae-4cf2-838a-2ef95dd6d7a8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619693594, "uuid": "777b5589-dfe4-4b08-83df-a077cf187089", "value": "2af49a1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fb2c3c-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659258, "uuid": "4b91e7fc-ffb5-43a2-9ad1-2d2ae032ab49", "comment": "Malware payload (QuakBot)", "value": "b909bf9a4f2089dd55ee0cbc7c67e490", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659258, "uuid": "fe80d0d3-9477-494b-a58c-81a360bd43c2", "comment": "Malware payload (QuakBot)", "value": "101bcec634a2d2e227caf7c2d07cb65419c1031ca753db7648aa53761c321f66", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659258, "uuid": "13b59a48-ab9e-4a58-bee0-6189bbc6de00", "comment": "Malware payload (QuakBot)", "value": "c6cb04d0cae0576d13c50b9df1f00d5975c7c579", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659258, "uuid": "6bee08de-e951-49a9-87bf-2f2f7b53f6c4", "comment": "Malware payload (QuakBot)", "value": "2cbbb1b8d749a934ef64807ab0c948c82dc91de5967ac12647457377653462d1d27855fc2c04e4f5ae3dd1832e42ae03", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659258, "uuid": "2b69b31a-48cc-472d-b9bf-304f83cac5cc", "value": "6B74C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659258, "uuid": "899fcd81-dfbb-4d10-83c1-5bd1eedc8d0c", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659258, "uuid": "c94a9ee5-ac96-417b-9612-5a9b03238de4", "value": "6144:QITfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuf:Fbi7/xZrkNK11G9AQyOi60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659258, "uuid": "a62e1259-e332-425a-8ef8-977c171d5728", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659258, "uuid": "dfc8fddd-2fb9-48b0-836a-24a3c2637ee9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659258, "uuid": "23127368-bb28-4832-b2a0-7b1b604dc631", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00284aee-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704290, "uuid": "3cd35bcf-36fd-4a09-9f8f-68d46ebd5f8b", "comment": "Malware payload", "value": "d5c4aba412ff63aad311b882811c85be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704290, "uuid": "98da3a46-4e79-45ce-b81b-ab30b34e1f5d", "comment": "Malware payload", "value": "101eb8833f9fa76d1edc925da65253ddebd13b2b40a93fe23a5bfe09a421f548", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704290, "uuid": "9d8b2d30-8b62-4450-a00f-8e7ecc270806", "comment": "Malware payload", "value": "8a4cbf62f636db9ba435df6534a562de60997c04", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704290, "uuid": "58fb49ef-cf0a-486d-ba28-0ac2ba319ca9", "comment": "Malware payload", "value": "4d9d822c79c0a7dbb39edb05a30f08740210e2a6013187132e5ff847dc261188207b95f6c033cc7f542e75cbddb6503a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704290, "uuid": "4899a61b-70ab-49b5-9a65-56854b77acb0", "value": "E933022A495C762D177D10F18945C74EE52758DA381CC5822CDCF4A6EC42AAD073FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704290, "uuid": "f7199daf-6cf2-4ead-86e6-d994a08ad629", "value": "768:/9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCCs7:qP6z4+ADViS8CWoD94pUnQ64x11RiCr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704290, "uuid": "4973e59f-dee0-431a-b89b-4c4d716b9db1", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704290, "uuid": "41f0bbfc-c628-493e-bf2a-e7135635e22e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704290, "uuid": "4a968010-fc50-4fb3-8765-a919f54dd19e", "value": "diagram-661399058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a364b0e8-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702846, "uuid": "116464e3-af47-4e8a-8c6f-6b634d6ce366", "comment": "Malware payload", "value": "1c8c593dddf07fe6b3630a95637b75ad", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702846, "uuid": "0e20fb31-35f0-4e47-8188-fc9795fdb6d6", "comment": "Malware payload", "value": "102d277945bd5d86ff73becebe50a2dc98e1e993584d63a24862d081cc7fe67c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702846, "uuid": "4cc60691-8d97-4c6d-8c72-20513a58a532", "comment": "Malware payload", "value": "6b8476cc659e8d1a35b79fc23c3b5a6be6a268a1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702846, "uuid": "e9f88d7c-c0f2-4d34-a033-e210a3e9e7a7", "comment": "Malware payload", "value": "0783cc8d87c6e7132d268fc2413a9b5a36ad8793cdf9625ee91a4ae5316bd0f07e73951f79e9a0c0e91739ccc38b09e2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702846, "uuid": "95acfb34-0252-402b-9724-0b0c89f0c505", "value": "8733022F485DB62A577C10F5C589CB1EE50B689E382DC9825CCCB826EC09669153FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702846, "uuid": "0671b497-4d60-4900-be96-1e2d3bac0e46", "value": "1536:bP6z4+ADViS8CWoD94pUnQ64x11RiC+OIe:LPZBiS8jopkUQ64xcOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702846, "uuid": "93295744-d4d5-4440-a06c-67fe3d02052a", "value": 51476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702846, "uuid": "1f6d86f5-0180-4e14-932d-d9e1f8ea9c4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702846, "uuid": "a2be2347-124c-4354-be9f-0ebda2602ab4", "value": "diagram-14915761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e4cd2c-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659263, "uuid": "8ce17739-d829-4935-9010-1fbfc7d96537", "comment": "Malware payload (Quakbot)", "value": "0b470acf9264c28199ae484fb6111e31", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659263, "uuid": "0a782816-085b-41cd-a0fa-571eff95c55c", "comment": "Malware payload (Quakbot)", "value": "1035a8bdf70cee2e1f0b46d81ce01d902841585f266a32c78650a5e58cdcd2e6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659263, "uuid": "e267f9d3-c8e8-4e97-92a7-16dade28bb79", "comment": "Malware payload (Quakbot)", "value": "90e2675191eec24a8427eb2572dfd926dc6f93d0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659263, "uuid": "f996cca7-58ce-4e2b-b803-50c9bf82ed0b", "comment": "Malware payload (Quakbot)", "value": "8b2aaa4769300baa7fcc2cc2c43b2d041b5ebcbe256ec2d539048705e06ebbe41fe93c20ce4ea46457d2b8ba373d9225", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659263, "uuid": "4134a137-cdde-4993-9355-0256f7e0cd79", "value": "7574BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659263, "uuid": "0ed1d37a-bb42-4a8f-8a25-1961679fd30a", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659263, "uuid": "750e2b16-e44c-45da-85fd-15a9240c46ca", "value": "6144:3nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuA:gFrkNK11G9AEtMxQyOi6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659263, "uuid": "5a1a7fcd-8bb5-443f-a20c-08f4bf970c11", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659263, "uuid": "257c3ca0-a172-429a-982a-27a83ecb99ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659263, "uuid": "995cc4a8-6342-4404-80d2-6968f9d8ef57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6a523a-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700718, "uuid": "94acdb25-25e1-4efe-b6ce-ee5fd8fd5b4a", "comment": "Malware payload", "value": "5eed7dda5646e41e45adcf40661c1217", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700718, "uuid": "80c94ad2-03e7-45ef-938f-1854656b1b4e", "comment": "Malware payload", "value": "10367a222a3048792dcdaee7dad306a47f3e8015efe899e04af47cc9d1bff761", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700718, "uuid": "a3550055-18e1-484c-a668-2aa4e2fdaf56", "comment": "Malware payload", "value": "66916b47ad7b94513bc07bd37ea1b4dd3862e9b1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700718, "uuid": "868277d4-9a29-41ae-a8b8-1cfe2cae5219", "comment": "Malware payload", "value": "6668b809e1283a699441fd67dc1cf7aab94cabcad6941dcbd88dfa469ec2596a0e155079e73d1d8dd4071edb359cc6a4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700718, "uuid": "35f72881-0c47-4c11-a92e-7d865b60f89a", "value": "B3330288CA88D372E8F578319C7DCB01D978A65B480BC5A282F787AB7907DD1174A9CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700718, "uuid": "1de47907-5581-4616-9dc6-930c0fd05abb", "value": "1536:UFugXVpoD8ZxhrLAuNS07MrxrKsY740ReM4:+q41rLZNkZLY80kM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700718, "uuid": "18b1d81d-f080-49c9-920c-8c15d9fe674e", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700718, "uuid": "ef073b43-ed6c-4359-ab14-fde6c12bf7c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700718, "uuid": "ad876741-ec8e-47df-9b09-9fef3f4f8eb0", "value": "catalog-1764756646.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca9a617-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659267, "uuid": "7694cf66-feda-4bba-97ed-d8eab1b40e6c", "comment": "Malware payload (QuakBot)", "value": "23cfb2d10a831c4d1a5b63372e0d4437", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659267, "uuid": "f3b19983-20b4-4251-8785-ae2e688971ee", "comment": "Malware payload (QuakBot)", "value": "103cbf55027e04cd33b002ed4cfa6333625a8f106c3bf3bd21e7ce74b4ee4b72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659267, "uuid": "5691e353-09d1-4121-a334-f707f9882c38", "comment": "Malware payload (QuakBot)", "value": "4532a5d7f8ca8408ff12c0478c0d3392125c1b67", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659267, "uuid": "250c239f-8732-42ca-89c8-47e105199b86", "comment": "Malware payload (QuakBot)", "value": "061889c1dbeb64ae10e6b3fc846869c2b5fa43d17946eb5ba480854473ea93eb8b1434598410bbb081f36549bf8efd90", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659267, "uuid": "582092b7-e1ec-442b-aeab-fd060c014033", "value": "29549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659267, "uuid": "d01a95ab-c9a6-410a-97cc-a61712849830", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659267, "uuid": "76f4e706-93d7-43fc-9d34-6c46fabcf40d", "value": "3072:k3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZgsZ:Ivv9sMoXBaRmr/dukbvuZ/7fVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659267, "uuid": "69ea43ba-e326-42e6-ab0e-14ddeda1340e", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659267, "uuid": "6d9808a2-fadd-4fe1-9e02-40944caed5f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659267, "uuid": "85a10a4d-ceb0-4ecb-b9ac-8b02b581c7cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7abb90-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659272, "uuid": "bb19a3a7-e9dd-45f6-8dd4-d3eaa8817042", "comment": "Malware payload (QuakBot)", "value": "e2ee89539cb0c385919afb71f405a91b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659272, "uuid": "a4607cd9-515e-4dae-87a1-deccf4cac839", "comment": "Malware payload (QuakBot)", "value": "103e904a77350ef667ab62f071d08daf64087adf32620b6cd1bd0fdd044212d4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659272, "uuid": "49b653b8-a979-4fb3-a6ca-13534b94083f", "comment": "Malware payload (QuakBot)", "value": "d32d65b04ab2245f35970f6eeb41a8c364ea81c5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659272, "uuid": "31aa2836-d032-4e41-8e9a-d9882e018f2d", "comment": "Malware payload (QuakBot)", "value": "fc8d64dc6fb9f692c9e96e554cc9052fae6c61811090400fa9ee91ee7cc3a965cb5e668fc52d41839003f0cc71ce1d88", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659272, "uuid": "2c6e3271-7481-4daf-a6f6-036a7e294cb9", "value": "E0549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659272, "uuid": "9dd06e8b-2f56-4c88-af93-d6725d2f5e75", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659272, "uuid": "fa3ae37f-0ba1-4a7d-a7db-8e68214410ca", "value": "3072:L3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZEK:Lvv9sMoXBaRmr/dukbvuZ/7f/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659272, "uuid": "ba99e141-c3e1-41cc-a14b-1589f875b9c2", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659272, "uuid": "d74e6da4-3364-481a-b484-25efbc4467cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659272, "uuid": "626875a0-7806-4d3f-972f-48e809ad8b9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d947166b-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702077, "uuid": "f9e05c6e-7d50-4d50-b49a-0e9ed5068fbd", "comment": "Malware payload", "value": "a1cccc4ba11da4aac7c87150a2f326bc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702077, "uuid": "495d5810-71b2-4afa-8eb1-a08666be8c67", "comment": "Malware payload", "value": "1047f4fe15d7cbac21cb67d750daa8213a157c1d1b630e7f507d7850fa30ada6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702077, "uuid": "10c9c470-3206-476d-9895-b1d334c58e88", "comment": "Malware payload", "value": "3604dccc4aa91ff7d37d95f0fa34b72d62b8fe0e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702077, "uuid": "467608d9-8b71-4d5f-865c-4c5d7fc7194b", "comment": "Malware payload", "value": "945c2ddf0796f298226e417b0ebe3233eb097eda3cd966414a25c6e132cfe698013b17e3294cdd55f532f7e14ca3630a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702077, "uuid": "418e79d0-225c-4e4d-ac3d-2cc888711576", "value": "8533F2CCC6CDD33294F578315C79CB02E578AAAF0816859181F74A9BBD07AE56B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702077, "uuid": "ae13452b-7134-4265-b46d-8d7e7f8b6ecd", "value": "768:qwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2j:XFugXVpoD8ZxhrLAuNS07MrxrKsYVOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702077, "uuid": "8e836940-1792-4173-a0cd-6b711b098641", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702077, "uuid": "c9035964-742f-446b-99ae-dd3d8fa144b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702077, "uuid": "b0ade34f-c61a-4430-a164-334b387e3b01", "value": "catalog-88957265.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed30b3d-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706140, "uuid": "879922f5-2469-4b53-9aae-33cc5c4f1625", "comment": "Malware payload", "value": "26a5c70ed12d38e8d357b105b2361c61", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706140, "uuid": "3f28f035-08a6-4bb4-b711-2a2055d6f962", "comment": "Malware payload", "value": "104df57914056e99a9093be89e0f80f90de37b96d3f74e126a3b6b8c8c21a372", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706140, "uuid": "674d27a3-ef71-4dec-9b8f-b67ed1517f1d", "comment": "Malware payload", "value": "d108a4bacf6353800901e93dd9e03fad24190eb1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706140, "uuid": "cd4d21cf-e756-4826-8381-0bce9dd8fa0c", "comment": "Malware payload", "value": "ba453c1cfb2e6d082e214c2a9cb93554469a76bdacc128f2ea8f05f59f050d3dc59c178125134e5cef9496ab7b2fc325", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706140, "uuid": "4ead662f-b317-4aa9-8aae-5da3dd14e07f", "value": "9433021A4CAEB62A972E04B48548DB5FE91364EE386DC2515C5CB079EC063E8077F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706140, "uuid": "4d127cb0-ca76-4ca2-8b76-6f299a21cf01", "value": "1536:HP6z4+ADViS8CWoD94pUnQ64x11RiCY8L:vPZBiS8jopkUQ64xq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706140, "uuid": "8c1219a0-557f-4377-9554-564f6a5423b4", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706140, "uuid": "b2da6d1a-c450-4623-80d9-7cf59e4eedd9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706140, "uuid": "5840f2f4-28bf-4ad5-a5d1-06df20941f61", "value": "statistic-2067981170.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3246b0bb-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659277, "uuid": "c161bffe-a257-406c-a647-e8f5bdefbb79", "comment": "Malware payload (QuakBot)", "value": "d7ebf9e1771e93571d847f9987a6ea06", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659277, "uuid": "2683bcb4-cc42-4f8e-8fba-85bd5b7c1ccf", "comment": "Malware payload (QuakBot)", "value": "105737fdee79e5b33b7ebd06058036c4e6f43c1e466103de4b66a04b72d9b38f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659277, "uuid": "e9e15b1e-126a-4b5e-82a5-7aab950b2059", "comment": "Malware payload (QuakBot)", "value": "d92f84a856ce88dd02b735632ba33791c28ce75a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659277, "uuid": "8722b7f6-376a-46f3-9abe-e557f84487f6", "comment": "Malware payload (QuakBot)", "value": "02030d11be2ac59c76ae22d0415d39cb686892c36b2b15f496252251070114787263efed75b0b0f9f3451d91abee9b50", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659277, "uuid": "f7c606b8-d9b5-4bfc-b089-097701b648cf", "value": "5A549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659277, "uuid": "55b7bf07-7b38-404a-9af9-d34762d1e473", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659277, "uuid": "20823f3f-498c-4ef2-b681-f4f71ea5c9ad", "value": "3072:P3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZY1:fvv9sMoXBaRmr/dukbvuZ/7f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659277, "uuid": "6f26b66a-4ca9-4e2b-85e7-d979a1eaf9ae", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659277, "uuid": "7e2282ea-68a6-4779-b1f7-b99459075eff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659277, "uuid": "56e930d5-ec12-4306-87fd-2c994deaad8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0944469-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702036, "uuid": "85fdeceb-4269-49c2-8a21-f392aa7ce7d7", "comment": "Malware payload", "value": "dc0c50ef89587e3d6c2103dc62248d1e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702036, "uuid": "390299a9-edcb-4ec9-b033-bedc9c58a5c7", "comment": "Malware payload", "value": "1058f337a9543548fd6571e92c359d15ad8a6cc24db853d80ab6a3aa78e01b06", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702036, "uuid": "79a106ad-3c42-4362-976e-f01c03de3ae2", "comment": "Malware payload", "value": "f51a23d7f496c6660c04bb445da740358d6ebe63", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702036, "uuid": "5a3cd61f-7976-4043-a718-3c0afaeb1f06", "comment": "Malware payload", "value": "67ffbd32d32500881544f924f2819e0ca9a0fdad9e21636c5ef050f6c2ee3ff5e41e94e79798f1f1b235151556e38b77", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702036, "uuid": "f9586fef-4279-4043-beab-04a761701ff9", "value": "27330289C1C8D336A8F579319C79C702C578AAAB480BC46281F74AABB907995174FDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702036, "uuid": "9912082d-cd0e-4b49-8ed3-aaf8dbb9bf2a", "value": "768:ywnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV26:fFugXVpoD8ZxhrLAuNS07MrxrKsYT6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702036, "uuid": "6ad5377c-2473-4fb9-88b2-7cabfe96c2da", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702036, "uuid": "0c7f45d2-c661-41c3-a3b9-3b95d4f50ee4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702036, "uuid": "b912d543-452f-4ba5-bfee-4be7f5eea480", "value": "catalog-85585347.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef4fe30-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702758, "uuid": "5f649be6-196a-492e-8122-f33337e99e5e", "comment": "Malware payload", "value": "752c1c59eeeb1dcca46ff06056aabd79", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702758, "uuid": "f577c101-0ac3-4edf-aadc-25cab31a6b0e", "comment": "Malware payload", "value": "106098a87b5f5155727f769f8a0210008a2ae41a9ff62c21539d0034ed943ffd", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702758, "uuid": "9df71222-db5c-4ce0-b621-4b9b8373cc18", "comment": "Malware payload", "value": "0a6ba2d9cf7f08b2fc4a7d083075548d344660ac", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702758, "uuid": "2d690432-b33b-49d0-8b4b-b26ed969990a", "comment": "Malware payload", "value": "7b8daaf85f74ee606360d02b92639cac81d0821017fb860130b8ea362d4a8fe92b00111de6831819109e6c6993331add", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702758, "uuid": "807ad1e9-d2bc-4dcf-bfff-5624f51b8cb2", "value": "1E33022588AD773D537D10E085859F0EE91B2C9A3C1DC1D21D8CF8A6EC05669117FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702758, "uuid": "8f5fb343-bafc-47de-8b4d-1f8b5ade310a", "value": "768:B9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCQUQ:0P6z4+ADViS8CWoD94pUnQ64x11RiCQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702758, "uuid": "0e109677-a15c-47ec-8a44-0d1e67708793", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702758, "uuid": "d45e68da-17d3-4ec5-9a24-51497bf1f2e7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702758, "uuid": "e57c855d-59c6-499e-a3aa-716869a7c1ea", "value": "diagram-1441970451.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f99d7dc-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699752, "uuid": "c04c6561-079f-49e7-8033-8bdac129379c", "comment": "Malware payload", "value": "5279a5be8866d95f6c1f80c2cfbe06b2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699752, "uuid": "ba71c298-63bc-438a-90a5-48f89c05caf4", "comment": "Malware payload", "value": "10711dd98df40e1f3c3cbc88d6b164c79fb587657b15fd206603a77bc17db129", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699752, "uuid": "661385bf-8512-44db-a8fb-ead3a0456588", "comment": "Malware payload", "value": "68c8bd021b64f71fe811a56724478f9f0b9130d5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699752, "uuid": "b37f7da8-13e1-4f27-94bb-a2bf4fceebb3", "comment": "Malware payload", "value": "58db9fe47a494a6ff4b0ac9c41a747e1724a3fe38c0c9227d8efaf1784be3b09d94c0fd0c2e7f7f791779545c06e135e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699752, "uuid": "955d56e8-ee80-487e-ae0e-5174f52ba2cd", "value": "A13302C8C689D37698F17835AC79C701D968AAAE0817C56183F34BE7BC07D902B4ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699752, "uuid": "e36036c4-5d4e-4b04-a62b-e032af0d2b2b", "value": "1536:0FugXVpoD8ZxhrLAuNS07MrxrKsYZh+WT4:eq41rLZNkZLY3+Wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699752, "uuid": "240c95c8-a229-4514-9422-b463da03afc9", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699752, "uuid": "94fc8668-7ecb-4d6c-af38-5f1c37c415bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699752, "uuid": "9717033b-d542-423b-a51f-7b9eb5b7ac7a", "value": "catalog-1012635566.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353223a3-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659282, "uuid": "a17e7baa-4867-4cf7-92b8-a4a5237ab06c", "comment": "Malware payload (Quakbot)", "value": "43e1948a165ac8efac2c7bde5f4dfb43", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659282, "uuid": "d7186845-47de-400e-91ab-aa709f8efecc", "comment": "Malware payload (Quakbot)", "value": "108ab9526a6e6927e2c34ddb6f512ddb04d991ef1a0530815aab3a6e9c293f1c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659282, "uuid": "734d4f93-b168-4cde-b116-a6883816e642", "comment": "Malware payload (Quakbot)", "value": "d6dfcd093a2656978cc737ea8d65139267e75d8e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659282, "uuid": "82642afa-de92-4ac3-bb69-0abcc91ca987", "comment": "Malware payload (Quakbot)", "value": "8739e2d7032f055b8771cdcbc5a803e430558ce590efbb399755d478592b07ebcffb6f841f296fe2ff4b1bacdb52d65e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659282, "uuid": "689ce3cd-1e02-4a71-9c70-49b14125d115", "value": "4E549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659282, "uuid": "d1a1baa2-267e-4f6e-a315-74574785c559", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659282, "uuid": "8de3a263-5e6c-4404-99ab-3585440e73a8", "value": "3072:h3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZxb:Rvv9sMoXBaRmr/dukbvuZ/7fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659282, "uuid": "5b7e553c-baff-4271-830f-3027e534c37c", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659282, "uuid": "2432d5a8-1652-441e-bdee-e0c3df12497b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659282, "uuid": "f9290cc1-1f57-41d0-8eac-0c45e562af5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f58609-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701461, "uuid": "293243a8-aea1-4f7b-93d9-865252247900", "comment": "Malware payload", "value": "7208dace5278be2ab548a9833fcc8e75", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701461, "uuid": "6b9edc68-1226-4845-a28e-629ea1a8a81e", "comment": "Malware payload", "value": "10926146a9e09e10121c09f51a9809c607d68330ce5c85d61e559872c1d6e916", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701461, "uuid": "a9adfd1d-26e6-45ff-9187-0b42c4f540df", "comment": "Malware payload", "value": "281172773a389ef57069cef519c513aff21a308d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701461, "uuid": "29c72a70-56ff-4e49-a68e-ec64266e9cc5", "comment": "Malware payload", "value": "6639562f16ee77f93cd6601900a33ccd1cbccba5b75e92342a87d9d18ba1e6f4bffcc399061cecc190e3ef2351fae01f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701461, "uuid": "e67f0621-e7ef-4f7c-8831-c411f3bdf59d", "value": "97330188C6CCD232D8F274316C7DCB01D978A66B441B85A281F74AE77D47EC56B099DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701461, "uuid": "71fe001b-e627-4783-85e0-9d806654139c", "value": "768:lwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV22:EFugXVpoD8ZxhrLAuNS07MrxrKsYySNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701461, "uuid": "5b9effd8-6d19-467b-8fd2-3ffbdd39f3cb", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701461, "uuid": "b0e7891e-83f7-4dd1-b625-353b3f561856", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701461, "uuid": "8a12a84b-6ceb-4790-91ba-db913374a6a6", "value": "catalog-401991187.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db8e7a2-a926-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619726700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619726700, "uuid": "00a5a2b3-500e-41c6-8122-445da42e86e8", "comment": "Malware payload", "value": "8fea19de05aacd26134a588c0371fc7e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619726700, "uuid": "8f8a8db8-ff54-42b2-9447-e3fca0e0ab61", "comment": "Malware payload", "value": "109d4fafa7e99a56ab137400921aa0f5b82ab509430a44dfdd313e251f5b4946", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619726700, "uuid": "85851c6b-8817-400a-8e99-488875936489", "comment": "Malware payload", "value": "9a6f5f74ea2689fdbc6fce6efea1ab1862dd262a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619726700, "uuid": "dbed0756-8984-4995-974c-cd43e68e7b60", "comment": "Malware payload", "value": "806a03ab969b03b2cf204f4db206034a4b26ba49e12a47e9e87aac62cc9d888769eb16a833a49ca6d0473abf2d7d59f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619726700, "uuid": "09623b6f-1479-47aa-8a65-988d6642e73d", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619726700, "uuid": "5a45a0b7-4386-4f6b-879a-14700aeabd2d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619726700, "uuid": "f465e55e-4dbe-4f99-80d1-cce160885066", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619726700, "uuid": "b7c9b6a8-e1d3-49c9-b628-c8dfadce2079", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619726700, "uuid": "621ccd99-d045-49d7-9183-7efa06672688", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619726700, "uuid": "07c2e726-4a7f-42b6-a7e7-b92fbbb7fe34", "value": "8fea19de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653bc6a4-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700164, "uuid": "e686ba51-003d-41aa-82f3-809bd367ead7", "comment": "Malware payload", "value": "fb14780ba28030541bbc170b7379b3be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700164, "uuid": "84353e6e-e512-4d70-a606-f060d84d655a", "comment": "Malware payload", "value": "10b179d7b5faee04b50e0f78c30f9c02bfc2489e11e2496a48eae558648bfbd0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700164, "uuid": "b6cc05b8-6b72-4b83-917b-39744a62496d", "comment": "Malware payload", "value": "53e36ce00000dd7b53879d68095cee26eb48c290", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700164, "uuid": "acd58eb3-1263-4361-90e6-2d59e7088de7", "comment": "Malware payload", "value": "b92472ea042ae2c4cce2b60afbe83e1c5174e1f29a1b37da4ba5659f1f3d541fb0ea3277f376b1addeaa62277ffb2bad", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700164, "uuid": "c88b41ee-fd03-4a06-a87b-8c42447dbc6d", "value": "A533018CD588E231E8F63871AC79C701D978AA9B4817959681F30AA7BD07D91274FDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700164, "uuid": "de296aa2-e9f2-4d26-ba00-791559b0e5ce", "value": "768:lwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2H:EFugXVpoD8ZxhrLAuNS07MrxrKsYmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700164, "uuid": "8b54fe83-da32-4deb-b618-6557e2230172", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700164, "uuid": "c78529cf-c1e2-4da8-ae23-d4858b091931", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700164, "uuid": "bc8479b5-c90f-4126-8fa9-6ca909020512", "value": "catalog-1318356397.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183efb53-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702612, "uuid": "98b8b073-3f7f-44d1-9fb0-e13e76c41fc9", "comment": "Malware payload", "value": "18331918bbe71f949fc2cdea1d95b67b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702612, "uuid": "3385cb84-f58b-4a0e-b775-4d66d8b7a37f", "comment": "Malware payload", "value": "10c58a0483168588b598d0db788c5f03ccceab48c9f7a55ec4f1422e7daff6a2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702612, "uuid": "5a208d4a-eab7-444c-8e36-a2c972a57f7e", "comment": "Malware payload", "value": "fb25ff9eae7941c360e363dbaf67e67ac8137168", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702612, "uuid": "f683a797-bfb9-4e14-ace1-6ac45a1aaaf2", "comment": "Malware payload", "value": "88c4abf03e0a7fde5bd5b168e05c1d670241246b733f6e133d905d55da18969f72f688aedb3722d71448e668c8fd23f3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702612, "uuid": "366bcbdf-0b89-4b22-a025-f0663c93c31a", "value": "2033022A4D6E7A2D532D10F0C585975EE21B649A3C2DC5912C8CF469EC05BED123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702612, "uuid": "b2b03687-9a33-406f-b966-3247ea4d559c", "value": "768:w9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpWM:RP6z4+ADViS8CWoD94pUnQ64x11RiC0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702612, "uuid": "4787d92a-d142-4085-a69c-de89a02583a0", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702612, "uuid": "e61a7129-1c34-4060-acfe-e760d3305ed1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702612, "uuid": "846dcca8-82d4-425c-8862-821827496161", "value": "diagram-1337709326.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f52c1a-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659286, "uuid": "f05050be-b8af-4ad0-b6e5-2a1492127a90", "comment": "Malware payload (Quakbot)", "value": "d13ecd591dd7c039de55507fd87fe256", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659286, "uuid": "362da999-18e7-4b89-a701-5e715387b39b", "comment": "Malware payload (Quakbot)", "value": "10e70a2a069eee62f335f27dc7bc7a7ac3919fb3429594c5b3c522ef711f0a81", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659286, "uuid": "3cbd3804-9f6d-4886-9417-3c9a9d027f1c", "comment": "Malware payload (Quakbot)", "value": "9eb2da85be0539a5b9c82a086d8c6c7b8d5d080d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659286, "uuid": "4d91adf6-ccef-47fb-91da-b036f21e59fe", "comment": "Malware payload (Quakbot)", "value": "2868e0a1702753b7f69c20d81e0c37b69a95af2d4256a4a9b55a3bbc8009339ec7987a1ce72be12b56211ff9b869f9be", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659286, "uuid": "0d4df354-efd5-4177-ad30-de643ff7c664", "value": "E7549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659286, "uuid": "0d9caa67-5bdc-4f28-b662-0a612c06f865", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659286, "uuid": "487acc33-45f5-407c-a3ea-d548ef8c3f9a", "value": "3072:j3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZYL:Dvv9sMoXBaRmr/dukbvuZ/7fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659286, "uuid": "771145e2-a2dc-4650-b11e-c6811a37b37f", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659286, "uuid": "500b7f12-5648-4c1c-8a86-32a3dce13b75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659286, "uuid": "c23ec480-926d-4819-8c1d-5bb8ecbde94a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5309e465-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702711, "uuid": "b33ecea8-6add-41b9-aaf2-3ba7c6b1ae83", "comment": "Malware payload", "value": "494c29801fbc82aa8a9e91faf6b5ad80", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702711, "uuid": "34f756ae-b6a8-48de-80a9-f8fb712e2963", "comment": "Malware payload", "value": "10f23d60c6a3826db3dba5f0089670ae238b98a2e8945c52b82a8c20e17e1ba8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702711, "uuid": "ac178e18-be05-4601-9401-8fae8148376e", "comment": "Malware payload", "value": "4f85d913d45f92219ab749916945cdb944650744", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702711, "uuid": "06b44560-b5b6-408f-b827-ab2c656a8cd1", "comment": "Malware payload", "value": "0ffb06d05bfa693e766f0587bc8968c6761e59b7650749f3ec1d43aa5a596bb90658c3fdd50b0e2b48c319ea62b267a0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702711, "uuid": "9d6a4fd8-0377-40a4-b6bc-3beebfef8d23", "value": "9033023F485DB62A577C10F5C589CB1DD507689E386DC9821CCCB826EC096A9153FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702711, "uuid": "53a6656d-bcdc-4268-8490-7b578722a5c6", "value": "1536:KP6z4+ADViS8CWoD94pUnQ64x11RiC+mpA:EPZBiS8jopkUQ64xcmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702711, "uuid": "4a85433c-5e36-4699-9243-44027103efbc", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702711, "uuid": "ee04a426-3fe8-4edd-b670-24807a68b67a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702711, "uuid": "d0d1079c-08f7-47b9-a527-2c8de5f259df", "value": "diagram-1409625830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab8b59b-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659291, "uuid": "9c5f5594-bb11-4fb2-b511-e32f8b9ab594", "comment": "Malware payload (Quakbot)", "value": "96155909702ea20629a7efb9ca0671db", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659291, "uuid": "fcafda43-a87a-4077-aa40-317e84aaceb2", "comment": "Malware payload (Quakbot)", "value": "1104426a3b0d2c9d0f229855685051717f9fa83a9bb98e1a30aef4dbef2b9679", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659291, "uuid": "68e5bb0e-9534-40b5-95ce-802cf73efd4d", "comment": "Malware payload (Quakbot)", "value": "38de2b7669ec70da7effb75f28b4432deeac52cd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659291, "uuid": "4bde3f7f-90f7-4f09-947e-494c22758851", "comment": "Malware payload (Quakbot)", "value": "d4aeca4550af510c393bf20328769509dfb27d113e84d8c7835685d7c60e53f106321f6f7a19d2ecf056498b191f35d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659291, "uuid": "4e940256-f2ff-4a7e-b3a6-8d0703196e0e", "value": "0B448E7EBE12DC23E25C2BB056C35F581A6BAAD53254210E1AB19F186CE73947C37F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659291, "uuid": "b4610c33-c4f1-4391-af08-6ef80cf8026b", "value": "6fc91e135f967218c3d36d0b14484e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659291, "uuid": "3e9a5d1b-78c7-4cd2-94d8-7db471f88e02", "value": "6144:hwxqaEeZ4POyKmLrLqGvHr0nNK11G9DFr:OHEnxZrkNK11G95r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659291, "uuid": "3f2ef518-5b38-4c90-9e25-c54954fe8e33", "value": 266728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659291, "uuid": "7d078e1e-9793-49f7-9847-088e93516bcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659291, "uuid": "65e640d3-3b97-44f7-b643-581ce2fa92a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc62ca7-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706490, "uuid": "9e56b3a1-e9c8-421e-b984-6e0b8cb50e34", "comment": "Malware payload", "value": "70aa5d18b4c87126001636cd5c49ec03", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706490, "uuid": "47d61db0-d7a1-426c-9c2c-3b40ffdf0567", "comment": "Malware payload", "value": "1112e4926490cd5ab19909d24c202ce3f923381c51bc81c77d822fa5b9415759", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706490, "uuid": "d38e31a1-06a0-4c85-9630-09b3b5b73919", "comment": "Malware payload", "value": "2eb816120d5f9c658a419f65bc39150fd9822737", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706490, "uuid": "86dfde18-7cd7-4d7e-ba81-ba94bed855a7", "comment": "Malware payload", "value": "7d7a815f1d0beaefc5ae6fb3f5154d9fc60612dce26084a8192927970ffcefebedc48a431dc4deae95b16970050ee418", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706490, "uuid": "4ca1a250-3111-4eb0-81e2-86f2653575cf", "value": "8933021A5CAE762A573E14B08948CB1DD65764AD38ADCA812C9CF472FC053D8223F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706490, "uuid": "56feef39-28a5-48e9-afc6-1f813be2455e", "value": "768:n9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpl:yP6z4+ADViS8CWoD94pUnQ64x11RiCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706490, "uuid": "0461a376-002a-47ab-b67d-7c258a979569", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706490, "uuid": "76b7d7aa-776a-4ca4-8001-5042dc829f9b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706490, "uuid": "8ff4cb5d-a3df-4484-a3b2-b678d0249444", "value": "statistic-383046563.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d60bf3e-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702272, "uuid": "ca179587-b702-4450-8177-010a406ff8d3", "comment": "Malware payload", "value": "28d58bdc5883d6e4e8cd40e47e4e45f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702272, "uuid": "ed12ffef-34f1-4f55-baa0-9b336c46602e", "comment": "Malware payload", "value": "111f7ae1280320975c47f1168cdc7b2764e8350360ddbb306a927a5c0ed96606", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702272, "uuid": "798d5490-ef53-4173-8e00-dc875c35f220", "comment": "Malware payload", "value": "f11c14698de92ac96c3f506247e956e9796210a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702272, "uuid": "a0564f06-9bd4-4b7b-a8da-e10fedc5d245", "comment": "Malware payload", "value": "328416b76b3dffa888ae7143c2ddaf6637a98f25734ff86d632240c9502e8cacca9e70fa0788f362d20920938a891537", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702272, "uuid": "4a664c65-a917-448a-bcd4-a1760f00eda5", "value": "7833121A8DAE7A2A572D10F04945CB4FE657189E3C2DC6864CCCB4A6EC066D5063EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702272, "uuid": "e07a3752-8dcf-4689-9c8a-4cc4ab5b3a68", "value": "1536:IP6z4+ADViS8CWoD94pUnQ64x11RiCFb+y:+PZBiS8jopkUQ64xjSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702272, "uuid": "2cc3fcb2-2208-4a7d-b0e5-6fb83ce10a0c", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702272, "uuid": "7c8088c9-9d2b-4b20-9c8e-184344d3b3be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702272, "uuid": "d83861d8-62bd-451a-a60a-fd2195546d3c", "value": "diagram-1026912982.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08117034-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705592, "uuid": "463dbc5c-01b5-4afa-a64a-73a9057d9a48", "comment": "Malware payload", "value": "22de1c741ed50f7279171ee03794ac8a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705592, "uuid": "0abafcf2-8c4b-478a-9a5a-cd57b133af61", "comment": "Malware payload", "value": "112700bbaaa5ecd875a19685b8d5e8340196cbee80dfdf6397f8b1f136d9d1f7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705592, "uuid": "d5fb7876-8c1f-4807-b358-31d72755ab7e", "comment": "Malware payload", "value": "81867c822ad98f63d7a6033541fe90b897fd2b48", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705592, "uuid": "d5a59ee5-f63d-427c-8d7c-8d4cba60939c", "comment": "Malware payload", "value": "7b3e12830d11bfa5fb1d2c148748269d2f1e572dc134b7d4b51e9521190f577e9dea0ca1bfdb431d4927fd7ad936819a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705592, "uuid": "06ba8162-33d9-488d-8251-142a489c4ec1", "value": "9F330219989EB629532D20F045819B4EE9536CEA3C6DC9416CCCF8B9EC092A5127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705592, "uuid": "60ce8d4d-8631-4fdb-ae0f-a39392293461", "value": "1536:tP6z4+ADViS8CWoD94pUnQ64x11RiCoa+Q:ZPZBiS8jopkUQ64xR+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705592, "uuid": "d0460223-e223-4b68-a899-35ebb0bdee45", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705592, "uuid": "6c498e6f-dc7e-4c29-877d-1337e243072b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705592, "uuid": "2224207a-9d80-47a9-b32a-70a65ac85cbc", "value": "statistic-1624726735.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7e4f54-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659296, "uuid": "c948ea34-679e-4bb6-93c7-2402429f0307", "comment": "Malware payload (QuakBot)", "value": "e769483a62e9ec7de30c1d06006532e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659296, "uuid": "e3be54c1-0b12-43b2-86dc-7886670e6557", "comment": "Malware payload (QuakBot)", "value": "1129050cbfc41aa0c965e8a674362ddf4f1ca1c6caabd29d3e9a19fe4b6d68d4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659296, "uuid": "5dbe64a6-5c01-4fea-af49-3af4c34b21b5", "comment": "Malware payload (QuakBot)", "value": "97cb2a180bf441c558b4188189ce2ee1501c90c0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659296, "uuid": "1a1e734a-0278-4d05-9cf2-475cd89369fe", "comment": "Malware payload (QuakBot)", "value": "26cf382e039ac627a89dafdadfbf2d11d174348e7c4222e0e936fcc9671b871099f5917fcb8ae1afbca5d4c7f636fc21", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659296, "uuid": "39067b90-e916-4988-8322-1cc7341379eb", "value": "D6549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659296, "uuid": "ea95d46a-15a9-4acb-bc49-3d5bef5ff8bc", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659296, "uuid": "825e390d-02f1-48ac-afa0-86bd8a305e85", "value": "3072:H3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZnZ:Xvv9sMoXBaRmr/dukbvuZ/7fH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659296, "uuid": "ae1df3cd-ba74-4cff-9694-3c779dfded40", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659296, "uuid": "6ad87eff-4e6c-4d56-a7e5-3da0318bab28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659296, "uuid": "e8b7c0d5-20ce-452d-bc20-8f7cf199b6c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4042ad35-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659300, "uuid": "7462a385-d0c9-4f78-b559-5924736f8144", "comment": "Malware payload (Quakbot)", "value": "b5c9620ed9144c93ba02bfa4312709e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659300, "uuid": "d56906af-0630-408a-bf51-15dded502b2a", "comment": "Malware payload (Quakbot)", "value": "114af16fe7ad5d2b81dd50dec7755fbf89ebc9e40a4b3adc8cc48d5d49b66a3f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659300, "uuid": "aa458a4e-f226-455e-bc34-9ab92923ea1e", "comment": "Malware payload (Quakbot)", "value": "c6232c0e226947615918069d0c6791313b0a618b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659300, "uuid": "494276c1-93be-4a06-8403-ddc442907f88", "comment": "Malware payload (Quakbot)", "value": "cbdbb6e46d9d914581b27c767823bfa85c3ffb96b2ed83aeb181c25582ff21a820e0aea793a1e99c32a7a794425c6141", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659300, "uuid": "0922852e-0310-453b-9da7-a2da0825f7dd", "value": "5674BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659300, "uuid": "24436207-683e-4339-9497-be42b264561a", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659300, "uuid": "0209e5e9-4c5e-44b4-9eae-987cedc6ef8a", "value": "6144:FnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu2:KFrkNK11G9AEtMxQyOi6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659300, "uuid": "6148ddb9-4b85-4950-964d-638506f1c308", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659300, "uuid": "35fe2252-6f17-4b69-988a-d3594b3a4dbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659300, "uuid": "2c0e48a3-7cbd-4ed0-b891-7b0d491ba247", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4308414a-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659305, "uuid": "7577ae25-66a1-499e-b91b-b2794676f6f4", "comment": "Malware payload (Quakbot)", "value": "e006a79ed5305c8babe7014318b3c636", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659305, "uuid": "f96236dd-46f2-4f0c-85a7-6d60b5bbec56", "comment": "Malware payload (Quakbot)", "value": "11560600c2dcae2c4a26641be5ebec031e0037baa18d4cb6c76e9dc4579d97fb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659305, "uuid": "b846c510-3935-4624-929d-02a188319e3e", "comment": "Malware payload (Quakbot)", "value": "7d9862103be949595382263fd15ed41a0f314f69", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659305, "uuid": "75a057f6-1b3f-4801-8f1a-d7181391eba4", "comment": "Malware payload (Quakbot)", "value": "a5b43106e4caf9e38bb9d8a9e3cc77309a32459ce0297bb62fdeb5f1f4252151f0b485d95882377c040b0d7f2c1ccb83", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659305, "uuid": "7a36440c-c7bf-4931-aca5-32de99731552", "value": "8B74BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659305, "uuid": "e36ce61b-3f83-48a6-8a12-a02f33d58ea2", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659305, "uuid": "2db6ebc2-b0c1-41a6-800c-e67ea3fdeb7e", "value": "6144:FTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRun:Fbi7/xZrkNK11G9AQyOi6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659305, "uuid": "dbff7428-ff01-4782-94ac-728972755486", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659305, "uuid": "8737dc84-d446-44da-8836-aa1f4c7e2628", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659305, "uuid": "5039f8d6-de9f-4e47-8309-51f2e1cf06c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eada384-a8b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619677739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677739, "uuid": "df90268e-f27c-49b1-9eb2-9abf9c4c16ff", "comment": "Malware payload (Loki)", "value": "bad16f2f48c3719ebf09ca6e948b7c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677739, "uuid": "83e8964b-f53f-4ec4-8d2e-98dc8cc4a1be", "comment": "Malware payload (Loki)", "value": "11704c25e0bb0eb2ffc7664800e55ce6b38d14642943b3555f146540dc518921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677739, "uuid": "659db967-7db6-40af-8c01-b47cbcb5a035", "comment": "Malware payload (Loki)", "value": "50f5704a712d04e4a2a90e9443b0968418b2b4c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677739, "uuid": "c17251a5-66b7-4a44-be2d-5e5d97bf81c5", "comment": "Malware payload (Loki)", "value": "fce03cde06ee7c547291891ae622db1d9e2bf0f81ce4703678fdb8826ccd039abe052bfa3dcbab37c377cbd884e825a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677739, "uuid": "e9068896-61dc-452d-ac02-705657cd35be", "value": "F2455ADCB50064EDCA078E3297EACC3182112D746A3B950E53963B7B7B7FE536A34486", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677739, "uuid": "dee9dae3-2555-4d77-8185-7a9fb81190a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677739, "uuid": "7a52209e-cb0b-4f3b-b96c-8345edbc69e3", "value": "24576:WeUhTiam/oLA4t2rwD4mHd/2cAj5/tQ79yKMR1q:4hTv28D9d/2cALQRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619677739, "uuid": "624d31eb-f56a-4ca2-ad44-32dac8680828", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619677739, "uuid": "036e6ed6-ff56-4faf-8348-878ed3a3e585", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677739, "uuid": "08dc8a3c-466c-4007-91f7-4c69e6d626e7", "value": "DHL INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d637bdd-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705842, "uuid": "104da605-caae-4c2b-86d1-aac4a34d6358", "comment": "Malware payload", "value": "239fa95ad96dc465035de1c30ca17f82", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705842, "uuid": "15929fb4-66fc-4538-9ef3-fd0f23e65b5f", "comment": "Malware payload", "value": "117fefc953e18e21cfdaefb31a81d4fffd1f91a8162708f705c560e8b5087a4c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705842, "uuid": "4716c89c-0ba5-4ce6-acca-c851bc46dcb7", "comment": "Malware payload", "value": "07c615cc1b4626dfa9d229713e8bca8120e6b7db", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705842, "uuid": "7d73729c-7467-445a-bb9b-1d5b0bf3de59", "comment": "Malware payload", "value": "64e03b1d73a6afdb75829d63fd3d9eb2bfa5e48161d78ca092473dd2685b97713048ee83160cd879cc1fca0dbf2589c2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705842, "uuid": "b757b0d4-5b5c-4ee3-8a16-1c42d3a3bd01", "value": "EE33021998DE7629532D10F08681D74ED9536CEA3C6DC9416CCCF8B9EC092A5117FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705842, "uuid": "86d8ec56-72fc-458c-a185-ed36d6970133", "value": "1536:+P6z4+ADViS8CWoD94pUnQ64x11RiCAa+N:gPZBiS8jopkUQ64xF+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705842, "uuid": "e37fd47a-e7ef-4218-a251-802babf0f39a", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705842, "uuid": "2cd3f3bc-57a4-458c-8c0a-2e9e9646afaa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705842, "uuid": "c7cff3f5-e211-4e52-83d1-b970060ed7a3", "value": "statistic-1822898507.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f0be9b-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659310, "uuid": "d4c5df0a-56ca-48f4-a2eb-fa49db829f3c", "comment": "Malware payload (QuakBot)", "value": "7a2b3bc4eb5b738621457f4c6bdd22f3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659310, "uuid": "8da6ccdc-0847-4db2-a87c-120d637f4221", "comment": "Malware payload (QuakBot)", "value": "1185d83fc577f1c7d5979e7e063a92bb1bbf756a889d7e7e4ded6dae252c9f5f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659310, "uuid": "5e820eac-c32c-4797-90f7-a2fa9d4dbd51", "comment": "Malware payload (QuakBot)", "value": "0fb538fbbfc9eb293e48cbae9680b122e1c1ef74", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659310, "uuid": "24190b90-63fd-4da8-86b7-059ce5cb6e26", "comment": "Malware payload (QuakBot)", "value": "55c0193e17b4c3829144fd8c11124361b00e4a162f444f09062b322be961d7bac721b03d47f037aa2993b5797b7f445a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659310, "uuid": "a99e3b6a-c703-4ffc-a7db-b58ca8c9c150", "value": "EC74CF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659310, "uuid": "5597a78d-f8dc-4c3d-8940-7c64b711218c", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659310, "uuid": "ec892a7d-ed5a-422b-83b6-e2e2d3b4c7e4", "value": "6144:MTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuI:Mbi7/xZrkNK11G9AQyOi6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659310, "uuid": "54e06dee-cf70-4cba-a786-3ea8f746a783", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659310, "uuid": "cfab8332-eda9-473f-847f-c60a98dcc652", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659310, "uuid": "e3838251-3045-4be6-8981-40ddd7b07059", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663024cc-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706179, "uuid": "c11580cf-da24-4597-b9b0-f08f70bced63", "comment": "Malware payload", "value": "ada03c9eee2eba97a15832a16e25a4be", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706179, "uuid": "61774739-671d-4ca8-a2ae-1ec268a65054", "comment": "Malware payload", "value": "11864ebc385c29804cbd6975472e2b2cb383494fd0837b4c46b3507046e766fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706179, "uuid": "f2440bd9-ccce-4eb7-aefc-a0a236db4186", "comment": "Malware payload", "value": "bbe0462a57cbf3e7b1338112835d493a2e530b42", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706179, "uuid": "2acb6b4e-49e6-4be5-ab1e-be0e8ad9c22d", "comment": "Malware payload", "value": "3e7ad178e22a013c03e3402563610b8851cd65a59caf4fadc591c0c895d68cddf74baf74c6044c82c149291342f15e50", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706179, "uuid": "75b0d1c0-cc7c-4216-bfb5-5ef5349b0163", "value": "A533022998ADB61D473E00F049898B4EE20318ED386DC1925CDCF4B6DC067A9563EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706179, "uuid": "438b36fd-c107-486a-bbc3-c4edf102a91c", "value": "1536:FP6z4+ADViS8CWoD94pUnQ64x11RiCfgdD:xPZBiS8jopkUQ64x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706179, "uuid": "b909c6e1-1e67-4fd3-9e4b-a762e9319350", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706179, "uuid": "4bdd8b48-46c0-4e25-bb2a-f36e0beb6c72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706179, "uuid": "5353b509-7f92-4910-a10e-a27ed42a1f0e", "value": "statistic-2093373531.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b2392c-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659314, "uuid": "43888ddc-e58b-4019-8831-3e2dc49fe810", "comment": "Malware payload (QuakBot)", "value": "c41d3e2e4424560208cf8443312b8690", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659314, "uuid": "1953dff2-26ff-431b-b384-d592e6125268", "comment": "Malware payload (QuakBot)", "value": "118a05606967f590c2f009c242f394712163fa3076976b2b83350918745d9ac1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659314, "uuid": "10b92578-0330-4471-8171-eb59a5819868", "comment": "Malware payload (QuakBot)", "value": "4172559fc56fd04fee210c20c42caa7f09ff372c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659314, "uuid": "24052293-1d85-40c7-836b-c8bf5460bb9e", "comment": "Malware payload (QuakBot)", "value": "59fbbd7cef207953d7926b92fa96b2650344af7d7a19a2fb29afc4242efa5dc0b0d8149b6dc34a840a64950a09bf073a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659314, "uuid": "bc243969-1860-4b03-a2b6-45e317ca431a", "value": "13549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659314, "uuid": "e890a905-0ca2-4d66-b6eb-da6eba1ba7fc", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659314, "uuid": "c84441d9-263d-44f1-942c-5815222071b1", "value": "3072:g3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZkk:0vv9sMoXBaRmr/dukbvuZ/7fJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659314, "uuid": "82d75ae9-27ec-42d3-a491-e3f5dce3c065", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659314, "uuid": "92d5364d-2f1c-49bd-a161-dd3410a8511a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659314, "uuid": "e9e98e22-984f-49ca-9b4e-885c7d6c2fd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485585b5-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705699, "uuid": "3c3593b8-bd3f-427f-8ffc-fa9786e6e1ad", "comment": "Malware payload", "value": "9e7244c94827b9480375a9a3027acc43", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705699, "uuid": "799e2a28-5e0e-44ed-a6fe-3b384b870234", "comment": "Malware payload", "value": "118b3e6644f1555a41eac9be6630031d216c596892e067d21f23d115c110ca53", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705699, "uuid": "a7348d63-3d4f-4973-b094-90e8c83fa4dd", "comment": "Malware payload", "value": "c1eda3073d3a2a35152567d351079b8dfe19e57b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705699, "uuid": "9df08563-5137-4d96-a06b-e4788779e866", "comment": "Malware payload", "value": "7529bed51ac25a9ec5137a6bd5afea6ef3f34307fde5e0d461191e654b245cf392663735912678f469c6f5f4be917d08", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705699, "uuid": "951d6b06-3e91-4a8e-8e94-de9ac32fdc85", "value": "8C33F116486E762E673D10F08686870ED653A8DE786DC6011CDCF466EC02AE6267FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705699, "uuid": "ee880966-29a4-4f21-a1f8-a2c4941e02f2", "value": "1536:uP6z4+ADViS8CWoD94pUnQ64x11RiCisKW:wPZBiS8jopkUQ64x4sKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705699, "uuid": "d95cb234-4aae-4e39-9fab-065a5b3e3269", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705699, "uuid": "84e9b86b-9ea9-4c4f-ab6e-f8ead5081677", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705699, "uuid": "b6008b9c-a16c-48c5-8679-eb384fd16f1d", "value": "statistic-1701145331.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e21ae7-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619733995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733995, "uuid": "221e5bc2-a598-4a34-b80b-37dcc09ec990", "comment": "Malware payload", "value": "90faed9cdab22f225324fce9a86d600c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733995, "uuid": "f8f3d4bf-7357-4aaa-b272-af35e5449989", "comment": "Malware payload", "value": "118badb9788aadf19379324d80b4a09369fb532e29874d5450bb1498f2ce8b06", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733995, "uuid": "af88205e-9cbc-4e9b-88c4-a93ed99a380e", "comment": "Malware payload", "value": "3355f762c65055b3be3b973233f23e912f5a2cce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733995, "uuid": "af5e3a2b-a8e6-4167-9691-b6ec002b0569", "comment": "Malware payload", "value": "d452a9eb6fe7e413594bfe49f0c8010783743814896c13195b49c2efa20991ae4b30911a3c32d54d354f27895c11ec1f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733995, "uuid": "ffd8cacb-2275-4a4c-9d09-4bd6ac85226b", "value": "44F3CF82D702C1ADFE212C7A28E677753D5837905E54CA69E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733995, "uuid": "b6410fde-fbc2-43bb-93a3-6a4603bae41b", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733995, "uuid": "ec949358-1bfe-4f95-b6f1-0d900349cf6d", "value": "3072:lJ5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh89H6:v52j4pk5zMbVO6/HUIXU8KgMy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619733995, "uuid": "bc7a43e9-64c1-43a0-8e2d-f3fb3262270d", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619733995, "uuid": "6d3d5ccb-326f-4c9d-9d77-d85c43f6fb31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733995, "uuid": "7cc21497-61a9-44d7-aec0-2a951939c9c0", "value": "90faed9c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b77cf2f-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659319, "uuid": "17354df0-f92d-4310-9092-8a4476759f52", "comment": "Malware payload (QuakBot)", "value": "de68d91dc6bb5ec924288a0cafb8934c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659319, "uuid": "437d5a45-2988-43d4-a9df-2eb1a162b1cd", "comment": "Malware payload (QuakBot)", "value": "118fbde33e48b61d5c55bbdbef83bc5540dd9fa686ef9ebd2e589f56435ff81a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659319, "uuid": "e9c94731-d3c7-484f-a341-35b9b0c07046", "comment": "Malware payload (QuakBot)", "value": "6b1b525cca5361a8c7837e35cac5838d3854fa05", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659319, "uuid": "0f78d03c-f382-421d-8332-785c4a47329a", "comment": "Malware payload (QuakBot)", "value": "2267aae2ab34a8eccb9e8d69b981981cd49603ab8b016f6c6b17fe0a1dbb90cc7c7538839c12404d511f76eb45d5c2b9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659319, "uuid": "4b632b91-9ab7-4649-b4b2-66a1439a0b76", "value": "3574BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659319, "uuid": "a40b939a-f16a-4e4f-b71e-3f4e636310d4", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659319, "uuid": "61eedc7d-752b-4056-8af7-5de2ecd8e0db", "value": "6144:mnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuY:JFrkNK11G9AEtMxQyOi6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659319, "uuid": "aa7c94a9-ff90-4fda-b833-9d6031c9b87f", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659319, "uuid": "19889bbc-f2a2-4980-926a-164e92348d5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659319, "uuid": "dc658452-414a-44db-9e8b-dc94971cc6b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e556b90-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659324, "uuid": "7e28c735-ac57-4f3a-b6d5-a0590aeadb8f", "comment": "Malware payload (QuakBot)", "value": "7b07731269c9c473312edb5600a13811", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659324, "uuid": "c07a7ddd-3973-48cd-a181-56bf850fc91a", "comment": "Malware payload (QuakBot)", "value": "11a6d785ff1ab7067d1a5fc3afeaff682cfcdf74dd7e43ad2e81bf76449346b5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659324, "uuid": "5b020ea9-fb32-43fa-8432-b2c58669c1a6", "comment": "Malware payload (QuakBot)", "value": "6b3d94626bac0bf90c2e5e3320ace99c1403cbd5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659324, "uuid": "244487ea-e35a-43bd-82ec-8e65bad6d4c8", "comment": "Malware payload (QuakBot)", "value": "2f13a97c52afd51ecc179d73aa30dd7a959e901dc1f0694c8a27018269b1b66a92e7e5fc9a9519b71d96a7d92bc29888", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659324, "uuid": "02b11e14-ab2b-4929-8762-dee586fb3c1f", "value": "BF549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251A55F55F587EEA3883D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659324, "uuid": "bc39e495-ee2e-4501-8c81-908d650a7769", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659324, "uuid": "d03f23d2-529b-4cd8-9120-ca487c3495d0", "value": "3072:E3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZE2:ovv9sMoXBaRmr/dukbvuZ/7fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659324, "uuid": "f9506e16-8571-403d-80b8-d590bb4ccd67", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659324, "uuid": "099c1d75-c92e-4a98-a50e-944fb3218973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659324, "uuid": "a8caa0b8-f713-48c2-9b1d-bea9864fcfa9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5120c20e-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659329, "uuid": "7dd86c21-eea5-4bce-b23b-3cc2f231d325", "comment": "Malware payload (Quakbot)", "value": "a4d5e836e2737b0e00eb53b6025e8cc3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659329, "uuid": "177b5aa4-2308-49ac-8abf-5d8c3e2f864d", "comment": "Malware payload (Quakbot)", "value": "11ac2516f489775aca578c04b813aba81fb4b043cdb54b5f3d3b7237ca589246", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659329, "uuid": "b0c3c3c4-53f3-4c18-b561-6ef1ffb2d461", "comment": "Malware payload (Quakbot)", "value": "932bec9f8170ce3ecf3d8d1581d7ecac1b4bb63e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659329, "uuid": "c8eb1e10-9eef-49f4-92a6-3721b8d6555f", "comment": "Malware payload (Quakbot)", "value": "35f56893112d9408292d042e10872be80f625eafa925719c0bd5ad54061bf0eb43321f7b208ad01f0edacd12fdc95bee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659329, "uuid": "8264037e-e4ad-419b-ad3e-ef13ae0d8fda", "value": "CB74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659329, "uuid": "17f1527b-32c9-4040-b4ff-29b13c82254a", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659329, "uuid": "617fbd5b-9c0f-4a1f-9a99-35c95b040385", "value": "6144:UnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuK:jFrkNK11G9AEtMxQyOi6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659329, "uuid": "58431671-ee77-4861-819a-b9e994d7bcc4", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659329, "uuid": "f803dbf3-2200-42f1-b2ec-3e08a1f21802", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659329, "uuid": "8a30140b-eb46-48ce-81e3-c059ac3974ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c80098-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703655, "uuid": "2dd5acc5-2a17-4e55-9f40-ec51ac4ed8b0", "comment": "Malware payload", "value": "d563f9f5980b34bca2b14ef9ce56e3df", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703655, "uuid": "640f7016-0d44-47c7-9e77-f6121b6b7f31", "comment": "Malware payload", "value": "11b5b59f31e550ff5fb6a8f6a4ad10cc854c6e7182b5c42185d3ce09ac1a7552", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703655, "uuid": "c42f842f-fa09-49ed-8d84-a717f717eda1", "comment": "Malware payload", "value": "554cabf6c2f3e66787385dbb3a67cc2aedb883d3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703655, "uuid": "aa2e37de-fb37-489c-8784-5c9e86b07923", "comment": "Malware payload", "value": "f00a08dc050d41e6120a928a6b68670b4841fd59877f4f63f47cdbdb73cea7dcaf9e02601309d6877ee7abf91f33e2f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703655, "uuid": "b34ba971-1071-4f1a-84a1-d2385fa5ae0d", "value": "2933021A4C6EBA29173D20F40549CB5ED60B64DD38ADCAC11CDCB46AEC056A9163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703655, "uuid": "02b0d11e-9eb6-40bf-b779-569b2001eb99", "value": "1536:9P6z4+ADViS8CWoD94pUnQ64x11RiCatF:JPZBiS8jopkUQ64xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703655, "uuid": "4d570bf8-0d8c-4b06-91d2-d6d6ee162855", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703655, "uuid": "8f93527f-dc6d-4317-93bb-600ea518e467", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703655, "uuid": "ec28231b-4fba-4d2a-968b-d424c4e655e8", "value": "diagram-2054175318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7342d29c-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702765, "uuid": "ee476325-bc2f-4335-96b7-a2ff23076567", "comment": "Malware payload", "value": "8f70ad720825a2eb719cf4a7aa780b4d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702765, "uuid": "e105c3c9-703b-43f8-8be1-57bbbd0ed412", "comment": "Malware payload", "value": "11c51c5d29fe9ab040fd28a3b046855515296615aec71e3ef7335bfa57856619", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702765, "uuid": "894518a8-c3b2-4abf-81b5-f7314a5bb490", "comment": "Malware payload", "value": "d8d2bc1378fe31034e788107461d5e1dfa76f256", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702765, "uuid": "0c20f793-c737-4d6d-ab37-85722e0657c1", "comment": "Malware payload", "value": "940ca5a1ead5118964561955a7f0e3f21d34be08519e6fa5b6d63eefe4fe271c1889ddc764c5bd8dc6175b5e4d6f3a5c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702765, "uuid": "fbf070a0-e4f1-41ba-8933-c209602ae9ea", "value": "06330229496E7A2D172D10F0C9CA8B1ED50B588E3C6DC5462DD8F8AAFC057A9017E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702765, "uuid": "a5fec28a-84fc-4e18-81f9-a79617ab8ce7", "value": "768:i9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCo5:rP6z4+ADViS8CWoD94pUnQ64x11RiCo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702765, "uuid": "65e4e35b-72a3-4c24-a2ef-bec3eef55fc1", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702765, "uuid": "3ebeac78-2203-437f-b171-a43e72ed1b13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702765, "uuid": "ba57cc52-364a-41d8-8170-1f70963af3cf", "value": "diagram-1448497452.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d61d83-a8e0-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619696587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696587, "uuid": "235420d8-0484-4b35-9d95-05c37a41188d", "comment": "Malware payload (Dridex)", "value": "d5735a8248a22e4536e56ade396ff9d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696587, "uuid": "c66e61c3-b826-4339-8518-cc3a98461193", "comment": "Malware payload (Dridex)", "value": "11e137b514f7b00061f8eb874a927a9a4426087bf1b76018d15bd7a7ab3834a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696587, "uuid": "6c885cb9-58de-420d-adf2-dd55719f8b2a", "comment": "Malware payload (Dridex)", "value": "69d03004321569b74ae4a1fd336cf1155ad9bf4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619696587, "uuid": "86e941b1-de68-4c57-81a2-014cfea5c4de", "comment": "Malware payload (Dridex)", "value": "2a61a3aaa5991c25586d6aaefd102ee8f4c4ca6797f96d791c9ac011022312dbff53b211ccbef7720160fcb9ca47a970", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696587, "uuid": "4de06d51-00d0-443a-8f7b-e649b852340d", "value": "93F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696587, "uuid": "ef5e039a-9d8c-4345-8ad9-b3801d9c4d21", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696587, "uuid": "0eda4b35-e769-457f-be5a-496703fc00a7", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619696587, "uuid": "cafac6a1-8a9f-4103-8d9e-0dc864d385c8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619696587, "uuid": "436b9dd4-698d-42bf-90f7-2e459db93e11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619696587, "uuid": "f011b2f1-ab2c-4907-ac26-b5cc59de2659", "value": "d5735a82_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43edd66f-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619734039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734039, "uuid": "c546506c-b153-4584-b889-d7d967daafa6", "comment": "Malware payload", "value": "a9f8ad25c1981c8629bf1239df4c5b88", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734039, "uuid": "3edc8505-8fc6-4517-bf25-f131f880f704", "comment": "Malware payload", "value": "11ea21155e3eb10daeff662211de13b2d7c37f9dafe7ba1a6930806dc2987093", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734039, "uuid": "25fe90f9-850a-4ece-ba1d-9761dc3f6a3a", "comment": "Malware payload", "value": "caf55e75e9705d6d72282a3fcbfc9346aada19ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734039, "uuid": "6cfbc20b-5bec-4514-be2a-cb21280fbb6e", "comment": "Malware payload", "value": "e66c3a958b141dfa956d8ae49fabe72de46d671e25cf7579816b9081b1a2e1e6cee1708e281b1cbb414f72be8edc461b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734039, "uuid": "c514e4cb-8013-4359-b88e-f33c00742b91", "value": "18F3CF82D702C1ADFE212C7A28E677753D5833905E58CA68E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734039, "uuid": "aaf7aa0d-3018-4bfa-b345-7c237dff44ff", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734039, "uuid": "ef8ae6bb-fa4b-46e8-a9c7-41d4d8a882e9", "value": "3072:pB5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh8zH6:P52j4pk5zMbVO6/HUIXU8KgMyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619734039, "uuid": "dc5aaa8d-2b3a-404b-9810-1ac6e1519a6c", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619734039, "uuid": "8f64b80a-6606-440f-a78d-debd666e3ad1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734039, "uuid": "83a0f251-53bf-4006-a278-818af616cb35", "value": "a9f8ad25_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ebe39b-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659333, "uuid": "8fc6866b-70f4-452e-9e35-c7fc37db9e35", "comment": "Malware payload (QuakBot)", "value": "77f0b896f57a2f3bcd3af96d78b2c2fa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659333, "uuid": "b626cb01-b8f8-4f06-ad55-3cbea4481d2a", "comment": "Malware payload (QuakBot)", "value": "11ff867b279d74a1609cac73f9896eee657ae0e79cc1d35144e71e68d4247146", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659333, "uuid": "249c85ca-6003-4e95-8d3d-b655ddc084b5", "comment": "Malware payload (QuakBot)", "value": "2a7084f48f3003d1c54e5d52f4ba75222a4a0f16", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659333, "uuid": "880cede1-fdfa-4111-ae32-1affc8e8b9d7", "comment": "Malware payload (QuakBot)", "value": "eac148ab5244063a9e721214d18caffbba184cbd6044a13fe395575d236e3c90a0a0dcd2ec306189160d6f46c41e14fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659333, "uuid": "1b5face6-2708-4446-9391-ceb739bdc1f4", "value": "AF74B07DBB17DC23E26C1BB062D35B581A53DAD63250210A1AB19E58ACE73E47C37EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659333, "uuid": "4d139831-805c-4fdd-bd24-7c1e9d1f4c3b", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659333, "uuid": "5faffb44-7502-470d-a715-146374bfab50", "value": "6144:FTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuX:Fbi7/xZrkNK11G9AQyOi6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659333, "uuid": "fb989aef-7066-4cef-93f0-904d5f47be5b", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659333, "uuid": "0f275a0f-49f8-439c-80cc-981ac364ce0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659333, "uuid": "48e8e2e2-ae66-464c-98ce-e2ceef69f68f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b299b6-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659338, "uuid": "fc2f9282-3a5c-494e-9b75-2f0cec8b7999", "comment": "Malware payload (QuakBot)", "value": "33f55b306de6aaac370e82cf82f73e89", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659338, "uuid": "93e6d44e-5621-4a19-bebc-688234a96f7a", "comment": "Malware payload (QuakBot)", "value": "120a9ab49c4245a7b484b2a81fcf5afb1304f10c71543d286cd3e6cbe11f8ed6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659338, "uuid": "3b2f3db0-736b-4a1f-bf00-665371bc18c3", "comment": "Malware payload (QuakBot)", "value": "f6d47c39d53e77927b73ae665a0897cb0468dec6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659338, "uuid": "fb0fc59d-6530-43c4-905c-8fd03eedc8bd", "comment": "Malware payload (QuakBot)", "value": "abf17055435ad70c82d2d40cc548ce276eefdda7e7eff5d546185155d4f03fb98106a7f1439d14dcc605b03d13c3ae3b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659338, "uuid": "7935fbcf-f6d7-4d32-aef5-d14c85c2b2b7", "value": "1E549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659338, "uuid": "2fa6db0e-a2cc-4d0e-941c-b2ba6113ed22", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659338, "uuid": "2324cc53-66e1-416a-871e-91621bcd3077", "value": "3072:l3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ1c:1vv9sMoXBaRmr/dukbvuZ/7fE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659338, "uuid": "0cc5bfd5-72ec-4a2f-8044-3e47f9fc86b4", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659338, "uuid": "ff9004d6-1cdd-49bb-801c-ea78947f39b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659338, "uuid": "eaa00e2e-a270-4ef9-9f92-c6d33c461431", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbe2505-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707430, "uuid": "325fcaba-0e44-46e3-b09f-276be3417365", "comment": "Malware payload", "value": "63dd3e5d361bc5a0d14e4d724b940208", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707430, "uuid": "745c11a9-7d01-4b7d-9ae8-51141dfe138a", "comment": "Malware payload", "value": "12109d445d102558b217a9d2fd5557c46c5fb1273f4ca670fc4801cc1a21f7de", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707430, "uuid": "06e1dc0c-6cda-47ba-8e06-ee85c7aabac7", "comment": "Malware payload", "value": "0756baa9f23eb2969b40f5afa838f635c2b8602c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707430, "uuid": "80481f0c-c33f-499f-afe5-9edd627a6e84", "comment": "Malware payload", "value": "546a23f8191753c5d45244e0c09c043ce1d32911d8c58a42af111a7804128a63905de6c5cfd7eb5f8209b2c6f411e3cd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707430, "uuid": "6686b54a-1717-4c18-b8a7-0e3840bb453d", "value": "083302294C3DBB2A577E00E445859B4DE647289C3C7EC68218ACB076EC0A2E5167F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707430, "uuid": "2bd8945a-e5c4-4489-b7b6-a5334086d190", "value": "1536:rP6z4+ADViS8CWoD94pUnQ64x11RiC92d:7PZBiS8jopkUQ64xud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707430, "uuid": "8078d7ce-6c59-48df-a44e-ec903fe079eb", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707430, "uuid": "02cd5587-0e09-4602-b63c-9339b1511f13", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707430, "uuid": "e75627dd-5fd0-4d24-b6f3-ccae1b26ac50", "value": "statistic-968612636.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f10fad8-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704986, "uuid": "07024c34-7b34-4979-97fe-9b9f346c9b3e", "comment": "Malware payload", "value": "31c716dc58976b6badcf945cc8a3cb2e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704986, "uuid": "7eec6e0d-72c9-4d2d-8954-4024104763a0", "comment": "Malware payload", "value": "121a912a766fe9ef2fac5b822f229609c2824c52dba86a0156cad50301441eec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704986, "uuid": "3fabc6d6-9b3e-48b3-8cf3-d0734e1c22bb", "comment": "Malware payload", "value": "6d68aa6f251d703d93805306b6d23966441083b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704986, "uuid": "bd4974ec-a980-4d93-a8ad-a015da5a72b4", "comment": "Malware payload", "value": "367764fed639ea45e01e0a622396071e816168f0f5cb116488e78e74c29acba77ce2f1bbe35fcc0e52aece29f344a31b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704986, "uuid": "4dc6ecdb-f2a3-4a21-bd9e-4f2afb62e72e", "value": "2D33022988AD7629536E10F0C6C59B4ED9832C9D386DC6425CDCF47AEC06BD9123E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704986, "uuid": "defbec8d-6bf8-4646-a43c-461400cdb9e4", "value": "1536:TP6z4+ADViS8CWoD94pUnQ64x11RiCy+V:jPZBiS8jopkUQ64xfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704986, "uuid": "21ef2dff-bdf9-4a05-b5df-3fe91343850e", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704986, "uuid": "55b5c6d6-937c-4b03-8ad9-42404d239323", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704986, "uuid": "540e19ff-f3d3-44bc-a4ad-e40925b9e3cf", "value": "statistic-111531874.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d2fbf0-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704675, "uuid": "9eb275e1-f6d3-43e0-9b1f-2f643c4a0e32", "comment": "Malware payload", "value": "adc3559681581ffac5afeb63dc8a93f2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704675, "uuid": "0b703c57-5637-45c8-ab7d-02a91a44632d", "comment": "Malware payload", "value": "1220d645e8a68bcc51c3c1b0b776e8fdd2c37e1c9881aa54ce17cfcc7bebb014", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704675, "uuid": "7aa0815c-20f0-4c53-8364-1bfda4a07fa1", "comment": "Malware payload", "value": "0c02d98da41874a332d7326960f11d4358a76fdf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704675, "uuid": "50587b3d-c037-4591-a8ea-7eee431d0f3b", "comment": "Malware payload", "value": "4944dd6d882387376b5cf5411620b8813fa4a597e3da06c8372b4e9f9be6c29c8ae06f6d4971797fb40036187b61c7c9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704675, "uuid": "939a14d2-0565-463e-9fdc-1d45dadd7eb1", "value": "8533012A446EBA2E577D10F44588C71EE517A4DE386DC9932C9CB876FC056A0223EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704675, "uuid": "6170d2fd-3d6f-4b31-b8e0-34b9991536ad", "value": "1536:OP6z4+ADViS8CWoD94pUnQ64x11RiCR7bvnXy:QPZBiS8jopkUQ64xH77i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704675, "uuid": "08edee93-20ae-4e36-947d-3774d45d6b5b", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704675, "uuid": "199b71d1-e068-4754-9c35-e17f5244f68c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704675, "uuid": "04c3e704-e9f6-46df-b1c5-ce2d1c9d4cbb", "value": "diagram-907342716.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598a7d4c-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659343, "uuid": "1c2006de-c1ae-42e9-aee3-1e7ff99a2f80", "comment": "Malware payload (Quakbot)", "value": "20d07b264a8ea488e133b1dbd77d3e01", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659343, "uuid": "aae11b44-dd64-432b-843c-de075bf3c572", "comment": "Malware payload (Quakbot)", "value": "1223dbdc18b0abe7e5830e12ca5dcf788adb8a5c3f0c3370dfb1a2c877106cae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659343, "uuid": "bcc46f52-7cb7-4351-a086-088cdbdaf9b3", "comment": "Malware payload (Quakbot)", "value": "e594b240c74b58ca7f51ae0124ad1cd1b26b6b00", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659343, "uuid": "8b4a995b-cfb8-408c-ac81-5dfaa6bb2d4c", "comment": "Malware payload (Quakbot)", "value": "1fb63a4660f239a343d11d32d1684ab43c02bf56c86ec5ebabd57f2ba68707563ef754d482ab3ba9a4f9b2eebfd71893", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659343, "uuid": "6affb75c-3e60-4dae-a87b-8634fe3eac68", "value": "4C549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251A55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659343, "uuid": "8cca110c-144e-4b00-b172-25fedc1855e1", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659343, "uuid": "f894d84d-7047-4580-8a30-d12963391055", "value": "3072:63FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZrt:2vv9sMoXBaRmr/dukbvuZ/7fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659343, "uuid": "c267049d-1681-47d3-ac28-2c521f59428c", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659343, "uuid": "c5c11bb2-9cda-4628-b914-60639eb4d2d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659343, "uuid": "a3a05aad-8bdf-4baa-84e6-11bbb5e4161e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9080b023-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701526, "uuid": "9e41d227-34c3-4762-9e72-fafc515196c2", "comment": "Malware payload", "value": "fbad5b2501de8251075a455e212df177", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701526, "uuid": "378555e3-9497-42bb-bb9b-f115225276cb", "comment": "Malware payload", "value": "1225c0e1ed17cce2969a1bd2a7ed1adb546afc08a97c427e223a7e67ef89df59", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701526, "uuid": "bb10d393-9858-4b1d-bf2b-e7a604a81029", "comment": "Malware payload", "value": "5aa3ee42b36d9ad6044b961b4f93b93e31c8ceb0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701526, "uuid": "c1acbccd-2b3b-4711-bd50-e4cd6754847f", "comment": "Malware payload", "value": "cf35ec3405e88f0cf50f3ee60340b53509911baafed34acdd36f0d4231aed91f6e8b979d3d81ce329c8d2b24811fb40a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701526, "uuid": "3bb468a1-335d-4b82-a4e8-1a3ca113fbec", "value": "7B33F288C6C8D332E4F57535AC79CB01D97859AF081BC5A281F78A9B7D07E85574ACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701526, "uuid": "7fbf778f-e2d4-45f3-b597-303602a6e82a", "value": "768:DwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2I:iFugXVpoD8ZxhrLAuNS07MrxrKsYzI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701526, "uuid": "ae4c4527-1cc6-4496-a004-c449e3050116", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701526, "uuid": "e7fcfae8-9d8f-4b43-a039-15f976a65a10", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701526, "uuid": "1f3adddc-b5e4-4234-bc43-6c60d3b30030", "value": "catalog-449197941.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5688bd-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659347, "uuid": "3f080a57-5e9a-4445-88ef-c444518d38bd", "comment": "Malware payload (Quakbot)", "value": "5a79443e1398187cdf9468c2bcc30a7c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659347, "uuid": "c6db0185-ee23-4b56-8487-a0933322f567", "comment": "Malware payload (Quakbot)", "value": "123efe1d63030167a1e61714ff82cfd2c56815a9e3405d5072c43e2a47c874ec", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659347, "uuid": "3cf50516-2d03-45d8-a21d-7a314e8d344f", "comment": "Malware payload (Quakbot)", "value": "c81d38b5707b3474871e60e964ca8d154f5bb6ab", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659347, "uuid": "d3376977-13ea-4254-87a9-86c5a0ae7b70", "comment": "Malware payload (Quakbot)", "value": "2f711c180c6be53025e2cc6826215f429404eceb631f60dd7eef3a75b12d02c8ebe6a728bc7393d1af20685a059c48d5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659347, "uuid": "9b228125-df79-4ad4-b999-dd0c9af169b3", "value": "11549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659347, "uuid": "a2f487dd-a563-44c5-9b01-427ea179aec0", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659347, "uuid": "de6ed605-4e6c-47e8-a444-5d5e8460ce81", "value": "3072:G3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZn3:ivv9sMoXBaRmr/dukbvuZ/7ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659347, "uuid": "fe9ea434-fae9-41cb-aa37-8a9df35f46aa", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659347, "uuid": "ac6025c6-8389-453c-a33e-0e31f1af8fda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659347, "uuid": "259b6cd4-3a55-4408-953e-21e19c5576a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35ba8df-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705530, "uuid": "c7b9a514-8ffb-465f-95f5-1f18cfe3581c", "comment": "Malware payload", "value": "dd00462e9f595fc36ed932543b0a1c2f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705530, "uuid": "f2fec09e-95db-41e6-9969-7292579aeea4", "comment": "Malware payload", "value": "1251eafa857b8747a554504d0818817d32ab2a3725251e744e517d558378b625", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705530, "uuid": "4f7e445b-9b32-432e-aeed-6092640b518b", "comment": "Malware payload", "value": "b9431a283af0762d0c571b7f3a4bfe072e422c4e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705530, "uuid": "b3a3f0ae-e2f6-401f-a482-6f923e08519f", "comment": "Malware payload", "value": "f368735422213aa46be1529be87806ee61d1df1c67ef57af3f81cfb6f6fcef108c632d4280dbef747948e3f07c8d9bab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705530, "uuid": "50a7a130-a539-4523-8c60-0b3ba62e8393", "value": "0133011658AD7A2E577E20F44542D74EE91799CC386DC6811C8CF4BAEC087A8053FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705530, "uuid": "dcbbc412-8f12-4c9c-b313-fc9bc22d4ee7", "value": "768:69cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCrR:jP6z4+ADViS8CWoD94pUnQ64x11RiC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705530, "uuid": "38c2d974-334d-4db0-b453-22158e8830af", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705530, "uuid": "e8e292d5-fd7e-4ded-80a5-222036549001", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705530, "uuid": "2e39957b-cca0-423b-863e-f1e237d49762", "value": "statistic-1568724814.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf49cf25-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706355, "uuid": "01698522-45af-490f-a201-b264ea391c8a", "comment": "Malware payload", "value": "0d64709b8f1f1285cdb0760dfea9e7c1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706355, "uuid": "dd8cb6c1-f216-42fd-b9b0-37265ff29767", "comment": "Malware payload", "value": "125212851ed1f8c79286388982cae1b22050289072aceaa3c58a33b8f89dd629", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706355, "uuid": "91cf40d7-be19-401e-afe7-a11f7bfd9bba", "comment": "Malware payload", "value": "fa4700e8f7a9d4b523f8decb0cbc5851fc24a534", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706355, "uuid": "a170d653-5df0-4e31-bb84-d84ddb627386", "comment": "Malware payload", "value": "a4fa036271be2a9910f8f68453b49e7bd8c529cdf15106a1920d51c6c5c2786a308e60906bf3c3e3d0c9da19554c8544", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706355, "uuid": "931b5cdc-e1a2-4454-9e05-fe133541379f", "value": "7233021A4C7DBB2A577E00E44585DB4DE643289C3C6EC68228ACB475EC0A2E5177F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706355, "uuid": "bea3a103-703a-4ae0-8365-673a3ead9f89", "value": "1536:9P6z4+ADViS8CWoD94pUnQ64x11RiC92u:JPZBiS8jopkUQ64xuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706355, "uuid": "45a9570f-7396-4af4-be16-a0cbfa7a8b05", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706355, "uuid": "fea5a5a1-d06c-4fc3-b0ea-8760b833bc9e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706355, "uuid": "776cbd38-aa72-43d9-bbca-0d139df22638", "value": "statistic-306695418.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2815d4-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659352, "uuid": "93368399-99c3-4680-8138-24b9a0b2517c", "comment": "Malware payload (QuakBot)", "value": "bdf528ea6e1433dc678594c7ef54d379", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659352, "uuid": "4f243b6a-4b84-4e87-9c53-421709d255dc", "comment": "Malware payload (QuakBot)", "value": "127b17f67cf4b006389e517067909ec6c96f61427339ad20321cce6a17690508", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659352, "uuid": "50f3d918-7aaa-4d16-909c-dc660adabdb7", "comment": "Malware payload (QuakBot)", "value": "00b43749feb9dd531a8665046e2781ce8e312f59", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659352, "uuid": "63334d4e-8092-433c-b18a-4dcec46d9f24", "comment": "Malware payload (QuakBot)", "value": "5a546be07d4ec3bef2477cd861097e8556a9e18cee223e87a78845c9be278ad3b0abc4beaf1e472d5198c971608f340a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659352, "uuid": "11a9733e-ca93-4af6-89bc-47ee6b98c31a", "value": "5774C07DBB17DC23E26C1BB062D35B581A53DAD63250210A1AB19E58ACE73E47C37EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659352, "uuid": "1611db7a-c816-4d07-95ff-f0dde61635f5", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659352, "uuid": "64c4151f-04f8-4518-b552-e1af34517652", "value": "6144:FTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuq:Fbi7/xZrkNK11G9AQyOi69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659352, "uuid": "b7baba53-47fe-47da-9f52-58eb91b5bf09", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659352, "uuid": "474cee2d-835b-41bc-8d6f-7e37ca3dc852", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659352, "uuid": "cb8712f7-a4a8-4079-9e2d-cec00c586532", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6405efb9-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703169, "uuid": "02633ff1-27fa-42cb-8434-b55c49b0139c", "comment": "Malware payload", "value": "40844ca28fd323b856b1330b0bfb10f1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703169, "uuid": "3e4c4cf3-1e16-4e4c-9e62-a7ce66d10d04", "comment": "Malware payload", "value": "127b4b4fb56f165c500d30b236ad25469787a5871189ab8fe6bf70c7c3b942db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703169, "uuid": "d096e63b-e951-466d-b425-9ba8a8f2f637", "comment": "Malware payload", "value": "e3e66488a2d0d115d40c46238584959a17e34ad9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703169, "uuid": "19772058-e0a3-4b7f-b1da-8a8ca5de9c00", "comment": "Malware payload", "value": "abccef066ab514ac51fd4764a81b9df11c173b8f0d7b16eef1a7853ea3a201afea1950986d8e0505ee737e7599b60dd7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703169, "uuid": "7904f11e-7706-47de-889e-9bb8fd337db2", "value": "7133022A485D7A3A533E20F485459B1FD54B28DD386EC9951C8CF4B6EC056A8123FFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703169, "uuid": "882ccc01-8127-496a-a8e4-d752a2ecd55f", "value": "1536:/P6z4+ADViS8CWoD94pUnQ64x11RiCS5KhPm:nPZBiS8jopkUQ64xg5Kh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703169, "uuid": "e4789ce1-d9e9-4a07-8b54-4834bda95f28", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703169, "uuid": "cc48bab9-5d97-490f-95b0-1b9f68578618", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703169, "uuid": "6280d781-a9e7-4591-9472-299ca43b9591", "value": "diagram-1783089591.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0eb35b-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700691, "uuid": "f74e9e68-9ce2-4e90-a7ed-7f340ffaa0fe", "comment": "Malware payload", "value": "e2e7012b4e4374444250f658a6985912", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700691, "uuid": "ea21bb21-67f2-47f0-8257-bcd8a40d740b", "comment": "Malware payload", "value": "128323d7281c250c863be044eb6a6288cb6b78361df448fd9ae8a47c185e80de", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700691, "uuid": "a31de6fa-f0e5-493d-b9d1-957ff5776270", "comment": "Malware payload", "value": "af48751e3f38b86e470198d225484041a32c82a4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700691, "uuid": "5aa08b45-04ba-4584-899b-5f2142550377", "comment": "Malware payload", "value": "116668cd4d12c2806875feebfd0e8ff67fe74ce97f5c19173d987eb946a9af38785f091409a7c1a74bbaa978e4b65e28", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700691, "uuid": "9e88dc13-5966-430b-ae53-61a24c7af403", "value": "C933F284C5CCD371A8F17535AC79C701E4B8B9AB481AD5A282F78AE7BD079C10B4ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700691, "uuid": "1c1a56e5-e9fb-4b52-964d-43f70e6d70d4", "value": "768:cwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV28:xFugXVpoD8ZxhrLAuNS07MrxrKsYOrc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700691, "uuid": "a164fb85-9bb1-4deb-b5e1-188c80ea274c", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700691, "uuid": "e5da8d99-5887-4f12-98f9-46beff9d4c92", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700691, "uuid": "8a4df90e-0ce7-4d4c-9a5a-8b76e6319f9d", "value": "catalog-1742446860.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76078e1-a8c3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619684465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619684465, "uuid": "33743437-6df4-487c-bfed-d8f34dc8ca19", "comment": "Malware payload", "value": "d45e3ae2fdc089a7d7596c59915e7e1a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619684465, "uuid": "4cd9a387-4b1f-4640-9c33-ccb668b076db", "comment": "Malware payload", "value": "129ff4250518a15d8d27b06dbb3035f0d4485b42456ba04f38d98e1a1da7eb5f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619684465, "uuid": "f93a3b06-3faa-4710-a95d-1c5c4b405b80", "comment": "Malware payload", "value": "abf196f0eec9f0a4a24ce60dfe83228f1755ae23", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619684465, "uuid": "bda2ce7b-2def-40c3-a523-8e3e3413309b", "comment": "Malware payload", "value": "ac75d222b69745bef329161469a7dff38e362addf41deebf74d6bad3d0b856f66fabc3d8a978693f0618d402a9019d2e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619684465, "uuid": "4f60da57-753b-4104-b163-c72fa805ebce", "value": "94D312C9164BBFFC5174338C4121FB02E6588C53CED69B71566393BC5A6A2A02F9BDB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619684465, "uuid": "df72c0ad-fac8-4494-b0f1-a57a0cc6378f", "value": "3072:M6sGjfpkXXSxBzB4tjVnn6qLuNz4kyCiPQh1dNPb:M6sGqHSatjxAxnybPqPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619684465, "uuid": "a8d01b91-49b9-4ad1-8034-4fe66a78408f", "value": 134889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619684465, "uuid": "5543fa35-996e-44e1-9ad7-ba14d2d69362", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619684465, "uuid": "37babc30-cd09-44b6-a226-d7dae524344d", "value": "REQUEST QUOTATION MAY 2021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620bceba-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659357, "uuid": "a49d6932-8899-49a6-8ccf-f5bcb0165227", "comment": "Malware payload (QuakBot)", "value": "24fb8c4c86c97fb23a68a290eac6d0df", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659357, "uuid": "27b0d3f3-5898-46e2-b14f-f370c7f579e5", "comment": "Malware payload (QuakBot)", "value": "12b420f02c6e6411143853b10b6b4a80d77f307df44e716d7be06ee70db866ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659357, "uuid": "9bca1fd4-fb2b-49b1-a4fa-4d0c3c397579", "comment": "Malware payload (QuakBot)", "value": "40f68eb75f8c3c72b33779e28ade3d66239609fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659357, "uuid": "df9888fe-f6b3-4ee1-95ea-b65ade5451b5", "comment": "Malware payload (QuakBot)", "value": "6b73d31487f5733323806cf67809cb83e0dd9ea07986df830a2888eaf18edd3ddab332b31f47fdd61550997fa9f00c8b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659357, "uuid": "902a4ed8-5f1e-42e1-8885-4b699552e90a", "value": "43549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659357, "uuid": "7bca6f66-cd00-4652-9261-740da93d17ad", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659357, "uuid": "6412d48c-b1bd-457f-b85b-d24f0cd44529", "value": "3072:z3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZcZ:zvv9sMoXBaRmr/dukbvuZ/7fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659357, "uuid": "15f53eb4-e620-492c-92df-c3d3bb4d639b", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659357, "uuid": "82a37ecc-775f-4e46-aed2-6f74fda4ba64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659357, "uuid": "19ab4e72-75f0-411b-b6fa-bfae30eda84d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d235f252-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699918, "uuid": "84aace9d-4127-4eda-ad6e-5f4c7b9d97cb", "comment": "Malware payload", "value": "4a47b36a25a38503a01348d8a5e91288", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699918, "uuid": "c93e634f-ca3d-480b-a758-c4a464844923", "comment": "Malware payload", "value": "12c011d91bcfcf6a93a6f4f47ae7fd7a67deb7e6eba81119ed33dc1aa63d8e46", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699918, "uuid": "6cb909f9-190f-4368-a50b-d97dab529271", "comment": "Malware payload", "value": "4725b5113ce78d5c5034a3bda8f51f5f4a2356e0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699918, "uuid": "cc0dbfa3-2c6e-4182-963b-4379f0869abf", "comment": "Malware payload", "value": "bef82c5af1b67365ebfe71bd5a2f186ad32bffc5caab5cbdd584eaef5b660af9ecbb5235df1b803954ba2080911fc271", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699918, "uuid": "e1265d24-66bf-4edf-bdb3-5764c666c101", "value": "4A3301C8C689D37698F57835AC79C701D978AA6E0817C46283F34AE7BC07D901B4ADDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699918, "uuid": "22c31d51-4a85-4539-b6ce-09666427af4d", "value": "1536:cFugXVpoD8ZxhrLAuNS07MrxrKsYVh+WTv:Wq41rLZNkZLYD+Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699918, "uuid": "528c6feb-ab1c-4d79-a893-9948b66c7b9b", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699918, "uuid": "ddefe984-909e-4354-ba86-82bf4f832436", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699918, "uuid": "92dd7b4f-c9cf-4650-ac63-9150f5fe80cc", "value": "catalog-1167343171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3946bc-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619734029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734029, "uuid": "ab8bde6f-d656-455e-babe-b8ff8b6b1db5", "comment": "Malware payload", "value": "a3ec877d0afc1418c717f63b774f7fbe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734029, "uuid": "5b42873e-b630-4009-ba7f-80f2dbdd8918", "comment": "Malware payload", "value": "12c49d35504bc9b7ac4079207c0a9f29d669397b13af5ff870341b7bb17b6ba8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734029, "uuid": "3d1e692c-5770-40b6-b57b-995e26fde3e0", "comment": "Malware payload", "value": "a9c6e9c6edec3d392e6258c4f4bbd359a0213907", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734029, "uuid": "9beabd09-2db4-48fa-aee0-f35e3983bba3", "comment": "Malware payload", "value": "d6819b2322796f7c5cbbeb46fcc0f7670dbcbfb0c81d95e0359d129093267690a9d69e3c233b138f977d48d19be848b8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734029, "uuid": "830b71f5-c196-407e-9174-45a72355d69a", "value": "10F3CF82D702C1ADFE212C7A28E677753D9837905E54CA69E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734029, "uuid": "75e8ad12-26c9-40db-9fb3-d411ddec2b70", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734029, "uuid": "ede0b346-daba-4ded-a08f-da0889ce8946", "value": "3072:ec5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh8MH6:t52j4pk5zMbVO6/HUIXU8KgMyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619734029, "uuid": "e9abccd5-b353-4922-9c09-012842ea0208", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619734029, "uuid": "409bd798-77c3-4ca9-9b5a-1a9544b61792", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734029, "uuid": "e55512f9-85f2-430c-a29c-5466031adf86", "value": "a3ec877d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25bb5f3-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707139, "uuid": "f18702e0-c202-476a-acde-ccf0cc589819", "comment": "Malware payload", "value": "ecdd6f8c31793418cbb36d6f97c57052", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707139, "uuid": "9cd17317-811b-46d4-bceb-b2bc59c3d741", "comment": "Malware payload", "value": "12d8a5f2fc13c16b110b9add2ef815ce1c5c3949641581fbe4984b10ead7deb1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707139, "uuid": "6d2d19d4-7140-4690-8ef5-ee78c6276dce", "comment": "Malware payload", "value": "53d669883d97f4b6290812873ef29713c0e5ab3b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707139, "uuid": "4f71d684-5527-4f60-9cec-c6e5f9b94615", "comment": "Malware payload", "value": "d32bf2daa0069c079c92c945b62412b7863861a56069c85fc7891e075e8a9059ec0ed668d20617f349dc6aa386bc7d82", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707139, "uuid": "c8ac372b-499d-4b33-a1d7-46eee286153f", "value": "7933122A986E7A29473D10B08449CB4EE667589D386EC6821CDCF5B6DC017EC163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707139, "uuid": "7739c5c3-fff6-4903-868c-567864265503", "value": "1536:JP6z4+ADViS8CWoD94pUnQ64x11RiCFBPvo:tPZBiS8jopkUQ64xNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707139, "uuid": "c2cc7b36-5bc2-414e-bf8f-9207846bb9d8", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707139, "uuid": "e17a5da3-3be3-4a06-b93d-f688c666e683", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707139, "uuid": "5a89468f-d185-4fc7-8fdc-35d2fbad4c46", "value": "statistic-7770571.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d25eb9-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659362, "uuid": "16a0fb9d-0b83-4771-a62d-67ddb41c6e42", "comment": "Malware payload (QuakBot)", "value": "5084686f94b7279b00ca014c570c565c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659362, "uuid": "a6ab8d31-e33a-4b83-a936-aed2bbafde77", "comment": "Malware payload (QuakBot)", "value": "12da99243e82f92e4052b578c44a96a778d28faa5bfc5110603afa2806e6510c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659362, "uuid": "c7d4b74d-76c4-48ec-9fa0-a4769c1e3551", "comment": "Malware payload (QuakBot)", "value": "5fadcbfd29e773b9c10757b4cdef963351485368", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659362, "uuid": "c96cb1fa-2a9b-4194-8698-19b1aa8c3db6", "comment": "Malware payload (QuakBot)", "value": "ec2985e10c3dcd0cc7e60ecd0d2e25ace30a0d112703e3e7be8e07b6d00e943cb8cdefe09d2907d73fe6965aba70f515", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659362, "uuid": "926e0ef7-1a92-4931-88b1-635ae8a5f6af", "value": "1B74C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659362, "uuid": "b316d893-a25b-450a-bf22-5a0874f19ca5", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659362, "uuid": "5cf5e556-6fbb-4f34-a562-04b74bf8a92e", "value": "6144:/Tfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRub9:/bi7/xZrkNK11G9AQyOi6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659362, "uuid": "6fa6e928-8c9f-416c-ba51-cb1f438124e7", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659362, "uuid": "683cf821-5779-4618-9596-a4e47d293dd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659362, "uuid": "075474a2-15ce-4514-a939-d7fcf45e2005", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67979e5e-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659366, "uuid": "28f6fcb6-6c65-46ae-81a6-d0eba6fb42d6", "comment": "Malware payload (Quakbot)", "value": "8b7951c1a46eae1c1a9d39e6ab064e84", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659366, "uuid": "e61498b8-21a3-4777-8c0e-2386644c1bbd", "comment": "Malware payload (Quakbot)", "value": "12dcf1461c94fc8a922ac47d3be9633744d0780c9c989491a26aee56f3e83974", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659366, "uuid": "db47fa8a-fe4d-450b-94c7-0dae3c5c8495", "comment": "Malware payload (Quakbot)", "value": "1c71fd320cb930052ad877816f1166cfbc79c5b8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659366, "uuid": "1cb866c7-0047-40df-b144-aa75acf765f3", "comment": "Malware payload (Quakbot)", "value": "8703b3bd94525603693fa47a1706ea439b959b32982e6757a3de889300b98d95e61fb3b2269c4caaa226e75460c5a6a2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659366, "uuid": "f908f736-e5a4-4a28-8764-0873a0af688b", "value": "5A74B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659366, "uuid": "3bd19c79-3348-4fb4-8b55-2f26d51ca664", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659366, "uuid": "3e946fa8-5688-4159-a1a3-115cfe777f68", "value": "6144:TTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRu0:Tbi7/xZrkNK11G9AQyOi6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659366, "uuid": "7d80fad9-f685-488a-9218-edb3bf980440", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659366, "uuid": "f7f42d51-8149-41ab-b423-aa31dc547985", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659366, "uuid": "b3dfcf49-60b7-4a5c-8806-d32a64c0cf0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada28513-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699856, "uuid": "20bdac00-c6bf-40e1-b887-ec7782ec514a", "comment": "Malware payload", "value": "1b5284a8d0c9db6d3ccc43cc1b2d9625", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699856, "uuid": "a5c7c165-3ac3-4c75-8835-afe650a9f43b", "comment": "Malware payload", "value": "12e673b8b4727293ab8549620892d9d142b37e7955cf6e11e135b4159fca192a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699856, "uuid": "d3c46960-78db-43cc-b3d6-23a1d59f24f5", "comment": "Malware payload", "value": "2adc7fd069b518c0d0cc94c595d0640472170842", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699856, "uuid": "999b7a10-0a46-4449-9d61-088c0a8762f7", "comment": "Malware payload", "value": "1afb67c2df250da247f81a894dd0ba59b138f2a43902d6e552e9940106f4df7a5add6184d3d03352ea9247cf32d2a899", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699856, "uuid": "952543cf-cdeb-46a2-a25d-e42712f0ed92", "value": "2F330188CA89E331D8F47431AC788B02E478AAAB441BC96581F786E37E06DD0174ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699856, "uuid": "86433a3c-91da-4cfb-9cc6-3c22fb2adfd3", "value": "768:ywnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2r:fFugXVpoD8ZxhrLAuNS07MrxrKsYUJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699856, "uuid": "cfa4fc67-523c-4d28-a474-04a9e4e044c3", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699856, "uuid": "f6a3957c-65e3-48aa-854e-7b0bb1a97965", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699856, "uuid": "40db7d51-c3e9-4db1-80be-5cd788d69d8b", "value": "catalog-1092395273.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267b3fba-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706931, "uuid": "541741f4-505d-4035-88a6-fa2da1570599", "comment": "Malware payload", "value": "393383b54cea50c3e53e4581cac01b73", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706931, "uuid": "9205a722-2337-4e9d-99f9-13169b13c0da", "comment": "Malware payload", "value": "12ebcd043a34d873b15b981521382ad8753561d0f375726d01925d4ffd7c4dd8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706931, "uuid": "1671de14-7dc6-4c16-b706-d809adbd1498", "comment": "Malware payload", "value": "8bb3b6f707dee645f28d25ff276be57534c736c4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706931, "uuid": "d5487d42-d366-4d39-8fb1-cd77cf5b5738", "comment": "Malware payload", "value": "1f06b8a13b789edf559003fa91533bfbb6714a7f024ffcc0603522c515085fad9af492898745dcfa3781ae9ef0dcd21e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706931, "uuid": "38868f94-cf17-406b-844d-31c19776caf2", "value": "F433022558BE7A69A37E10E08585DB0EE5436D9D381DC1821CCCF4B6EC052A9167F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706931, "uuid": "bc962579-f84d-47d8-98ed-a4e53ab83d9d", "value": "1536:+P6z4+ADViS8CWoD94pUnQ64x11RiCru1Al:gPZBiS8jopkUQ64xlu6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706931, "uuid": "d6c949d3-d3a3-4180-b72e-8defbddfea24", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706931, "uuid": "6d9a3e4f-4cb7-4199-a742-df4bd081f0dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706931, "uuid": "6298c5c1-f1e8-4e82-b865-cce390b83a6e", "value": "statistic-604207158.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5cf269-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659371, "uuid": "c62f9efe-ebe9-4cc7-8b45-a88e865592cf", "comment": "Malware payload (QuakBot)", "value": "0437dddef6f3fe40da6f221791bb34e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659371, "uuid": "9ec5a615-4fe0-4f6a-8b33-08b6d9e580ea", "comment": "Malware payload (QuakBot)", "value": "12f77ac5230c0f60e1ef1ceb7d35508741e6e0bde1826e9b2c8bd2a989219748", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659371, "uuid": "ee93a68f-ec80-4e34-82b6-6309e1f942da", "comment": "Malware payload (QuakBot)", "value": "ee5da52fa599e7002375c069107e55cea0b4c46e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659371, "uuid": "4a61fa9b-879b-49ef-8828-c9bcd247fa0c", "comment": "Malware payload (QuakBot)", "value": "e433bb72316b5898afb098d6373bdd7b40669f82f054c418a168992806e4f815f394c2f8f8c93082c7ec98beb9deffec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659371, "uuid": "0fba8828-fffd-4e43-b145-f0927d262379", "value": "63549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659371, "uuid": "622fcdd3-87f4-4334-8ee8-7885fe75b2c9", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659371, "uuid": "cd2c98c8-2fcd-4374-9514-5d06cb4932b7", "value": "3072:13FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZg9:lvv9sMoXBaRmr/dukbvuZ/7fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659371, "uuid": "9264b819-03a8-465c-83ff-4304ab78f90b", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659371, "uuid": "14e272bd-b545-41bd-8650-2c5182e8fcc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659371, "uuid": "d47f5b8a-0c5f-43f4-baa0-e88e1031039c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b58e4a-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706176, "uuid": "4af25559-7414-426b-94e2-a0595a7faddb", "comment": "Malware payload", "value": "5f68cbefd32ba46dc877db7e5a37b3e5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706176, "uuid": "4dbfa103-8d3b-4ce2-9bd8-6b7e3e3f2584", "comment": "Malware payload", "value": "12f916d6910d32260e1a82d9a493b24496f546d24df21d1a3a7076d66723aade", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706176, "uuid": "1ee2946c-a199-48e0-83c5-4dc697198556", "comment": "Malware payload", "value": "a70e39e63b5d6dd1c36b68ff57196d01d55132d7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706176, "uuid": "19e4a690-c4f3-462c-b868-70c74e6f4cbd", "comment": "Malware payload", "value": "bbeba759950ee6126d0806a0cc419bb0d3cb205a3447a6449cab78cddc0ba0831f8c1638d8e89dd2265cf31cd55f79a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706176, "uuid": "e811aed5-82d2-4206-afd1-05d8012ad7e5", "value": "E233022A996EB536577D10F88484CB4DE50718AD38ADC9812C9CF475EC0A3E8127FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706176, "uuid": "85f2e4af-f787-432c-b78e-d33a8379a1af", "value": "768:H9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpJn:SP6z4+ADViS8CWoD94pUnQ64x11RiCDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706176, "uuid": "6ebf38ad-81c2-4420-ba14-fb629ea9c96a", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706176, "uuid": "d0370a6e-6637-4ebe-8c3a-9dc833bdc825", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706176, "uuid": "c506ee7a-1bcb-4986-839a-2c80f01b88c7", "value": "statistic-2091686480.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1d05bf-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659375, "uuid": "d2723906-62df-45ba-bdfd-c93b5ec133c0", "comment": "Malware payload (Quakbot)", "value": "a51b198d83ee2a322d58e1a0d57791a1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659375, "uuid": "9028e585-9674-4f77-ae31-948567335350", "comment": "Malware payload (Quakbot)", "value": "12fa48b8d7c721f35d076fde1af44a0743af78d172fa54f9afc91b92b8029df1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659375, "uuid": "29b38623-60e7-4c88-8c73-716ee1e7a038", "comment": "Malware payload (Quakbot)", "value": "4b47d399b43852c4e3b36fd197b46784da17ff81", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659375, "uuid": "974df76d-4aa8-40d4-94a6-01bea0298f10", "comment": "Malware payload (Quakbot)", "value": "225ec270d4f9b398df75dec8af93a1364adcdea7ebc2800b4f3374552fc13b66d409e816a6408f5c0231340fa3498dd8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659375, "uuid": "864639d4-ce3b-4b7e-bf67-33e786acb7f9", "value": "8B549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F587EEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659375, "uuid": "9741e98e-c354-4bfe-bbc7-145219b49266", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659375, "uuid": "58c865b1-1003-4b80-9b2a-b613a1bb11ee", "value": "3072:+3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZed:avv9sMoXBaRmr/dukbvuZ/7fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659375, "uuid": "8f0276af-80c6-4880-997f-37edb2a65591", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659375, "uuid": "5906398a-b20c-4661-9d99-4859627e92fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659375, "uuid": "926987a0-7425-49d9-a390-96a0b57b6834", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe1e9dc-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659380, "uuid": "5a3e7ab2-696b-4d56-aa8f-ea02b8f3e5a0", "comment": "Malware payload (QuakBot)", "value": "478725018de3f1be2e5a2026e8f02567", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659380, "uuid": "6e7ddae5-5aba-4096-8149-a56c2fc9907c", "comment": "Malware payload (QuakBot)", "value": "130d7bf611c4631d722f8300ed1c3657c07220550441c99b45fe3fad4ac4b020", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659380, "uuid": "e454bb3d-acc4-4f3c-912a-6a43f635404a", "comment": "Malware payload (QuakBot)", "value": "b62961ff4b464c7414ae7044eb080e78a7183a7d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659380, "uuid": "a4bec223-9c98-433c-b873-42d81a383701", "comment": "Malware payload (QuakBot)", "value": "3c9471a72791956f2be55b4d1cf6e2d9b0d23501100b62b6827ef2aa1ab67202feb20c17a4e9cb39a5b9ac54be87aab5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659380, "uuid": "7e3ab044-54bb-483a-b0cf-05201b2dd893", "value": "9074BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659380, "uuid": "5948d37a-e15e-4c51-8e30-8a74a0543d76", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659380, "uuid": "36067d1e-33d0-4bbc-ae5e-959e1c1870ff", "value": "6144:PnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuM:YFrkNK11G9AEtMxQyOi6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659380, "uuid": "40587ee7-8da7-4f55-9b99-4cbc4e2715ac", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659380, "uuid": "36a421dc-f191-4909-80a4-db342b1e6f80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659380, "uuid": "076ed69f-9f8c-4eed-bdc8-57623abae2b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ffc8ff-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703110, "uuid": "0d10395e-e80e-46e0-a0c4-e7eabb39a883", "comment": "Malware payload", "value": "9154ba67601e25170656896739ee3841", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703110, "uuid": "05a09f78-8244-4f88-99f9-bf8cc55db319", "comment": "Malware payload", "value": "130f4bd515607a1f14a90f35c1c2664d52f123e430a80a48a3b941a962c8b8ab", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703110, "uuid": "427e8787-0f69-4434-8e2a-cb6401425238", "comment": "Malware payload", "value": "aa2be1907f3da670da765df83c6ac4033163ad1d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703110, "uuid": "6ca5b754-6d79-46a6-9d9c-02cf3e3d302e", "comment": "Malware payload", "value": "5790741ff0106252217da5d4cec197d422d806e8df90137619e1d135093f25b082cbb99f9bb92d9c83ed08b11f8fe00d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703110, "uuid": "cdd9c698-5b87-4d37-b9e1-e357f079118e", "value": "043302298C9E792E537D00B54985DB1EE51B789E782CC5812CCCF4A9EC062B9123F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703110, "uuid": "b3aa06d0-6f7a-4fbd-b7c4-14756c777b7b", "value": "1536:mP6z4+ADViS8CWoD94pUnQ64x11RiC+VTR:IPZBiS8jopkUQ64xMTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703110, "uuid": "206efe63-b469-4084-94d8-9faacdf7a283", "value": 51482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703110, "uuid": "c57c2994-4bff-4714-9773-f51e58f0a5ce", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703110, "uuid": "d85b610c-518a-4311-9136-5c8751f105b4", "value": "diagram-1737512085.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a4e61a-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659385, "uuid": "46bc10a7-d209-4d66-862f-f856ff7dcf65", "comment": "Malware payload (QuakBot)", "value": "70ce609c94fb8d88ca80c9b3599cd76d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659385, "uuid": "720fcff2-c3f3-47a5-8677-f68e944bdaaa", "comment": "Malware payload (QuakBot)", "value": "1325ecefeca9de7db0916612b0f69744ac4c3009205114b192ea4464234c381c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659385, "uuid": "57e933e0-29c8-4122-b3e3-bc96379f0e65", "comment": "Malware payload (QuakBot)", "value": "0bc4259dbd468535e6e097395de09be3f3a53b62", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659385, "uuid": "79a92de7-22d2-49ae-9830-379189133975", "comment": "Malware payload (QuakBot)", "value": "e7a381287ed241dbad33bd1013c223fe07d063c005927a7d6ee9d3c4bb4ad56bec465decaebff8314c1c9761b14a2249", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659385, "uuid": "d3fe313c-6588-4f90-af92-885672464815", "value": "7B549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659385, "uuid": "f7cd6b8c-efca-4093-9428-9e4da245df3c", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659385, "uuid": "2a24671e-1b89-42f0-a992-4a495304a33c", "value": "3072:03FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZsv:4vv9sMoXBaRmr/dukbvuZ/7fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659385, "uuid": "0b076289-dc68-484b-9922-b61b41bcecf5", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659385, "uuid": "a90bb964-bffb-4fd0-be34-96be35e358f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659385, "uuid": "583c7cdb-c672-4449-b4e3-bfbdd819ea9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1c20f7-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701706, "uuid": "17acd279-84bc-435c-b0cf-c4ca4dc300bb", "comment": "Malware payload", "value": "9bf2e9fcc30ecb1ed3a4ba6d8677c465", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701706, "uuid": "018068fe-223e-45de-bb8a-8b98c5e977c9", "comment": "Malware payload", "value": "1335c3e7be4b6ef6198c018156e9d6eef7b29dcbb8ecc3a985980fdef37ce993", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701706, "uuid": "757aa606-8e49-4028-8ee7-c7b78de59a45", "comment": "Malware payload", "value": "db11f9d570ae3e5e84aedfa5dec11431391fc9da", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701706, "uuid": "6f7037f0-9c8e-4c88-9d2c-9de421907b4b", "comment": "Malware payload", "value": "81f22ddf8736d28a0a6cb83ff33dbaa1aa7129ae8fa232e326b8df50184a40231f9c54d168123454e48274481ca59cf5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701706, "uuid": "93db9d1d-0b29-43d2-a544-3925797ccbf9", "value": "5D330188C6C9E335D8F47431BC788B02E478AAAB441BCA6581F786E37E06DD0574ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701706, "uuid": "5b1c4f72-a186-48ac-8490-759fd8db3f0f", "value": "768:qwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV20:XFugXVpoD8ZxhrLAuNS07MrxrKsYUJWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701706, "uuid": "dae74fae-7986-473f-9244-b5359c5489f9", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701706, "uuid": "1dc6dfc2-a89e-4b17-a1c9-b7f0660be5ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701706, "uuid": "27d92715-fd3f-40e3-b09e-1d1a91f0fa39", "value": "catalog-615045362.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756a08a4-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659389, "uuid": "d21b3fa1-9a0f-433d-9dd0-d2072b9ccffc", "comment": "Malware payload (Quakbot)", "value": "905790f54faf544ba637c9bc37618cf2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659389, "uuid": "b226962f-389d-48f5-adea-eb3fbbcba350", "comment": "Malware payload (Quakbot)", "value": "1344e6dacf6785196ab5910f7659c3ba3179a1c5aa6e4f2455b3bb69480aec92", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659389, "uuid": "94363fea-7ec2-42ed-a264-fe3fc62fd358", "comment": "Malware payload (Quakbot)", "value": "023765840121d3b7332fe0d85e64dff716c053af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659389, "uuid": "e43100f8-de6a-498f-8316-706e70d95e53", "comment": "Malware payload (Quakbot)", "value": "434c32376316275dd1bf22818319dad439bdfde2ec156b43c4e0f778938b04973c06997b990eafad7133885eedf24bf9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659389, "uuid": "449b4213-f95b-4abd-b0df-f884cb330ffa", "value": "B674BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659389, "uuid": "91ea798b-d348-4835-bba1-bde1947afa47", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659389, "uuid": "59c698ca-bdd9-458b-8dde-39e0eee70024", "value": "6144:mnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu2:JFrkNK11G9AEtMxQyOi6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659389, "uuid": "22a90a70-e617-4637-a90d-aafe1e0284f3", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659389, "uuid": "07b9f097-dafc-46d7-adcf-dd0680f6ebe5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659389, "uuid": "e26d1bf2-0701-4537-985f-983e733b5882", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783315b3-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659394, "uuid": "949a45a4-66e5-4bc6-ae40-4ef52769b669", "comment": "Malware payload (QuakBot)", "value": "f606d9c3f1a331683fe439c8da7b93dd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659394, "uuid": "d0717dc9-dc35-4b25-ae33-0de38c83c7e8", "comment": "Malware payload (QuakBot)", "value": "134572fb8a55c9235b3b6cab97fc065595ada0ea1feeb0a2e17d9fd2eabf9d55", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659394, "uuid": "728a817f-7c77-4d92-9e47-8fa087b63808", "comment": "Malware payload (QuakBot)", "value": "006e9caac88f4e933b975b913b5b9c8bd785815c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659394, "uuid": "adc7f0cc-8b9a-454d-8dff-951a1fe86433", "comment": "Malware payload (QuakBot)", "value": "290988f497c4c8004e3f820db7d376b0b252ff83a05e7b69cc3f27000384473556ad382c338daee9689f95fb0506414a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659394, "uuid": "e3dad041-32ba-4db3-80d4-bf514f709dbd", "value": "79549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659394, "uuid": "369fa270-144b-4930-bb8d-6263cec75a6d", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659394, "uuid": "149ab8ab-457c-4935-a187-7951552a4810", "value": "3072:L3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ1UD:Lvv9sMoXBaRmr/dukbvuZ/7fcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659394, "uuid": "acdba1e9-5abc-40a4-9cb3-e0bc90f330a3", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659394, "uuid": "77afca2f-1eb3-4829-b34f-a4fea47d4771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659394, "uuid": "b3b7f27c-6872-437d-90f4-152e77d9a0c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9ce119-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702433, "uuid": "c61e3d51-7e50-4940-a923-a33198fe8710", "comment": "Malware payload", "value": "ec5484432ce5b7f5c1d59d9e444abbaa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702433, "uuid": "4b4326a8-8010-40fc-8283-e1feb30c20e3", "comment": "Malware payload", "value": "136deba6bf769cb80b11bcf0449ad900e34117812f24844e845c44ef7dc12267", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702433, "uuid": "d5ded741-02bc-44f6-a33c-01929af726c7", "comment": "Malware payload", "value": "72e8e716a63b85e120964fa86a8f810fa35767f0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702433, "uuid": "0dae3c2d-7530-4579-b377-3cc044cfb942", "comment": "Malware payload", "value": "5c759e9c881b27d5dfc3a6a2b4fe22ab72b99f70f2c49e5ebe88980384127f662f4ce5b7d2780edbe8a26b516eb7ac3d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702433, "uuid": "3d63efd3-2c0c-4b74-900d-f5aa33df4bd3", "value": "F93302298C7D772D572D10A08585876EE51B28AA3C7DC5425CDCF4BAEC022AE163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702433, "uuid": "991a4f04-243c-4b82-bb48-792fc1c06a44", "value": "1536:iP6z4+ADViS8CWoD94pUnQ64x11RiCMI1:cPZBiS8jopkUQ64xx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702433, "uuid": "d6294050-1666-4691-b81e-7ec8513ba2c2", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702433, "uuid": "abec8bc7-1ceb-4d6c-b970-78f72016a6df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702433, "uuid": "a13ea9a1-732d-4db2-9a20-3d51a8357ee0", "value": "diagram-1165913475.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af174aa-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659399, "uuid": "1974ec8b-fc46-4d81-9770-061174472cdd", "comment": "Malware payload (QuakBot)", "value": "5ff822224861327af4dc8faad964ae8d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659399, "uuid": "534792ca-fb95-4997-8f37-b062a232fea1", "comment": "Malware payload (QuakBot)", "value": "138102193473a65e3a58c0260669a39bac7854f5eddca1e9c36082f3c9ef830e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659399, "uuid": "7fbdac47-1ba3-458c-bafa-3cc5d60acb65", "comment": "Malware payload (QuakBot)", "value": "59257fb2a9d5976b7132f6059295f14a2dfe4a3d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659399, "uuid": "34b3c029-0aa4-4faf-a476-8ff4d54250f3", "comment": "Malware payload (QuakBot)", "value": "72c26fbcd59706da2df66cbbd68463453ba678a6a93f545887b64e33a339af52754551a6bf337afbc239f90f4d197d77", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659399, "uuid": "04a63af9-69c8-4b93-9b2b-792f9fbd71d6", "value": "FE549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659399, "uuid": "3a1e4c68-329a-4ec0-9826-f93df9da750a", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659399, "uuid": "89be9780-949b-4b09-85b0-9a1f092f8331", "value": "3072:b3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZdh:7vv9sMoXBaRmr/dukbvuZ/7fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659399, "uuid": "344f374d-9f76-40c2-bfbf-84fb3d3a3265", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659399, "uuid": "44eaa54d-f0c0-49f3-b21d-9ef7452ef6ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659399, "uuid": "880e756d-a228-4ebc-a769-fde178c4f6bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da24b9f-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701762, "uuid": "0a787e32-4aae-47a7-8fa3-0a42aefa4747", "comment": "Malware payload", "value": "e0f040a353f5749c1cc818367b749dd5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701762, "uuid": "2c891cd0-2402-4f99-b842-b5490446b7df", "comment": "Malware payload", "value": "1385e153ad37018656352fa31b5def23daf8c1fa85d05b34f222eef593eac9f9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701762, "uuid": "b28ae12a-610a-4a9c-94ac-47e4fe936e98", "comment": "Malware payload", "value": "907db2beaf523ab99bc704217f42d4ae6bde5392", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701762, "uuid": "21e0671c-67a0-4a8a-8334-85794144173b", "comment": "Malware payload", "value": "b4f760bb96347892d243e4c7694f00bbe1f66ddac25e07d41c02c885517cfb8e4d4c8c36000ca049ab2f37c6ec3b2568", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701762, "uuid": "4ff06d4c-840e-4e79-a5a1-0ac1f78722b0", "value": "E233F188C5C8D37298F63531AC79CB01D5B8A96B4816D5A2C2F78ADBBD03AD5170ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701762, "uuid": "ff8ad700-4c0d-4150-bdab-880685fbe582", "value": "1536:uFugXVpoD8ZxhrLAuNS07MrxrKsYl1JmG:Iq41rLZNkZLYlfmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701762, "uuid": "2ccd488d-27ee-4dcb-93af-d134586d851d", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701762, "uuid": "09b72894-593c-47c2-ae8e-543e1d7558fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701762, "uuid": "9c31e703-fe51-4977-a2e3-3374042dbdbb", "value": "catalog-650899087.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702146ed-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702330, "uuid": "10e2ce49-3070-4e06-bdc1-20f044fc8868", "comment": "Malware payload", "value": "e41424f891515782b761edb9e34e0b76", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702330, "uuid": "2ec53319-33f4-455a-817d-4505604077fb", "comment": "Malware payload", "value": "13976efb733f4fe6e85c8a3ed0806177cd13efb048b7bff95bd403480c677e17", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702330, "uuid": "680b8261-937e-47be-8fd6-e94afbdaa941", "comment": "Malware payload", "value": "64122ecbf046c7491e2ff8c7b7e363f38d13ff5b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702330, "uuid": "f9d0f98b-0561-457f-833e-5362b2fffdac", "comment": "Malware payload", "value": "242faccf9f658861df141a97c8d5d7d4b0ec2bc8eb98c6126372f5af550fa7d2418cda8bec5c09432bfdd31f65e837ee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702330, "uuid": "25ce3867-1271-4169-9d36-69a1ae0cae07", "value": "0633022A496EBA29172D20F08588C74EE647689D387DC5D16C8CB476EC0679A023FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702330, "uuid": "1bcbed60-894f-4ce5-a98c-998813bf4b2b", "value": "1536:7P6z4+ADViS8CWoD94pUnQ64x11RiCR2s:rPZBiS8jopkUQ64xH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702330, "uuid": "dee46c51-05b5-410e-bc2c-330760dcde17", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702330, "uuid": "1c2b12c1-a367-4215-8102-8f02c3ab31c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702330, "uuid": "d5229018-a647-40e5-8162-3a9741dbbf87", "value": "diagram-1063659380.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dda40ee-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659404, "uuid": "cd7d90be-4904-4dab-b36f-afbf7e9410a5", "comment": "Malware payload (Quakbot)", "value": "eebfed5214209ee163aca7714df3c0b4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659404, "uuid": "25c54852-fb74-4813-8956-9373ee1bb1da", "comment": "Malware payload (Quakbot)", "value": "139d5dcf28c5476c07218b45697ee14339f6574d62a44cacb97c4fd867799bfc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659404, "uuid": "6f117d23-660a-4c2b-8d47-84bc764efa0e", "comment": "Malware payload (Quakbot)", "value": "ddfca8e32797ddf51b405361e5af51f6cb8de85f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659404, "uuid": "a14b7dc0-f763-402c-acf5-9ff18a12af9a", "comment": "Malware payload (Quakbot)", "value": "4701b88733c313a01df01d21f467af82a677995523b3e75bb9aee4b44d8270a7de4407d2ec28e1891a05e9bd66021744", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659404, "uuid": "0effaf6c-d009-436b-8011-bd8af204cbea", "value": "62549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659404, "uuid": "7eb58d1c-c159-4277-ad96-36e94d9fcd68", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659404, "uuid": "9075c16b-5a81-4a1c-9112-7c81dfaa6f8f", "value": "3072:63FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZn8i:2vv9sMoXBaRmr/dukbvuZ/7fD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659404, "uuid": "40a15b44-a568-416d-a857-9c55e864e48d", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659404, "uuid": "132f8d5c-0818-4912-b1f9-b6b2d164075f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659404, "uuid": "08df33c0-4e3d-4d69-98d7-2252ae59d60f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14723671-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702176, "uuid": "dc7501fb-df0e-4a77-b269-a6fd9ba2213f", "comment": "Malware payload", "value": "0208c21345cf8809189e35b9ce72effb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702176, "uuid": "77a00d2c-0295-4804-bece-c294cc3b5b35", "comment": "Malware payload", "value": "13a34563b09a5eef3b78e49dda60a54940a5b2d39323a06b7dbada9e03554df0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702176, "uuid": "316558bf-73f0-40e8-bc05-92ea37ae6f67", "comment": "Malware payload", "value": "f2d6ac356d7300b0134f4f3233f22e4a0b7eea40", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702176, "uuid": "c7528587-00e7-4a33-b208-35112beb57ec", "comment": "Malware payload", "value": "74cb90840a6c71c2d990809d1028249b49c940cc382fe3df0c00122c82f26b95bb5fc18bb387e51531fe45c5b796e38c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702176, "uuid": "b72af2cd-27ab-433b-8f8a-66c10d9d7574", "value": "C133F188C6C8E375A8F27931AC78CB01D578AA7B4416C6A381F74AE77807D91174ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702176, "uuid": "783ec99c-8403-483b-964e-446e3d901711", "value": "768:WwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2m:rFugXVpoD8ZxhrLAuNS07MrxrKsYpAPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702176, "uuid": "15100253-64d6-4195-a181-1cf3fd261d7a", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702176, "uuid": "8956a706-4008-4ad3-a54d-e1471b1fb16e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702176, "uuid": "52cba9bf-c5a7-47fb-8055-662bb7fcfa78", "value": "catalog-962315196.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d78fdbe-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706272, "uuid": "b84aa162-209b-4d88-8dbb-bd320b162083", "comment": "Malware payload", "value": "8e639e171f31ba16ba146a7bf4ba2138", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706272, "uuid": "d014b546-f1c2-4312-b8f4-d690951cdf5c", "comment": "Malware payload", "value": "13cdcaa2540ab355d2d7b9f7cb7a78d0c952f178b8e6888d0c24b98fe30faf27", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706272, "uuid": "f9953b36-470f-4107-8eaf-4b518b7912ef", "comment": "Malware payload", "value": "ad375596ada282d0c6b14e5d9b2fe4970ab0412a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706272, "uuid": "c4aadad5-e8ea-491c-bb17-fbd728c49905", "comment": "Malware payload", "value": "a75ee8d8db36a2be7446634b92cfd0a7a3cd04cbc74310b8ae49ab42403de2e2ab801338ebbabc1944f165d417d71bee", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706272, "uuid": "bcc4be90-3164-41dd-b459-b05308c3c4e8", "value": "5F3302294C6E7A29573D00F4C0469B4EEA6728CD3C6DC5821D9CF4AAEC05A9D163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706272, "uuid": "f48ab7e6-6a9c-47fc-bcee-6419520c4944", "value": "1536:KP6z4+ADViS8CWoD94pUnQ64x11RiCf97a8:EPZBiS8jopkUQ64xHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706272, "uuid": "0c2f950c-a777-4382-8054-e1dae6cf884b", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706272, "uuid": "70388360-35e7-4790-a6b6-6aadbb4e6449", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706272, "uuid": "276d5eed-5973-4502-b4fe-a39c9a19ef41", "value": "statistic-241888721.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54a6f79-a8cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619687897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687897, "uuid": "9b98c718-63d3-4f51-be3c-75d3bf99d955", "comment": "Malware payload (AgentTesla)", "value": "9baad25b56dcb34d962cf43088db7cae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687897, "uuid": "d3edb87b-4b69-42ee-9826-7a52e1827a63", "comment": "Malware payload (AgentTesla)", "value": "13da9fc40a825e8f21b8f1567c0b1443c12315400f73e885cf8ec68d4cfa2e5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687897, "uuid": "a01c944b-f569-4898-b8d2-460312d8aa7d", "comment": "Malware payload (AgentTesla)", "value": "317b081e0a0ad21ce36bd8e22fa91c332784287b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687897, "uuid": "ebdae1bd-baa5-44e2-8b2b-16051faea52c", "comment": "Malware payload (AgentTesla)", "value": "b5282b1f7c6be3cc96dd6064c0aeab2fe9ab8e5dc748c9724a98acc45dce2444603b0d7398b2194bb3287a1b8ba0853b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687897, "uuid": "df8d5c02-2c0c-48f6-92e6-d7ab2e859634", "value": "6E453344F8C2071ACB43E530A24AA117B0DCDC427B5C5E4A1752FB12E9F1F35A9E76A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687897, "uuid": "1a229ec1-fd83-4a18-8a01-215c7bd94464", "value": "24576:B1Wf+jalyy+X368RfNJ7b32NiVaDOdsIW23D/Ol3psldWJ6s:/4+jcyfqkfNhwiRds/23TOx8dWJ6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619687897, "uuid": "0b7d843c-92b6-4d15-89f5-b524a4ae6c07", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619687897, "uuid": "deec5fc8-76af-4133-8895-cccf4a71e07b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687897, "uuid": "fb563da5-5f47-4da5-a26f-2f4e15ca8e0d", "value": "DHL Shipment Delivery Notification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47938f6e-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702262, "uuid": "c8a889fb-5da3-4b8d-9187-a5074d688b85", "comment": "Malware payload", "value": "ef1f939b86f97e268e668dadaf1aa24a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702262, "uuid": "164273a1-1529-4723-aa52-a2ffa5097d62", "comment": "Malware payload", "value": "13dc841c24b1ab7766c7677fb3d0f22d7c8b47333e3ee95007f519980d80c0d2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702262, "uuid": "9291ba70-045c-4380-bf07-6b54a2f3030c", "comment": "Malware payload", "value": "9e891452d67449926d810634842bf6f66ac39d9a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702262, "uuid": "a9d37591-0aed-4e65-acad-405400449fe3", "comment": "Malware payload", "value": "48e78ec184e858827750b6774a4d6c4efacd2c2f019b2520ea0cbee8e75c9c6ed8fb61eef71c560f5d39bb730d27ab23", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702262, "uuid": "9940eb60-b17f-46a2-beae-d8ddba4b6112", "value": "873302194C6E7629673E10B08A84DB4EE61328DD3C2DC5866C8CF46AFC05699023FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702262, "uuid": "603e7578-7a6f-4fcd-b789-fc94b531be65", "value": "1536:5P6z4+ADViS8CWoD94pUnQ64x11RiC68O:9PZBiS8jopkUQ64xI8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702262, "uuid": "f9a7bd2f-555d-4a2e-ac34-4d48f69d1ab0", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702262, "uuid": "fc2a5e6e-6fbc-4a05-8af5-27bc34b1f602", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702262, "uuid": "ca5b49e6-be65-4a73-8993-1c62f0f1805d", "value": "diagram-1023854301.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404ee831-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706545, "uuid": "a429451a-64a6-447a-b464-213d6dba4e0a", "comment": "Malware payload", "value": "db1e77da7c1678478f10173ef1f785c7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706545, "uuid": "55918b5e-5f84-4f42-b000-bfd4dda65c6d", "comment": "Malware payload", "value": "13dca76f8630974a4c88238347d847fa44ebb29a059f417991d4d1eed21cf21c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706545, "uuid": "d275bc73-69f4-4fba-aa65-a222d4018a41", "comment": "Malware payload", "value": "a486ba8e1d003abff0b53d4689653bca96d6717b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706545, "uuid": "482bf803-1a80-443d-a945-3ec296c45c6b", "comment": "Malware payload", "value": "99b609e1bcd6eba57c60f8d72784b300896971c8c1c48a29adf715288f5b29ead52bed57b831e5368f8c34a77f0acae1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706545, "uuid": "6acb64da-e854-4df3-8d32-6e20cccb8603", "value": "2533012A9C9E792D573D10F085859B5ED81728CD3C2DCA826CCCF4E59C066A9127FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706545, "uuid": "e810e255-a42f-4177-840a-9db8c84db2b8", "value": "1536:TP6z4+ADViS8CWoD94pUnQ64x11RiCvAP:jPZBiS8jopkUQ64x+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706545, "uuid": "bb0b21f4-2210-4393-a389-446c6ac91ce9", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706545, "uuid": "afc10a55-8f33-460d-ba4a-afc9f92d2b0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706545, "uuid": "159382ac-45bb-4efb-933b-4d693d38ba28", "value": "statistic-412642774.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc148e19-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702914, "uuid": "c49d5db1-de38-4a84-a94a-85632b32a41e", "comment": "Malware payload", "value": "56bdd6ff8f183731226e6ef609edbfc9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702914, "uuid": "95a8b01b-3201-47ae-9a3b-b7b11e768540", "comment": "Malware payload", "value": "13e35f1d742bdd5d36efa60eda785286edc920bff30ca326a9ffd2147e3908cc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702914, "uuid": "843b38f3-80f8-4385-990a-48fc03132006", "comment": "Malware payload", "value": "2cd66885ec1d48e97be3f3bdc9c31840aa4bfac6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702914, "uuid": "e45d5386-d037-465c-b3f6-189ddea62425", "comment": "Malware payload", "value": "2d8d824328abec9bf01bf94890a99b3406aa8a110b56b05c49cd58a44e32ba809fa950366e170d3a02f189bafb71cc82", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702914, "uuid": "77926704-7b45-430d-a530-9960233a2e60", "value": "D13302294E6FBA29172D20F08588CB4EE54B689D387DC5D11C8CB476EC05796163FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702914, "uuid": "e192c3c8-a90d-43d6-9a09-411d0077cfd4", "value": "1536:zP6z4+ADViS8CWoD94pUnQ64x11RiCQn3:DPZBiS8jopkUQ64xe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702914, "uuid": "179ff87b-2535-47e7-ad27-240dfb0d972c", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702914, "uuid": "db541522-5534-4e0e-a623-f51c09a7dd57", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702914, "uuid": "0b1be240-b19d-41c1-81ba-02dad2d02b7d", "value": "diagram-1556712295.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2f9e2b-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702543, "uuid": "467c8565-0b7f-4c4b-9f16-cb0de560ec3d", "comment": "Malware payload", "value": "0a44cbe8b5428a642cbeaa5bb4e7829a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702543, "uuid": "7207d287-0944-4f94-82f9-5e0443e936ed", "comment": "Malware payload", "value": "13e5be40ee25932885b386c1556e38aa97871e6832c3e2fc3a984a59cab6f220", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702543, "uuid": "f9155724-75c5-492f-a9e8-0daa759b0b17", "comment": "Malware payload", "value": "4ea2b8e7abcd1a64c9a325a0034838f6a5121453", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702543, "uuid": "e178715d-5805-42f2-a46e-1b902e38fe96", "comment": "Malware payload", "value": "d1d208a1acd3626b6089d45c78d2143a761dc2c4837e1440c72c34f176e9ac9b89cfca273c6e605676a444dc0738e238", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702543, "uuid": "a215831c-2495-4978-aa13-cf52b1a4460c", "value": "BA33022F485DB62B577C10F5C589CB1ED517689E382DC9821CCCB826EC096A9153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702543, "uuid": "775d8625-c664-40c2-b027-5ec313f63469", "value": "1536:oP6z4+ADViS8CWoD94pUnQ64x11RiC+PpG:ePZBiS8jopkUQ64xcPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702543, "uuid": "99bed0c9-0c17-4203-b2a9-02b422dcbead", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702543, "uuid": "1afe22b2-17b9-4f7c-82ee-0803d177bd3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702543, "uuid": "cbc983f5-ed70-407c-b031-310af88ffdd6", "value": "diagram-1271645523.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0bcde8-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703209, "uuid": "ab3c025b-ec0e-4d99-9939-5c2851963e5c", "comment": "Malware payload", "value": "8ee690fc967038022f8c62292c18f8e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703209, "uuid": "1d702d6d-cd6f-48f6-8fbe-2c073c0a12ec", "comment": "Malware payload", "value": "13e6cd1fe99ef6ac110c7c26877d3c672068d461c3a2e7a5a95706bcf5c9a081", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703209, "uuid": "2f353a3e-7ea2-4273-a0d5-3dfb2c7a14c0", "comment": "Malware payload", "value": "ea0b9bdc9788270d81965a8b0b0b1aa15be4e60f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703209, "uuid": "0e164752-1227-45d3-b45f-c78cb59f47a9", "comment": "Malware payload", "value": "6bc1217fc3d2f1f8a809cf5b9a8d19368bcb9bae2df8325e3fb1a4c07edf6e0403d6542e08d49b61cd511c8b747a7160", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703209, "uuid": "da515906-d916-4760-b7cd-801d7f4b6fbf", "value": "F533022D9C6E762D672D10B085899B5DEA572C8E3C6DC4401D8CF4B6EC026AD127FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703209, "uuid": "2ed2f046-046a-4b21-97fe-aede777f070a", "value": "1536:4P6z4+ADViS8CWoD94pUnQ64x11RiCTtH:OPZBiS8jopkUQ64xRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703209, "uuid": "324b3255-4c7e-4fa9-884f-03f2bbe6fe3a", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703209, "uuid": "d8c98c75-2baf-4698-a420-7776b1ab92b8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703209, "uuid": "dcaf10ea-1a10-4240-8252-c8f225469f75", "value": "diagram-180424672.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de466f7-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703937, "uuid": "ec77abea-f832-42d9-bd33-8bab8dc4fd90", "comment": "Malware payload", "value": "f5faa02749845ba4ead2dc56682927df", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703937, "uuid": "e49f6879-31ed-4bd5-90e1-d86ed7c30a39", "comment": "Malware payload", "value": "1407bdcdae18fa1fa41cb60400db3c1285f1eae7228cdc0399d7991175880eca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703937, "uuid": "dd7710c5-572c-4abd-842f-194bb2c60b0d", "comment": "Malware payload", "value": "b845f6cd1e9e936e917d8c3dbc4c15de31329734", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703937, "uuid": "4920f41f-2de1-4045-bda1-192029a6336b", "comment": "Malware payload", "value": "7e5220ab0eb5e7e3b83cfb0c286826d981cdba62b9cce8064ef79b1c423ebd9f1aee0553ab7aaafc44dc2befc978d133", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703937, "uuid": "4064c2c6-0012-4f35-93ea-170ba6b3519f", "value": "EF33022F485DB62A577C10F5C589CB1ED50B689E382DC9825CCCB826EC096A9153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703937, "uuid": "6c77fcb9-ef22-456b-a8ac-de9359effa6a", "value": "1536:dP6z4+ADViS8CWoD94pUnQ64x11RiC+NLC:pPZBiS8jopkUQ64xcN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703937, "uuid": "1bdc7e5a-5680-4c81-918f-e0cf0cebf81d", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703937, "uuid": "0531d306-d03a-411b-aaef-9f86d6002c22", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703937, "uuid": "83785308-3dcb-4f06-a916-e703554e7fe4", "value": "diagram-347084048.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6e820c-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700504, "uuid": "d20fdb40-1c70-45d4-9809-0cea4ec1d4f1", "comment": "Malware payload", "value": "b767851bcfec611b35ce22fbd45bdd9a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700504, "uuid": "63e3973b-4804-4471-ac75-e3ff4e8aef89", "comment": "Malware payload", "value": "140b6997c24b7211b71e154f3da4ea674009b00b272ab84bdb956f6e74b21437", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700504, "uuid": "2e16abc7-cfb5-4285-9556-809c407492a0", "comment": "Malware payload", "value": "82c7dbe7b7e6f034f1b142ce8da12d32f28fdd99", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700504, "uuid": "261ffb05-124e-473a-b8b1-72173bd29a70", "comment": "Malware payload", "value": "c0b07b9803ae0c91a7264cc8984bb13d8919d710bfdf27ecfffc88aa97afcafc3e0fd482cdcdec1d1e2e62ffb63a5916", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700504, "uuid": "0ec6b4aa-2279-42ef-82ac-dfd0cdeb0f8c", "value": "C733F1C8868CD371D4F57430AC798B02EA78ED6F4816C96281F78AA77C07D952B4E9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700504, "uuid": "9274843a-f759-4889-a776-b27285a3d4ac", "value": "768:hwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2T:oFugXVpoD8ZxhrLAuNS07MrxrKsYoaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700504, "uuid": "1a2f9c06-6f22-462f-9ae5-d1bb8d7e92b9", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700504, "uuid": "976a08bb-ff39-4689-b375-28fe360eeea5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700504, "uuid": "9745c709-3b07-4d1e-86c2-bc1e87c3d058", "value": "catalog-1579781898.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a47c51-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659408, "uuid": "6d0ce6d5-bbea-4ea9-9466-0f49a62a6319", "comment": "Malware payload (Quakbot)", "value": "b3ab9c85caa7af1060f61bf3d498d52d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659408, "uuid": "cc9836cd-c475-4701-8c63-e181608ba55f", "comment": "Malware payload (Quakbot)", "value": "1430e57905016124d364a239290fa745ca174d654b1f3f03b942afdc4300d5e0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659408, "uuid": "ad1b19c1-6791-4ba6-92b2-7f4b08509b6d", "comment": "Malware payload (Quakbot)", "value": "8b2c1bc58d8573acbd1d656885c63b9f14559ee8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659408, "uuid": "b5851c90-6269-453a-b287-9c99c07ab6be", "comment": "Malware payload (Quakbot)", "value": "f2da77ee99b588e32502c2cab94ed673d2b546d23077dc2aea7e265ece9b9d82e9247b4ba232d6021f86e5fe5375d10c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659408, "uuid": "282216c1-e7aa-4c57-bb3c-5df221b7c28b", "value": "B674BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659408, "uuid": "6e902b61-efe5-4006-92ea-b5cb902615aa", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659408, "uuid": "24079990-6dc1-49a9-9cdf-81120bd71443", "value": "6144:2nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRu7:ZFrkNK11G9AEtMxQyOi68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659408, "uuid": "473aefae-28a9-4f19-8de0-7b65c7773a6d", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659408, "uuid": "e49378c3-afae-49f6-b618-1673772e8067", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659408, "uuid": "83c81683-604f-4097-9073-3031986d547a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fb300b-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659414, "uuid": "a4d58bae-be03-443b-97b1-450556dff2d0", "comment": "Malware payload (QuakBot)", "value": "2a594874777bd15fd852b287e1ebe9d7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659414, "uuid": "b0dee8da-ad1c-44d8-be33-58487e879561", "comment": "Malware payload (QuakBot)", "value": "14439fe14f5e0fc7e4c10ed2b668872e26e494aa84b4e9be51c3231d4c6085fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659414, "uuid": "18ce0401-ca18-4702-8217-fe07ca3acfc2", "comment": "Malware payload (QuakBot)", "value": "2018d9dfa1a57a7ace5c95026638497d5fc4ae67", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659414, "uuid": "378bf2ce-da18-4af2-906c-bae0d7dd377a", "comment": "Malware payload (QuakBot)", "value": "47a1722207b2604bb287345099e6c2665bdb4ce534f75ce5b30627c0e1443b91284a5c6fbce4fdec8f816f1d2d5fedea", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659414, "uuid": "796eed65-0899-4c58-b4a5-a9af4436fd46", "value": "ED549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659414, "uuid": "74febc70-546c-46ff-b410-fa155461127b", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659414, "uuid": "6106525c-8ce2-4475-9fc5-69ee073cb4be", "value": "3072:T3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZg8:Tvv9sMoXBaRmr/dukbvuZ/7fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659414, "uuid": "fb96e633-009e-40dd-a3ce-c74e65e6f28f", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659414, "uuid": "939ebcc1-414a-43c1-9176-e3fba77060d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659414, "uuid": "6639d377-8834-4251-b555-00de130a09d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee18c2c-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703831, "uuid": "ce6c572d-4d55-459e-bb08-459e1c9badcf", "comment": "Malware payload", "value": "ea64a0e2c2d5a290c27c483698a4c650", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703831, "uuid": "e6883ebd-a26d-4824-8627-a4a5cb71d726", "comment": "Malware payload", "value": "144ec21f40376f9d1efdf790c0db8badb9d7f91e3773cf8f1b7869b77d73e1bc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703831, "uuid": "bc46e972-8ddb-490e-9f0d-a8785170f79b", "comment": "Malware payload", "value": "2c0db98da30753a85d1d6630f68b157174753a53", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703831, "uuid": "7804e91d-d1d6-452a-8d07-5f00f229206a", "comment": "Malware payload", "value": "7d12ba6df5889bb615666eca845a8e64b8b35051e0b43583d6e46b0dc5fea68079f45d5bb5a0d61980ca351e380ff5a9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703831, "uuid": "a30ac5ca-0ef4-4732-8960-f8d2dcd39bc3", "value": "993302298C5E3B2E572D20E08545DB4FE657689A3C1EC2461C4CB4BAAC067D9227FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703831, "uuid": "6d41777b-433a-4a65-8f99-57a03671eb7d", "value": "1536:aP6z4+ADViS8CWoD94pUnQ64x11RiC4B//dY:0PZBiS8jopkUQ64xit2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703831, "uuid": "aaf58a80-5868-4fe5-b7b3-1036a5932259", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703831, "uuid": "577ac853-b4fe-489b-9cf5-92eeffdf3389", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703831, "uuid": "5ea40c4e-cb14-4652-96e3-e17146e1b728", "value": "diagram-273100644.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3050813d-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702223, "uuid": "032f5cce-c5b3-404f-9e25-b2ae23090fd7", "comment": "Malware payload", "value": "24eef9b7ac8f6162b5082ee81a0ef957", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702223, "uuid": "53615d3b-ba72-453a-b634-19c596f81b85", "comment": "Malware payload", "value": "14504fea5acce19137b39367dbff83adecaa023c0d5cf0f6f9bfbb610735b78e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702223, "uuid": "151c01f1-ce4b-452a-bd72-8f9ef5f3cf5f", "comment": "Malware payload", "value": "33948b37929c8cf05dd547e8fcf1d50746df1c90", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702223, "uuid": "5fa330d4-5c57-4bfb-9016-72262697d750", "comment": "Malware payload", "value": "d3f69420258925e22426ab041a9d40552d62f5ed82ab11b54b8b48fede0082c13b4c209d480c646db2bbd39d1dcfc529", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702223, "uuid": "3b2ddc32-5250-4b1e-8356-978fe1064aff", "value": "F033F28CC688E376A8F17831AC78CB01D578AABB4416C5A381F74AE77807D911B4ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702223, "uuid": "d0cbfdb4-64f7-4750-b834-f78cc776cc80", "value": "768:FwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2N:kFugXVpoD8ZxhrLAuNS07MrxrKsYprPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702223, "uuid": "44ba943b-74b5-4644-a9b7-eac9b9793cfc", "value": 51491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702223, "uuid": "3362b71e-1c69-4793-aa89-189cc2df4761", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702223, "uuid": "82b2edbc-ab00-49a8-8971-333c578db416", "value": "catalog-98763646.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946b7f90-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699814, "uuid": "960e2648-a279-4903-9fcc-359436eb55f8", "comment": "Malware payload", "value": "b87dc8a8b0955d71c43dba13208fe9c5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699814, "uuid": "1d09a101-19f9-46b3-811a-ec02ebfdba74", "comment": "Malware payload", "value": "147630d47a358493de8b93d31db047f41acfe7fa5f5ca511cadfc55f69de50eb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699814, "uuid": "46498902-7d79-4abe-8645-613f3f8bcd0f", "comment": "Malware payload", "value": "40b615ee1d047bca58801f0438f504777a7e5f03", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699814, "uuid": "139e459b-79e4-4d3c-b76c-9f158117c70c", "comment": "Malware payload", "value": "d15a1498f206ad570d5c2fa61bac5493ddaeaa5317782bbd9fae3da4336c28367f7d2b79abdd28f895a02559ef74885c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699814, "uuid": "37d0cae0-cb2a-4574-90eb-a796be37cf2a", "value": "343302C8D6C9D232A8F534369C398B02D46CBDAF4416C5A682F34AA77C0BE51574DDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699814, "uuid": "8d1bdcb5-1f91-4927-8b8e-e5f0b4388d25", "value": "768:OwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2i:DFugXVpoD8ZxhrLAuNS07MrxrKsYy7K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699814, "uuid": "1b8ed789-21a3-4d59-bb1f-79aace432817", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699814, "uuid": "44a11fdd-046f-464c-9c44-11552c9824a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699814, "uuid": "5e3d14a2-d998-4666-b0d1-cd5c2d23aebe", "value": "catalog-1054175918.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7b7454-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702598, "uuid": "87674f3a-2c86-4f77-a157-9863018c0d09", "comment": "Malware payload", "value": "6b8b87e20ceeb10494b566c89237b8f8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702598, "uuid": "e544e901-3f6a-4403-8804-544cbe9c5db1", "comment": "Malware payload", "value": "14815c4ed88fcc966b6cf107e54310e707d9856ca5dc4ecb3f76f7a10515c3ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702598, "uuid": "aefbe135-e256-4ccd-b617-ffe43b326755", "comment": "Malware payload", "value": "84c348d527f3de22548768a61f39695d9f132ff8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702598, "uuid": "a310084b-8464-4c17-81aa-0ff7fd076216", "comment": "Malware payload", "value": "7b16412120fcdb1748b0558040e7c3b0276718b27f4ad61f739f2129bfea7125002dea5987a4f2ba66f3b1443ef9b41e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702598, "uuid": "cba72fb1-ab79-43cf-be59-61d72b3d05aa", "value": "4D33022B8DAD7A29573D10E48540CB5EE617689A3C1DC5406C8CF4B9EC067B9163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702598, "uuid": "58db83e7-9add-483f-bc77-f713346e922f", "value": "1536:ycP6z4+ADViS8CWoD94pUnQ64x11RiC5d9m:yaPZBiS8jopkUQ64xV9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702598, "uuid": "dfa3d294-cbbb-4c53-83c0-7a26ac6fbbe5", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702598, "uuid": "4014c30b-410c-4901-9e72-0c6c8eb41963", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702598, "uuid": "11cd8b50-9453-4088-b960-80a864af35ba", "value": "diagram-131983311.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3404e7be-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700941, "uuid": "1a24b6d2-8630-4183-92aa-9ac9a8344c3d", "comment": "Malware payload", "value": "7d22a444c754b99d4d3d0bca504d9d0f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700941, "uuid": "ba307dbc-38cd-4357-97c2-5f37dd10f460", "comment": "Malware payload", "value": "14848b477659c239858613f70578915b8d1935e56c0a318c821b3497073dd897", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700941, "uuid": "eddcef19-3bd7-457a-b79b-43fd2dacc4d3", "comment": "Malware payload", "value": "f0112479d0bd7fdc31f89b3ace5d54b370b44385", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700941, "uuid": "cb0806a0-b507-457e-ab13-a2ccbe0a7cc8", "comment": "Malware payload", "value": "7f5822a7663adce2151536e927a05bcd0c3099e5493178950ed559c4923b877ed53def07999483c20c9137694474e3ba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700941, "uuid": "d33bdbb4-3ce1-4c93-be62-d53abb4a8b33", "value": "1A330188C6C8E331D8F87431AC788B02E478AAAB441BC96581F786E37E06DD1174ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700941, "uuid": "7a855fb1-811f-4e0e-8a47-d990fad7c954", "value": "768:LwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2y:KFugXVpoD8ZxhrLAuNS07MrxrKsYUJPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700941, "uuid": "adc5701c-4547-40df-85a6-05d99782f373", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700941, "uuid": "e8cfb0c0-c22a-4a7f-9985-b740a44c272b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700941, "uuid": "056e629d-4fc8-430f-8f8e-f1a6921aec6d", "value": "catalog-1945094073.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e32301-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659419, "uuid": "5ad2c152-2be9-4ea9-9c00-c09dca9a8c19", "comment": "Malware payload (QuakBot)", "value": "808dd9334b1c76927ac3a0feac605cf3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659419, "uuid": "f5959fcb-4487-41d8-aadb-6a12c39242ab", "comment": "Malware payload (QuakBot)", "value": "14a94c5a16370dd79753bd5441dd1083e37b8b4208209a71c13716b083a570c1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659419, "uuid": "21707898-8ce0-44df-969a-ac77782c035c", "comment": "Malware payload (QuakBot)", "value": "3d504b646ec6f7546c1fc169688781f2ae61fe64", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659419, "uuid": "b5937d2e-e089-4a94-88be-f4a07eb8906f", "comment": "Malware payload (QuakBot)", "value": "5a7b68ea9657ecd9dd6a5cc4e77b7b66830071c71d6ecf7988b07fc39972ca68dee2862686048a75fc3525b184536fc5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659419, "uuid": "6eef8155-30ad-4e4e-acd4-7a1cf2e33d94", "value": "2774BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659419, "uuid": "6eb31e70-04a1-4d9f-979f-3dc2e7405844", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659419, "uuid": "20c20b8f-19ba-40b0-85de-4f6e06078191", "value": "6144:WnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuX:5FrkNK11G9AEtMxQyOi6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659419, "uuid": "aa6a9f57-b291-4521-ae74-667021dc59e0", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659419, "uuid": "5ff80c72-06a2-440d-a219-f1dead0cefd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659419, "uuid": "f52e05c8-989a-477c-bf41-8b7a089956e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4869780f-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703123, "uuid": "c7eebe56-2edc-4358-bb90-e51389d82a4d", "comment": "Malware payload", "value": "90881f3316c73723f4239e93a821735a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703123, "uuid": "c0c15fcb-80ce-4ebc-9356-87d100d92554", "comment": "Malware payload", "value": "14b2bf6439329d94701d4322d601f3d635f449f0566716e2d75919de9aaf59cf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703123, "uuid": "e2956cf9-5857-466b-b54f-7f0fbf8722c5", "comment": "Malware payload", "value": "3a9c31dc56907d5e3de8b429a8393064a7698777", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703123, "uuid": "8887adac-31b8-4eb1-9d37-4e8b6a82e737", "comment": "Malware payload", "value": "73f8a3e9014c340c7aa842f51532b8aa3e15960887f6f338679cb320111a263f3ef55f4d9c57df6597d99f940ec01d2d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703123, "uuid": "aa7c9874-9df0-44dc-b8de-a85226913bab", "value": "9133022A88AEB639172E50F08549D71EE61768D9385DC9812CDCF867EC066F8113FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703123, "uuid": "ce594c91-2ed5-4ebb-8a9c-89c0949bd37e", "value": "1536:9P6z4+ADViS8CWoD94pUnQ64x11RiCqeF:JPZBiS8jopkUQ64x1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703123, "uuid": "d1bc0931-9936-4130-89f0-ec22171973ed", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703123, "uuid": "82097b2a-fd0a-4573-9ecc-ac8da59bd6c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703123, "uuid": "c3cb08d3-7ba0-47b3-b6d4-ab9fe97336ca", "value": "diagram-1743280868.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21eafe4-a8dd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619695569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619695569, "uuid": "6d9c0aae-451f-4eef-bd35-60eb14b08eed", "comment": "Malware payload (Dridex)", "value": "36e9be084648428ba97e6e9cb4458f69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619695569, "uuid": "76206a1c-e55e-4063-914f-4e67e61f5c6d", "comment": "Malware payload (Dridex)", "value": "14e3a97cf9d7f2ab883b972d1f255fdd158e391e430e1eb1b63abb7325f33d9f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619695569, "uuid": "e86ade4e-e5e7-48cc-8eda-f1e6ae30a372", "comment": "Malware payload (Dridex)", "value": "3839ee5772a8fbd1d728e8b34c4d48eb0ea79e0c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619695569, "uuid": "217d41f7-18d6-4cc2-855d-6b219c3506e9", "comment": "Malware payload (Dridex)", "value": "6ea97fc09373de65ede51314d8a0392dd4787ea22e03419cc7cf99338c1dab8f4d178e08c43400695830b364f1bddd8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619695569, "uuid": "37693647-67c6-4e08-8435-2552fb161eb6", "value": "D3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619695569, "uuid": "984c7d75-1402-4ee9-8a3f-d84469e0305d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619695569, "uuid": "87eae316-e1cf-4c3c-99e7-6e1fe67ec445", "value": "3072:qiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:peAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619695569, "uuid": "c289827f-7c01-4f4c-a721-3be93502f9ad", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619695569, "uuid": "ac68031e-0cbe-4c32-ac87-50c46bbd0996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619695569, "uuid": "20904a6f-eaa7-40e2-b1af-d31698293df5", "value": "36e9be08_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89aaa45c-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659423, "uuid": "b13d9f83-9a73-4d5e-9206-f1605c9ceefb", "comment": "Malware payload (Quakbot)", "value": "e393dc22bbc5fdff0d84a1b39d1a0b33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659423, "uuid": "d63ea6be-7537-40ca-beac-db12cda1bd96", "comment": "Malware payload (Quakbot)", "value": "14e4fb354d6bc913fb6e8519175a45f45d83df7892c71a4fb63b2c8d70d65152", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659423, "uuid": "40fd9a5e-33e7-45f7-91aa-4a541bb96cc4", "comment": "Malware payload (Quakbot)", "value": "b26c7df39f2319b2dfcf72d08ba03cf619a89704", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659423, "uuid": "7a59895b-4a17-4281-93b4-0d3f43602153", "comment": "Malware payload (Quakbot)", "value": "eb5d0d73bcecba4fc08fbb88be81d8b97248ae07a6ad2218cabe521d7d5cbbd75a8f30149079d48bd798f62f0e64f465", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659423, "uuid": "d40f1bec-8943-40dc-9525-d7c0449815fe", "value": "E674BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659423, "uuid": "6d0ba10c-6e2c-4658-852d-e83723989e21", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659423, "uuid": "3210ab16-ac87-4ac8-8639-e6339a940fa9", "value": "6144:1nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRue:6FrkNK11G9AEtMxQyOi6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659423, "uuid": "a0c493aa-483d-4d9a-9167-cb09293148e6", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659423, "uuid": "c449efa0-c531-4260-b3e6-5cfe845f9b52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659423, "uuid": "259b8ebf-cbfa-446a-bb9d-5201611f4134", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6ca719-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659428, "uuid": "fc6f2ee5-017f-46a5-b65a-fb66c0729af0", "comment": "Malware payload (QuakBot)", "value": "da8d06389150925cfe3ff70eaedae457", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659428, "uuid": "ca02bb2c-eb6c-454f-a922-a8833b7869fb", "comment": "Malware payload (QuakBot)", "value": "14f6ff2eacecb1fc776975c7d598812c86b2226a3b44a6c6fd952bf3096ee9a1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659428, "uuid": "8892c47c-ed10-4e51-a857-e71be1f85ee8", "comment": "Malware payload (QuakBot)", "value": "26eccd8e1959d0808b5f6acd0053d660d41baaa5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659428, "uuid": "9fb7991b-44a8-4389-97f7-bea6ee61bcf3", "comment": "Malware payload (QuakBot)", "value": "63880f230f1fdab97551d310f3a21e34c8df92a0eafe2d9165ebf0378c3c7297f2ecab2ecc2799034257a98ebeed878e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659428, "uuid": "89d2f147-1f4c-44b3-ae7c-bc77dca698ec", "value": "CB74B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659428, "uuid": "96a1e0ae-9ef1-4c0b-8a05-ae9f3d459db5", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659428, "uuid": "a6ca6aa7-3c38-4750-a165-59b4b1947b28", "value": "6144:zTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRu8:zbi7/xZrkNK11G9AQyOi67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659428, "uuid": "caf44074-c3e6-4155-9a4e-097366a687f6", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659428, "uuid": "42816d88-5073-4c20-89ea-f75617b9b895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659428, "uuid": "ed059066-faf2-48d3-8de4-78123a04186e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f309f2e-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659433, "uuid": "705dbab4-ce49-4a12-9ef0-2afd495b0bbe", "comment": "Malware payload (Quakbot)", "value": "97275a8a626cdb134cab563307b33194", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659433, "uuid": "1e79a252-a38e-4783-8db4-b59e56ff97a2", "comment": "Malware payload (Quakbot)", "value": "14f871f4d8e63f09508776799569151120a36c75a04203353392f510a1d99799", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659433, "uuid": "4aeeae85-b5f9-4059-b18f-707d5273c5b3", "comment": "Malware payload (Quakbot)", "value": "d9b9c12d7c2c2e7101a8265366d8dc05576a9d5b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659433, "uuid": "4d4243c4-cc16-4280-9158-2f0b5a22dd47", "comment": "Malware payload (Quakbot)", "value": "0087d74ce574babbb300818ae6439040f5e122fc809283c60eaa98aabf9946986991c6d4323faf6ed058ee26b07f9f60", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659433, "uuid": "0dd9ff5f-dbac-4101-976b-67085c34f933", "value": "F374BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659433, "uuid": "e0bcd5d3-fb2d-4c7a-a27b-dd7cf3f1aeb5", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659433, "uuid": "567fee9d-b1b5-490c-b8bf-17726d59b66e", "value": "6144:xnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRui:OFrkNK11G9AEtMxQyOi6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659433, "uuid": "7c48710f-3020-4f30-94c4-1180c05fe202", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659433, "uuid": "848fefb9-a6bf-46d3-a2b3-037caaf9a865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659433, "uuid": "6c859571-6933-414b-96ef-649d04425d94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92020321-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659437, "uuid": "5238fcbc-4e95-49a8-80e7-d7fe2896fd12", "comment": "Malware payload (Quakbot)", "value": "7af4ae31c98cf13c2de743914126db6c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659437, "uuid": "eb484e6a-6e18-4380-bf9a-afc836a2d42f", "comment": "Malware payload (Quakbot)", "value": "150a373e0af7c39f43622a0c00ef75153d91ced75e46f20031405b96ffe456f4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659437, "uuid": "84147a4e-89fa-473e-bb5f-f058ed6ae898", "comment": "Malware payload (Quakbot)", "value": "cd7f6c92eb962d7c4c68778ca8734b983f92b783", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659437, "uuid": "b0fcc456-2470-403c-ba92-750654786687", "comment": "Malware payload (Quakbot)", "value": "c3eb21de02723f49f7abb7a944964b57134849c4e0269200c7c5e83de996902647cf112eabbcc5f49873bc12013c1631", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659437, "uuid": "2feb5175-c6a2-496d-b868-b4d92709be5c", "value": "E674BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE7394BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659437, "uuid": "e74dbfee-5289-45d7-b03c-6e9575e8b908", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659437, "uuid": "6a9ac081-8905-4674-891c-aa77b2f57af2", "value": "6144:JnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRun:mFrkNK11G9AEtMxQyOi68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659437, "uuid": "219738f0-7427-4c63-9ddb-edd6746e30e2", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659437, "uuid": "493c517b-830c-4ef6-a84e-0e7dceccf96f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659437, "uuid": "840aa65a-e459-45d0-b936-6489a355480a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c8b74f-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659442, "uuid": "1692db21-abb3-4aa4-85ad-2b8e70d0b097", "comment": "Malware payload (Quakbot)", "value": "0311f5deecff23b03963b22cbf983e02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659442, "uuid": "96d6f8ac-8ac1-4fa4-a676-dff3fad47daa", "comment": "Malware payload (Quakbot)", "value": "151851ac2736563c48f960533022b91224ea9110672b7f767db2c9d69f2078bf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659442, "uuid": "c0881ada-5343-4c74-93a1-6a74bf5b36a1", "comment": "Malware payload (Quakbot)", "value": "1fbec179a4dc68e3ba94bf27003cac06594da221", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659442, "uuid": "ce796f82-1ff4-4372-b2ed-a138237be390", "comment": "Malware payload (Quakbot)", "value": "4edc4f5e84620b16431ae1b34f88bf05492c19ee6412c63f68a07b05683326f432e99abeb57fdd587c8d3793e8479952", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659442, "uuid": "d4fcd297-712b-4744-be51-332c115f42a1", "value": "3574BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659442, "uuid": "59083412-bb8e-4dc9-907b-da475bb1d8ec", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659442, "uuid": "9b5887f5-43ef-4557-bab3-a2aea0db4657", "value": "6144:7nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuI:sFrkNK11G9AEtMxQyOi6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659442, "uuid": "22d325b4-cda4-4e0d-b7c9-f8b425c13c95", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659442, "uuid": "52a06e42-34bd-490f-a4e6-6e173b97d906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659442, "uuid": "8dc27a4c-7ebe-49e2-b8f5-92e376ad73bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed13504a-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707264, "uuid": "6690b8c9-3797-40f8-8357-b246c7a99331", "comment": "Malware payload", "value": "d8e9a0c98dfe0bc917216963141833a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707264, "uuid": "68be541f-28c3-4d9e-8043-1ceffa550fb4", "comment": "Malware payload", "value": "1521161af55c528948d9791aef80f2ccdca9f0a7d50147d5297b9e0455fa885e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707264, "uuid": "54087669-da69-418b-b21e-4dbff7ad377a", "comment": "Malware payload", "value": "fd1d3fc0e84372e5937c86a0dc6ef5ffc6267210", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707264, "uuid": "43cabca8-70f8-4970-afd0-1ef8bf3a7c17", "comment": "Malware payload", "value": "5549412891a02bfb066f4e1da0dcbaeed2c7d69d077c04789d086d5781162cba6f11e10d14b926c04fcc8ddccaefac4b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707264, "uuid": "4be1f58f-6b4c-4562-8f8b-cd9887be344c", "value": "7833022A4C6E7629573D00F880459B4EEA5728CD3C6DC5821D9CF4AAEC05A9D113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707264, "uuid": "be44f56a-6aa1-46a9-b801-6b50400044a3", "value": "1536:TP6z4+ADViS8CWoD94pUnQ64x11RiC7N7al:jPZBiS8jopkUQ64xz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707264, "uuid": "0155249d-ae40-4afd-9fad-c34a02533bf5", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707264, "uuid": "4caaa98e-778b-4f1d-8623-6e6116abe911", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707264, "uuid": "f1f9748d-de30-4222-993a-1dc31b7f0f1b", "value": "statistic-852354721.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ad7d51-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659447, "uuid": "0fe5e807-92bd-4d4e-9954-19e2f67fae40", "comment": "Malware payload (Quakbot)", "value": "b88f39f4f247c652cd147c721a986247", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659447, "uuid": "602b1300-3a30-46b1-9db7-159328293311", "comment": "Malware payload (Quakbot)", "value": "15233e7be0c1a5248ebf8743ed2a605acbd99b9870365fa238bc03b11893d806", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659447, "uuid": "c305d517-0c84-446a-b2f8-c3a0a9ac0392", "comment": "Malware payload (Quakbot)", "value": "8d11f504815eb57a1068506e4b4fc40d18e55eff", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659447, "uuid": "8e820ac4-48d2-4bec-934f-733c2baa3d2d", "comment": "Malware payload (Quakbot)", "value": "2158e8f2fa06480e0f3f8caea18b4a19fb00102614e99cdb2b6c90a6dfc882970d44922d80d9994af8aa4033ae5a9ffa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659447, "uuid": "a471b67a-9161-4de7-9ad4-5cba3dc2e4fe", "value": "9C74C07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659447, "uuid": "72fe7e08-b138-4501-a224-3027d78a239b", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659447, "uuid": "bf19f8de-9b0b-4a67-b3e9-346cd9bb0498", "value": "6144:iTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuW:ibi7/xZrkNK11G9AQyOi6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659447, "uuid": "784192f4-3825-40a5-b29f-35db5051b161", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659447, "uuid": "8eed9436-c600-4311-88a7-680d8b38caaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659447, "uuid": "cd83c69c-a014-422f-80a7-98ffb979019d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a0a630-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706950, "uuid": "9c366a53-5ff8-4171-b9f9-7f22553ae782", "comment": "Malware payload", "value": "b30529d3c2bc9ee2e4516e9b0235ff79", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706950, "uuid": "b20a7554-5471-48d3-b765-548ae9e48ffc", "comment": "Malware payload", "value": "152da39d8feac3338ecec47ee5b49d8164eea1608d06929673050b949f339a5a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706950, "uuid": "00b13543-cf43-488a-a8b9-e56f63c2302e", "comment": "Malware payload", "value": "8dcbcd63f84acb27b26697eba76d87c50a58b805", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706950, "uuid": "1c9036e6-61f9-4303-bb8c-c881451f0a61", "comment": "Malware payload", "value": "aa0b88a61814c44bf7f23b4539a1ce9d6ccdbcb3c913f9a53d2f480c6a713ec98d51836b8a36f590824b2e6cdac8a65a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706950, "uuid": "c435ce42-b8a1-4bc2-a092-5c8da75dfff0", "value": "2033012E58AE7629473D10B08549DB0EE667599A386EC2821CDCF1B6EC057EC113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706950, "uuid": "be0c05d3-ea0e-4db6-8b80-50ab9cf09ad2", "value": "1536:SP6z4+ADViS8CWoD94pUnQ64x11RiCFhPvC:sPZBiS8jopkUQ64xNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706950, "uuid": "41582160-b301-40ce-97ef-84662ec959fb", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706950, "uuid": "823ad5dd-849d-47ce-a704-0b561d54b950", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706950, "uuid": "f7fd268c-161a-4e01-856c-64236945192f", "value": "statistic-620709860.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9df91f-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659452, "uuid": "25eceef0-fded-48f7-8282-095ec80b0cf1", "comment": "Malware payload (QuakBot)", "value": "8567f6681f90460aec2d4e5b9441ce80", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659452, "uuid": "1ebc5de2-3489-4a6c-a211-09382fe54aaa", "comment": "Malware payload (QuakBot)", "value": "154f5b7dc374f3221b9043333f549c63cb783047b492d912523b8fe8665a7216", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659452, "uuid": "e6e95462-a66e-4fce-98a8-8bd97fdc63f4", "comment": "Malware payload (QuakBot)", "value": "053f8ae759fff53073300b1ba50a2f62d4e40af9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659452, "uuid": "2712f0b2-8dbf-4cd3-9e52-3b95f10fe2d7", "comment": "Malware payload (QuakBot)", "value": "f9b9b2dd26d3368abaf79c565aa5dda22feee815d8d93714e88ec6681c75ab813bec6c0cdf0f0aef10213a528b8ea148", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659452, "uuid": "7adbcefd-226f-4fc4-8570-62cdcb5b8d5b", "value": "5874BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659452, "uuid": "eb79c148-b276-4f42-82d3-af2e9079ff7b", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659452, "uuid": "85c99d38-f254-4046-8bac-751c119fd86d", "value": "6144:enQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRue:BFrkNK11G9AEtMxQyOi6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659452, "uuid": "11383b3d-100e-4b9a-811e-35d4251b789b", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659452, "uuid": "c3333368-948a-41e2-ba20-0a31a78a066c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659452, "uuid": "df5de563-6384-48c0-8952-1bed54edc416", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e9c01b-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699900, "uuid": "ec65f381-67c9-492a-8701-9a577b3a4674", "comment": "Malware payload", "value": "961b49a91a716503d00f3f01309e3217", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699900, "uuid": "aee47c73-8f32-453a-abb2-88c3aeb722b1", "comment": "Malware payload", "value": "156819877f91c1302d7b9c1414c1dc4132d870a2d130788d4312fce595d1310e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699900, "uuid": "18e0566f-81de-4d6e-94ce-d7c02e581c3c", "comment": "Malware payload", "value": "44d4b11f8ed20c0d09e5a7f2433534bc5ed6bdd8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699900, "uuid": "36c34925-b623-4812-bee0-3026b17dd78e", "comment": "Malware payload", "value": "702dae389072ee27c5e37eb8006003e195641b5222c108332f8a3f2757931a2422148b228e25fced288b31bc1c35b059", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699900, "uuid": "307e44d0-8278-4f3e-8116-2e26062bee93", "value": "4F3302C8C6C8D276A4F57435AC3AC702DA787A6B0817C57281F74AD7BD07A851709DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699900, "uuid": "4576c892-cb80-4035-a5b0-f03c965a1a2c", "value": "768:UwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV25:pFugXVpoD8ZxhrLAuNS07MrxrKsYiYSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699900, "uuid": "fa55a301-b539-4567-9f26-639a93cac953", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699900, "uuid": "3a5656ee-e1af-4a2e-9770-17cfceaa83e2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699900, "uuid": "372bf59b-5c2a-4380-bf2a-2850fae444b7", "value": "catalog-1152419785.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c474407-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703907, "uuid": "f0761b4f-a256-45e8-b073-3c542c4eb1ad", "comment": "Malware payload", "value": "982d406b0fa13b826844d1bb5b48a820", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703907, "uuid": "f1630af1-c5d0-4793-b141-d97b4af52f1f", "comment": "Malware payload", "value": "15933c487e7b34d813b8702b750f61044e8ddfcf7dd0626a224b1f6495296166", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703907, "uuid": "074cc8a6-d8b6-4964-8f3a-b8be8ab660e7", "comment": "Malware payload", "value": "dc3562e14f0a6fe2c52e0b858e6ece9ca32c0d28", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703907, "uuid": "ec74094c-c4c6-4d74-b439-8e579983d6c6", "comment": "Malware payload", "value": "f91d35bc01eb0df0dd1e2b06bb34e0c674aaf98d1e966a1c41a8abff64d7dfd941e70ca8f5c1ce624a7694ade9d24361", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703907, "uuid": "74d593ca-4c73-4bec-b2c5-d721e8ccded4", "value": "1C3301168D6D772A532E10F48989DB4EE60724DD3C9DC9862CECF4A9EC016A4123F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703907, "uuid": "d83e8358-a922-4785-b5ad-d7b6044567c2", "value": "768:D9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCt4/:WP6z4+ADViS8CWoD94pUnQ64x11RiCDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703907, "uuid": "77b9e3ad-4f2e-473e-9b63-16a33d8b408e", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703907, "uuid": "a6f9138e-a3c0-4369-90fd-e31b86edb2d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703907, "uuid": "53c7638b-8274-41ad-9b06-16edc3f09a01", "value": "diagram-322473225.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf4d3fb-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705707, "uuid": "e52303b5-45a3-4208-8dc1-9d669caeae1e", "comment": "Malware payload", "value": "5aa62359c30f541a657e44c07439af06", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705707, "uuid": "9d224ce6-1d23-4b9a-893d-f4a519ca7a5a", "comment": "Malware payload", "value": "159981cccfd9b363df08c1fd43daa5a44a31419405c64ee2781ec5b471ab9799", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705707, "uuid": "74f52f9b-427c-492a-a234-e0ca001c63cd", "comment": "Malware payload", "value": "7c487b2d298d10acd7687773febbd318ec912500", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705707, "uuid": "6aa4bb9e-d547-44cd-aa8c-bac605342326", "comment": "Malware payload", "value": "e18a5fa2fe75bdd5fc5a2faf0e76a7054f57882b3c6663fb77022a096d37b02c18a60ac3434ac1632f8497c22350a28f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705707, "uuid": "08b61f5b-4434-4b43-af6b-de32ef247f07", "value": "3E33121658AD762E577E20F44542C74EE91799DC386DC6811C8CF4BAEC097A8053FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705707, "uuid": "2c7f54bf-2afb-49c5-898f-8eaa8d2f2a33", "value": "768:79cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCto:uP6z4+ADViS8CWoD94pUnQ64x11RiCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705707, "uuid": "d1110aae-9833-4b87-b491-225ff7b66b19", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705707, "uuid": "4be68eb0-0967-4ace-a659-e441441bdc54", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705707, "uuid": "2adc133a-f87b-457d-a2b1-a9e5284b1d53", "value": "statistic-1710914616.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6cf866-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705815, "uuid": "bd1a51ed-a243-45c0-aeae-aad1497c118a", "comment": "Malware payload", "value": "c3f968c27796030abdbe1f5720818ead", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705815, "uuid": "5566b48f-455f-47c2-a6d8-ea8d46578e33", "comment": "Malware payload", "value": "15a41f07ad0d32d9338852b65860ea47acf510fc0bd16604bbf5472d923ef68d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705815, "uuid": "d394ea3a-80be-4e34-98f5-40721e9c883f", "comment": "Malware payload", "value": "eaf3f836d245815d5adf2f4be44f2e25172c206c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705815, "uuid": "f76fb9e8-d695-44f3-8758-cfa49eb6f187", "comment": "Malware payload", "value": "e7aa3846fb5dd1848b6662fd6fe0ff7b545a9b35a5846ed0e7ff086f78136baa5a0820a8d45d31cd2371373689926a51", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705815, "uuid": "ad7a0d4b-bdbf-44cb-bf89-f68b2dc1f1ab", "value": "3B33021A9C6D7A3C933E14F08941972DD247689D387CC64218DCB4A6EC0A7AC153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705815, "uuid": "cdbe54ed-3470-4e19-a12b-5d3acb9c3f1f", "value": "1536:FP6z4+ADViS8CWoD94pUnQ64x11RiChpp:xPZBiS8jopkUQ64xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705815, "uuid": "c760fa48-25e7-4d95-bc44-9a3183fc0cd3", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705815, "uuid": "ff5cf9ec-6496-4e82-b777-a6c12e9cf5c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705815, "uuid": "b6844bb6-5f74-4729-8195-2d0dc90f88b2", "value": "statistic-1801812602.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe6c45c-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704263, "uuid": "fdc6d4b9-4d2a-4c59-bb75-3e9d58aca014", "comment": "Malware payload", "value": "a5f7222feedc4ec823ddd355ec2c49b5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704263, "uuid": "e48cd60b-f776-4c5e-bb24-b4aca94db5c4", "comment": "Malware payload", "value": "15ab860384131227b045414e9d2b1ea7c5909153e0c4b4359442e0d03f8a6c9e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704263, "uuid": "61d872ee-20d7-498d-b27a-5fc8a68dbf1e", "comment": "Malware payload", "value": "2fabf7fae6902d45e287987aa13792c16f9a067e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704263, "uuid": "fa7f63d1-6763-4d01-b597-919e993bd1f3", "comment": "Malware payload", "value": "a214cc76fb7dd370b7fde8e47a6a5d0cd4e676ca3d603679ec82402c7ca09207a9465d6ec1df6a97f7bbafb3f909ebfa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704263, "uuid": "732427dc-a67e-4890-9c14-490472454a54", "value": "8433021A5CAE7A29437D10B08159970EEB5768DE387E8AC15CCCF47AEC05699023F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704263, "uuid": "daeab654-9c55-4e19-8238-f4005325dc79", "value": "768:h9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCJj9:UP6z4+ADViS8CWoD94pUnQ64x11RiC7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704263, "uuid": "f8a6591f-5c81-48aa-acb2-48498c37ac2c", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704263, "uuid": "9f112c18-6967-4a25-9803-6b7e8f07b4bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704263, "uuid": "3ff2f909-2e99-4484-80ea-a5c1ef24f85b", "value": "diagram-643161986.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9e52e3-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707321, "uuid": "782d3897-2f19-47ae-8b6a-b897c343a617", "comment": "Malware payload", "value": "f0ec50ab5a10c393c92d810bfd27b50b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707321, "uuid": "706046de-5135-4074-b7bd-8c00408cb029", "comment": "Malware payload", "value": "15b77a1e67c03b28f42db35eca8a2ecad73ec2ca6d74dd033af94eb55465157d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707321, "uuid": "e6d9a54f-c289-40f5-880a-da5f48760320", "comment": "Malware payload", "value": "2ed70ba5321c56fcafe62ef56b939362d118b81d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707321, "uuid": "961c285c-96eb-4a09-a303-92d43a085c7e", "comment": "Malware payload", "value": "37662a7c44f43e742513735cbf96675aa273851c152d99aa053f1401985e0a3b5e11966c266d508d5dfbc06270a2aed5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707321, "uuid": "e669c131-a68f-4c2a-9645-4abfe14c3c24", "value": "703301298C6EBA2D577E10F08185DB1EE653689E386DC5811CDCF469EC0A6E8113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707321, "uuid": "46f264c9-bb38-4844-9698-855aaeebcf48", "value": "1536:GP6z4+ADViS8CWoD94pUnQ64x11RiClG6+:oPZBiS8jopkUQ64xbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707321, "uuid": "4fbb9727-c812-4d58-af22-0090c7e39aa9", "value": 51483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707321, "uuid": "f2f29743-ffeb-4fd0-9554-bcbec891538d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707321, "uuid": "31af8d54-fb8a-4093-aa60-1dcbfe1683e7", "value": "statistic-90354322.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26df412e-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707361, "uuid": "da47bb78-9a88-4d54-a438-1d571f37d50e", "comment": "Malware payload", "value": "1765c033069d548950d6b747560c369b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707361, "uuid": "c6116fe6-10f5-43d9-a6a2-f05c1bd1c2cb", "comment": "Malware payload", "value": "15c74e7b2a9bb4d54ad933370005d09359a436e090c7cea8ae0ae7014ae86d20", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707361, "uuid": "2dd74ea0-83c0-4458-8f54-02b24a70f35d", "comment": "Malware payload", "value": "2ed6313b849895886f3489b06f944353a8bb5a21", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707361, "uuid": "e330b185-4176-4bda-aa4c-de169b115962", "comment": "Malware payload", "value": "7393b373ca4e44c112c5e9f6b9fc78d640b94eaf308ef8e8d8578c98e7ecf952903e22f4a4afe1934683bcb71290a91b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707361, "uuid": "52179144-d0d6-4eaf-98a3-156a35327326", "value": "3733021958AE7629532D20F046819B4EE9536CAA3C6DC9416CCCF8B9EC092A5127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707361, "uuid": "257e4075-b81a-465a-8a65-ecddf5e529ad", "value": "1536:SP6z4+ADViS8CWoD94pUnQ64x11RiCGa+V:sPZBiS8jopkUQ64x/+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707361, "uuid": "720638b3-0425-41b7-aa39-549ef68bba5d", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707361, "uuid": "e843c5bd-f545-41b6-bea3-90b5fc57daa9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707361, "uuid": "ff3e9bd5-df52-4f34-acf2-b682c243e6dc", "value": "statistic-926727258.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d65488d-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659456, "uuid": "b610b1a7-6ad0-4fcb-9fbb-9ce31eb14fcf", "comment": "Malware payload (Quakbot)", "value": "fb3c84c5f47c6b279f3f02ff840d8143", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659456, "uuid": "eef29169-69e6-4e4a-9437-50993dd80586", "comment": "Malware payload (Quakbot)", "value": "15cded58adf1e1d1851e6a1a01606a4b35df27a4e998d4f02fbb92940c5603ef", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659456, "uuid": "599be133-09b5-4f0a-bf03-75bf103e9ee0", "comment": "Malware payload (Quakbot)", "value": "61f186fac4b11fe2eb786ab197efa1dceef7a6d4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659456, "uuid": "b048a788-edaa-4570-a581-c1f5fd36f579", "comment": "Malware payload (Quakbot)", "value": "58e7b2eb42294ebb595e988e8cf2c74ae671efee48575c917a70ffed59db5c22d2ea9bbb89e0ceab44b1656e800cc77f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659456, "uuid": "84fdfcfc-4729-4381-9e27-fdcc6b051252", "value": "CF549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659456, "uuid": "f037366f-37aa-4f78-a1a0-57d3236b5f4e", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659456, "uuid": "db4b613d-be76-41ff-8d59-87b3b4ce8d92", "value": "3072:q3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ99:Gvv9sMoXBaRmr/dukbvuZ/7fR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659456, "uuid": "cceae22a-9b76-4e27-ad95-3c25f9e1b19c", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659456, "uuid": "ed2be26b-0cec-4ef1-86dc-5071490f688b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659456, "uuid": "cfd9d49a-7386-41ae-bec4-c8d482be6360", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c950d3-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702125, "uuid": "6aa635bc-94ae-4e1d-a90c-d45b7ab57b5a", "comment": "Malware payload", "value": "4086399baa2f5bddaf52f53a3b9114e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702125, "uuid": "532787dd-ab71-45b2-816e-63c000e5735a", "comment": "Malware payload", "value": "15de91572b05c83b013904ba6ac2dd09ba54a038777d4b7812c2ea0c00f56c83", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702125, "uuid": "a35dafb9-fe02-42a9-a039-2ec19bed7437", "comment": "Malware payload", "value": "ec5e02088bfff3277890282a51587b8326c8cd79", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702125, "uuid": "e3d42829-eaba-4def-8dc7-bce8e5b9df48", "comment": "Malware payload", "value": "ba9e1e9816237f42f41fe74bc68fbf5568c0c66d79ca6c6217e20bdb30b707e30d6f69e3f71551adcb9a8097364e8ca2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702125, "uuid": "5c57c0bc-107f-4e0c-aeb1-2920589d9bd9", "value": "CC33F148D68DD332A4FA34355C3ECA01E9BCAA9B4816C56281F78ADB7C07D941B4BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702125, "uuid": "34239af2-52cb-4c35-9c5c-688cc946205c", "value": "768:pwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2W:wFugXVpoD8ZxhrLAuNS07MrxrKsYMeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702125, "uuid": "801981ae-9257-437e-80ae-dc9c40297e3d", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702125, "uuid": "d407d367-2249-4401-b7c3-89d8ff7501cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702125, "uuid": "d1b8be1b-78e8-49a4-a418-2f83d2d4bdfc", "value": "catalog-928749718.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d313a069-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705503, "uuid": "3ebe5f23-4ff3-4437-b296-23713f8331e5", "comment": "Malware payload", "value": "624dd3854d2e99e6bbdee73393313959", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705503, "uuid": "63320024-ba73-436e-85cd-37231cf4d730", "comment": "Malware payload", "value": "15e2c34639b4567246de4d812cf4cb519693295f5d7b38cc643d45d620ba15fe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705503, "uuid": "b1b3f894-92bf-4f67-bc5d-26d6f6714c86", "comment": "Malware payload", "value": "513ac5cbed36f35d66e381866a36b0a932e79c67", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705503, "uuid": "c68e7eb3-397b-401e-a8ee-16b5903d4c42", "comment": "Malware payload", "value": "356ed12b5bbb41407103ca08324f872bda85b2d4d4ff0284ccc5cab2010cc5f683b161710fc4e302782698b95d0498e8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705503, "uuid": "8b11ff41-dc82-44f5-8e1e-3df931a1332b", "value": "AE330219989E7629573D20F045819B4FE9536CAA3C6DC9416CCCF8B9EC092A4117FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705503, "uuid": "d1bf7eb1-dc77-46a7-8e64-34319ff56312", "value": "1536:yP6z4+ADViS8CWoD94pUnQ64x11RiC0a+w:MPZBiS8jopkUQ64xJ+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705503, "uuid": "80208eb5-6e22-4716-bc4e-5d54308ac2d9", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705503, "uuid": "496da6c1-046e-4366-ad39-15e854e6695b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705503, "uuid": "b619d800-0412-4f19-979f-0c93b7006251", "value": "statistic-1546858670.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0529c55-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659461, "uuid": "568aa7aa-645e-4ba2-9e22-6a6c1e1d40f9", "comment": "Malware payload (Quakbot)", "value": "7e07664d5193848941a207ad8d6308a0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659461, "uuid": "7823e0b8-de27-424d-8426-461cd2891019", "comment": "Malware payload (Quakbot)", "value": "15f586666dc240241f4fd22a9515429f8bd1ad76f549f745e33e33fd4d4f2713", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659461, "uuid": "34466042-5a7b-4924-a2e9-a1fa6a6c138e", "comment": "Malware payload (Quakbot)", "value": "1351aaaee56e61faf36410f1f776f8020743d070", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659461, "uuid": "9925e507-437a-4fa9-b7b8-5f87e09c1ebe", "comment": "Malware payload (Quakbot)", "value": "f5e7d805d944335e7ba5d16406c277e37aab946b31688ab80d16f99553d160a33c4a318ba23230ad162130543ba05406", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659461, "uuid": "23036621-788b-4f9b-a9c3-f9e69faaa1d0", "value": "80549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659461, "uuid": "58e55383-34eb-4f3c-a0c6-a5d2fddcf120", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659461, "uuid": "dea32748-b930-466c-b196-49312a8855a0", "value": "3072:q3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZL1:Gvv9sMoXBaRmr/dukbvuZ/7fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659461, "uuid": "2c9a2e12-913a-4171-aabf-101e2791261d", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659461, "uuid": "9e8e2094-7193-4980-93fa-02efe0dc77e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659461, "uuid": "4c2780cf-e1b1-4be0-9efa-6a155b349c84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e0ba9a-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701016, "uuid": "5672bf05-1bb7-4d94-8a82-5ea854b3989c", "comment": "Malware payload", "value": "5dbbfb15caa290ac0a91c725e8b8f165", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701016, "uuid": "54600288-be0a-4ec7-952c-2e34f933d32b", "comment": "Malware payload", "value": "15f6975be11b2d1f46a4f13aaf010806b8a011f940868157c6be7ca8f6259e0a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701016, "uuid": "8b9214d2-96de-434f-ac20-94d6d4a7cd77", "comment": "Malware payload", "value": "e88a7c088e66c03751b68f4cc72b6558a395eee2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701016, "uuid": "a2ee1658-2fed-4a51-933c-872e57a17389", "comment": "Malware payload", "value": "a170561102cde72cabe597e1f38a7f46c88b3a5966882fbd8dfc043b9d9a8a7049e2341513f4083752407f7475470322", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701016, "uuid": "4a37f149-6ada-4467-a175-624d1b7a3dac", "value": "B83301C8C9CDE331E8F534355C398B02D578BAAB4427C1A181F34AAB7D479A52B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701016, "uuid": "7884cf1a-4d2e-4f1c-a78b-2f867a61a2ea", "value": "768:awnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2a:HFugXVpoD8ZxhrLAuNS07MrxrKsYetH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701016, "uuid": "5b14ac34-ffff-4a6c-be25-bc1eaa5f66e5", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701016, "uuid": "39238089-3b0d-4408-821a-1401de82cc7e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701016, "uuid": "485ea6e8-7fe0-4d5b-942d-d42d9f36152b", "value": "catalog-2004402627.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3166fc1-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659466, "uuid": "73bea2e8-3165-4cd1-b961-f29bad2ab758", "comment": "Malware payload (Quakbot)", "value": "639697deabcdf0fc6a55819d14c49d99", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659466, "uuid": "cfb881dc-e61b-4b9b-af80-3665dcf27bad", "comment": "Malware payload (Quakbot)", "value": "160a14d6261d18e85014188b652006ff59c153f7e953ce3afb52aaaf9804ed6f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659466, "uuid": "29166bb3-9963-4497-b699-4d1d11bf27bb", "comment": "Malware payload (Quakbot)", "value": "efe82f43db14be3b3fd8ab1d4d9223bfced2bfda", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659466, "uuid": "0fd05797-325a-4225-99ee-09fc1c653cbc", "comment": "Malware payload (Quakbot)", "value": "9c04b35c06f7faf6bf2e5a2c2f2c4ef2fa8c4be864bb00d3c74ab7cd6e875591a171bcb986c6ce83f6ed1d30ab27b815", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659466, "uuid": "d5bb69f6-6242-45e5-a14b-0db098470651", "value": "B374B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659466, "uuid": "da985875-370d-43c6-a158-dc9a078d2f2c", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659466, "uuid": "7e05201a-2862-489b-9036-f884abca255c", "value": "6144:ETfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRun:Ebi7/xZrkNK11G9AQyOi6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659466, "uuid": "8f3bce61-44f1-4ca2-bca6-7bcccf1c660f", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659466, "uuid": "138d20b2-f25e-40e5-937f-fdee1c83c473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659466, "uuid": "c71c0e34-e836-4e19-aff3-7ae969b7332b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250b2d72-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700486, "uuid": "65f3bfcf-523e-4393-b2d8-820955f88e47", "comment": "Malware payload", "value": "13450d76314fc1a43ab0a023c7c1d964", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700486, "uuid": "12fd0901-dafb-4269-b02f-1dd6eb2c603d", "comment": "Malware payload", "value": "1624d9dcfdb46e1758d3e5e4bd2dfc1ba2e655af89b3e0ba6da2a762de5ac94c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700486, "uuid": "e24da7d1-41d3-4298-a041-b5a9cce33e7a", "comment": "Malware payload", "value": "2d32021fd98b24b818bc0293f13c57444e2df576", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700486, "uuid": "6d834998-7445-4c53-97b2-2464aa2f2a94", "comment": "Malware payload", "value": "f3482d44bc3ea7566fe513edafe6719f2a888480aaed7cfd0055965ab7a11e1b7da4e8669a0c0d4c3d6874c868cdf8be", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700486, "uuid": "ff79e63d-7fa0-4396-931f-11fbfcce328e", "value": "3A330188D6C8D372D8F639319C7A8701D9B85A6B040AC991C2F787A77C07AD5274EDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700486, "uuid": "275a2741-ad6a-46e1-8d42-7903792a34b0", "value": "1536:jFugXVpoD8ZxhrLAuNS07MrxrKsYA37BB:Lq41rLZNkZLYGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700486, "uuid": "148b44d2-a73b-44e9-87c9-ae661e61a7d9", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700486, "uuid": "82a3e07b-b1e7-4df9-aabf-9e9aa77d28a8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700486, "uuid": "de36a7b9-fcc3-4737-9743-6ed5c6ace222", "value": "catalog-1561275222.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6d0b54-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701119, "uuid": "7879d29b-e08a-4947-9e96-127b30a2d9e5", "comment": "Malware payload", "value": "56d6cfecadea052d9660dac642441888", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701119, "uuid": "74689b43-00a2-485f-844f-3bbb21df80dd", "comment": "Malware payload", "value": "162ae2fbe267bca4a7d9b23b2a57b9f33c03bf8aebb85e186d831aa43b80fe35", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701119, "uuid": "b83f3ba1-f388-4629-b716-262439889567", "comment": "Malware payload", "value": "adb813ff104c75fb5ba0086e1da6713685f49f0a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701119, "uuid": "bd88fae2-38e3-48b3-9489-85e2e0bc89df", "comment": "Malware payload", "value": "de37cbc461a91d660812a10b2e8a37e9855a0db3b01158c9555357034ef6e096b7e5eafe8b3ca73fe3fe05b9317da448", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701119, "uuid": "0627e6e2-1c9f-46e9-bede-45c90f013c43", "value": "1333F1C4C9C8D232A8F57871AC798B02D538A9AE4827C56285F74AD77D03E92274ECDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701119, "uuid": "59b341ff-3c70-477f-b508-aa8e8c4bb2d0", "value": "768:XwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2E:uFugXVpoD8ZxhrLAuNS07MrxrKsY8Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701119, "uuid": "a5c7a36d-242d-4933-96e7-47952391864d", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701119, "uuid": "fa7b8b44-9b3a-4ebf-b38c-4e4435bab8cf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701119, "uuid": "0dea62f3-6bc7-4d5e-af3e-ac6ab1dabd1a", "value": "catalog-2082897040.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d9c4b6-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659471, "uuid": "cd91b760-544a-4c03-a4a3-4e6fb780e3cc", "comment": "Malware payload (Quakbot)", "value": "956563908d111d1f5a72c8a774c07eb6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659471, "uuid": "c3492336-8c1c-4112-8448-5e2925640ff7", "comment": "Malware payload (Quakbot)", "value": "162e64801315887d146d845b43869c09f3d93be5479c4b8b70ec0bb40a1ed6c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659471, "uuid": "ee578f8d-7805-4007-867a-664c39dd0bbe", "comment": "Malware payload (Quakbot)", "value": "f014d5d70913a459c0b8829c97041a2877476ad4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659471, "uuid": "96fee8cc-0149-4b20-8a60-1649e669af93", "comment": "Malware payload (Quakbot)", "value": "d67b058f59067d5e961cc47c9be3ade835dab8ac9e5892792472bec172230b4308edf165fa0ba55961a4bedfbfdbe865", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659471, "uuid": "acff2364-65bb-4230-86a0-7424a3ccda38", "value": "ED74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659471, "uuid": "72b569f3-02f7-488d-87a8-a43c2597d401", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659471, "uuid": "8ff748a5-ed2a-4e5a-9503-df6451610fa1", "value": "6144:DnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuy:UFrkNK11G9AEtMxQyOi6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659471, "uuid": "5654d29e-20cd-40f3-91ea-fa9048f95f63", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659471, "uuid": "38094b38-d47e-45ad-97e5-997348b8e330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659471, "uuid": "724e452d-9e54-41c5-8c34-c15c2de518a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89c4a5d-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659475, "uuid": "100d39bc-7c0a-4b20-8d59-b479daef8b5a", "comment": "Malware payload (Quakbot)", "value": "0c535fa0a1447fdf6a9175aad00468c4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659475, "uuid": "f00b6f69-c9c2-43d8-a42f-393860295b02", "comment": "Malware payload (Quakbot)", "value": "162ee0052f7337b333f0f2d2077c92485a9c30e2ba5d9213307718cb81f685ca", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659475, "uuid": "2676750e-3aa9-4611-af08-13ded138aacd", "comment": "Malware payload (Quakbot)", "value": "b548179a364ea4bbc898e235e867f8d2714c5b65", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659475, "uuid": "a38e8fb7-dde9-4e18-b1aa-9091d8fc4ac1", "comment": "Malware payload (Quakbot)", "value": "4ab6668512b207ac49879e028dc9e52af8846fbdf46b6b464ad9a4f212ae0991497d0ebd1553c5b4ec8b28a644965c59", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659475, "uuid": "c2d03bc5-089b-4d71-9eeb-efe950b0007a", "value": "1E74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659475, "uuid": "22132491-7970-4b73-8e04-714a74c6a8d6", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659475, "uuid": "6dc6ade5-e8a0-4cd8-8864-806942ef201e", "value": "6144:FnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRul:KFrkNK11G9AEtMxQyOi62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659475, "uuid": "39c977ae-d7c0-474b-abfc-41da7ac0627a", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659475, "uuid": "b270c859-7187-4104-a236-a0dadbff0096", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659475, "uuid": "1e0960cf-f449-4849-9170-9f927a3e952c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51cd1c6-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702875, "uuid": "3c76dbbb-490f-463f-bc3e-40acf5ccbedb", "comment": "Malware payload", "value": "b5681d9bbce27d7b89fcf0fd3d9e287b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702875, "uuid": "07c83e3a-9221-405f-b0f0-b4e2ce0a9339", "comment": "Malware payload", "value": "16395d48b8bb820353920a38040d5d4c9c3a112ee5a2b3576679634bdaa286e3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702875, "uuid": "84a7b0b6-a861-4b0d-a876-396391bd6856", "comment": "Malware payload", "value": "a5e206b7dc632b265b275f2f3d4a5ab57de1db56", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702875, "uuid": "52d02a7a-46df-49a6-99a4-6f712f4157ae", "comment": "Malware payload", "value": "146767b4b1f3c003f627b7797ce855b9e848f8f573b2d69f4be701a4f0491bb722f74439d9b037bf1b58d49dc3ebf3fd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702875, "uuid": "08421b17-8a65-41c7-85d1-7f8431c55541", "value": "0B33022A4C5E7A29577D10E04986CB2ED10769ED386DC5812C8CB4B6DC06BA9163E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702875, "uuid": "aed00b1e-ce91-441b-ba59-e71434da5ea4", "value": "1536:+P6z4+ADViS8CWoD94pUnQ64x11RiCBKbGo:gPZBiS8jopkUQ64xubGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702875, "uuid": "03317232-eefa-4ae8-a735-829e491b4791", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702875, "uuid": "c42293be-3d4e-4c2c-b3d9-20ab3acfbd2d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702875, "uuid": "906c9e3a-6135-463a-8c39-a72a1cb26673", "value": "diagram-1524085535.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4e7131-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705220, "uuid": "d3360eed-456e-4ca9-9297-51f165d873b2", "comment": "Malware payload", "value": "4729b200370e46079274b5779ed314fc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705220, "uuid": "260e6603-9062-454a-b605-d8712a9615f9", "comment": "Malware payload", "value": "16410225bd390d453f7d594415955447f771b527b30b450d5649a62067af7133", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705220, "uuid": "e75e522f-ba01-400a-8762-c521e0f1084b", "comment": "Malware payload", "value": "887dfbcb25253898e75154ff3aa311bb01c86090", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705220, "uuid": "dbf89188-b097-49a5-981e-b14a90e4a04b", "comment": "Malware payload", "value": "d77955d553331c1bdc5369f3da195b1aa248c0f8a99c99abaa43db1d753b08a51e0ab3a7778f88c515215655057f0e0c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705220, "uuid": "62240af6-5326-4c11-91f6-2c63fbf68227", "value": "9733011AA82E7A2A577E10F04189CB1DD11728D97C2DC1415CDCF4A6EC06BE9127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705220, "uuid": "bb5b901f-1570-4914-8872-ca378932de9c", "value": "768:c9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCZ5r:1P6z4+ADViS8CWoD94pUnQ64x11RiCZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705220, "uuid": "89de45ea-8af1-41cb-9e37-1a2be4af118f", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705220, "uuid": "4a2932fd-81ce-4b2f-8ff8-89e6ed4c0dd5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705220, "uuid": "ef60cc56-a041-42ad-82e7-3c112ce5a774", "value": "statistic-1286655394.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ebeb1b-a936-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619733873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733873, "uuid": "a3a11b4c-d27e-4bfc-bb70-f039cc156e89", "comment": "Malware payload", "value": "b8ecd6adcc24fa2fe39b1f8955dabec0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733873, "uuid": "08d32b0b-dbb1-41ad-8adc-b2f1f2ee00f7", "comment": "Malware payload", "value": "164516744ea3531bd6d948eff0a3ec38d00b5dd5ec04fd124ab3b44032b72598", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733873, "uuid": "a0c6efa7-107b-420e-b282-808871e04039", "comment": "Malware payload", "value": "9bbb1bf4036e2c550e7ceccfaaf96ffd999c4475", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733873, "uuid": "18586238-adf4-41e6-9105-2cd083a5ab27", "comment": "Malware payload", "value": "dbba9c857a31ab54ff3e443d1fd27d92d01ee3fb8ee782566a532b70fc26f4afc530601a171ad8bc96f12f3a6ba08490", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733873, "uuid": "f313806a-4636-40c4-9394-2dc6186effde", "value": "0FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733873, "uuid": "c128f9dd-46ae-491a-986d-9a1d9421ad00", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733873, "uuid": "7f803dc4-69fa-4318-9b48-bc3a3884219e", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619733873, "uuid": "0e076504-a3e3-41d3-82aa-b24f9cb4b34c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619733873, "uuid": "5e0c927a-b8d5-46ba-8c7e-e999e960204a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733873, "uuid": "06d5ac79-81fa-44f1-8ee4-ce33b131ab68", "value": "b8ecd6ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b539ac3-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705409, "uuid": "1328f45b-4c02-48c4-b3d8-f3140240ddd3", "comment": "Malware payload", "value": "86019cc2da2d55611892fd74dd274b1b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705409, "uuid": "59952dfd-d0d9-4dc3-ae1d-9f919e289918", "comment": "Malware payload", "value": "164544c0f05f8abdd71d752bee181d4c3038b40fdc46d51db0969bb072a0cec8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705409, "uuid": "d4e776c4-1d21-4cad-8482-54da2aeee843", "comment": "Malware payload", "value": "bece02e2027508d86635028a4253c9f46059b79e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705409, "uuid": "4742e56d-3c2d-42d2-9a86-681fc01bad3d", "comment": "Malware payload", "value": "75462e4d5b6be291366e63a47045052d56bf286c4882bfacfe9369e8204d5429965fc337a05f245a22283bc7153a9e9d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705409, "uuid": "a1f74fdd-3cc4-4503-8331-6e8e01aace99", "value": "EB3302258C5E763D9B7E10B446819B1EE54B78AD3C2EC5411C9CF0AAEC06AE9113EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705409, "uuid": "ca0b1987-8f1f-4e1b-b512-36db60ccb1eb", "value": "1536:YP6z4+ADViS8CWoD94pUnQ64x11RiCn9Hio:uPZBiS8jopkUQ64xRwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705409, "uuid": "0eb38504-38b8-4cd5-a42a-b853c9ce1565", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705409, "uuid": "fbc487d9-ca51-47b5-a810-cb073e4bc926", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705409, "uuid": "dca21802-c325-4e1c-8f5c-0a194d02010f", "value": "statistic-1464610031.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bbbbb2-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707119, "uuid": "84079797-2c6d-4133-b53e-02aaea3c816f", "comment": "Malware payload", "value": "9526f0ec035d0e55861316962b9c60c3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707119, "uuid": "8e5cd2be-ca61-4d68-9219-79165d025342", "comment": "Malware payload", "value": "1652e5369470cf2bbf74b05a100d4a730a79fe8cb29003f518b421f11f374f72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707119, "uuid": "bef9c841-606f-4cc8-ac4d-806599c9024e", "comment": "Malware payload", "value": "6628a2f211116499c21f30d05931fda4bcd21bb4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707119, "uuid": "16b72d75-1fde-4809-b8ee-3afbc67e382a", "comment": "Malware payload", "value": "2387ec1c091b255decb6f28d59c61b97fb1e977fdfe7ae44c7e59a52db8fa495eb4099c946bfc470b5450aefe77f741f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707119, "uuid": "dcdc5464-ce3e-402f-ace4-51eae546fa15", "value": "733312298D9E7A299B7D20B04049DB5DD45728DD382DC7421CCCB8B9EC056AD017F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707119, "uuid": "a69c55be-bf79-4944-8064-c9825199ea07", "value": "768:J9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCIok:8P6z4+ADViS8CWoD94pUnQ64x11RiCDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707119, "uuid": "77ee5a8f-25e6-4024-b5f2-52ddb6646c00", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707119, "uuid": "b6ba43b0-0174-458c-a297-97408a2d17ab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707119, "uuid": "f01de1a7-c887-47a7-9634-214886448f2d", "value": "statistic-766318891.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab64efd9-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659480, "uuid": "3ef5734b-5d3a-40d8-8ec8-4c05eb395602", "comment": "Malware payload (Quakbot)", "value": "03e2e626f905b93e6f409e5a1255742f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659480, "uuid": "2b43c132-5565-4410-9796-82ea02963703", "comment": "Malware payload (Quakbot)", "value": "1670c76a6995a9ed224d14781c721603e157285caafd7cc9c68433de07d4bcd3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659480, "uuid": "7bfc4e9c-543d-4758-8067-a797feb39c3c", "comment": "Malware payload (Quakbot)", "value": "912d00db88de43b84a103aacaa0c224424f52b26", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659480, "uuid": "a369fb0b-3376-498b-aa2b-acf6591b32c4", "comment": "Malware payload (Quakbot)", "value": "ba84ccde5884c7687d1073534901367db30366a3292738f263a51d1f572cd6dba96dbe8964fca4da3f89d8ef5216dca5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659480, "uuid": "9e25b6c0-9563-4a43-a7f1-36a6388605c0", "value": "E174BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659480, "uuid": "8cb97e0b-fa72-4e39-8339-2690a8289506", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659480, "uuid": "0045aea6-af12-4b33-a78c-f6e6d79a1784", "value": "6144:YnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuN:/FrkNK11G9AEtMxQyOi6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659480, "uuid": "6e8d157e-1a55-4ec0-bf6f-f79351cddce0", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659480, "uuid": "9f56da56-3102-46c0-a24a-b8bdd7b42288", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659480, "uuid": "694ee2b4-0092-42c6-be2c-37ea66e73745", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398d1f8b-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705675, "uuid": "eb6abe3d-45d3-44bb-b8e7-43c167d8b9d1", "comment": "Malware payload", "value": "79cc5d9aca2b29e39e4d9ad2d9015c91", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705675, "uuid": "e3d641d2-1e1f-4ec9-a1cc-0885bf0e696c", "comment": "Malware payload", "value": "167c609a67a0fc21ccff31675e275d94bcdcc3dda4c5e1441819794afdcc6854", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705675, "uuid": "8e07eb6a-598d-4953-99d4-4ab6f21eef0d", "comment": "Malware payload", "value": "9f9bc02d9da6a4c4a23a879720a96cf05704cc76", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705675, "uuid": "9f99a7d0-0a38-448a-9462-29fe9eaee463", "comment": "Malware payload", "value": "f0a774b3dd9fa6a2b995b0797e10b84a010ffc955f83d110452246ba7271e6f54fb637e3a55ccda4ef751756a1c971ae", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705675, "uuid": "8a75dd02-a5c0-4393-acff-121e89bb69b0", "value": "6033021958DE7629532D10F08585DB4EE9536CEA3C6DC9416CCCF8B9EC092A4127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705675, "uuid": "55403548-b89a-45f1-9092-6a384cdc5159", "value": "1536:8P6z4+ADViS8CWoD94pUnQ64x11RiC7a+O:6PZBiS8jopkUQ64xc+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705675, "uuid": "ebf118d9-cdb2-493a-93bd-38a0939f47b9", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705675, "uuid": "566b5cab-a40f-40a4-87d9-3bd30533aaf6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705675, "uuid": "82c6145a-7bac-470a-9649-bacb204b6368", "value": "statistic-1676228925.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2fb5ad-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659485, "uuid": "75f06d29-0791-4af0-8f0c-fb5ac4ed14ba", "comment": "Malware payload (Quakbot)", "value": "3bc993bd48eedd6fcfed6dd319f47030", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659485, "uuid": "220912fb-1505-4e34-b2c3-a1404e327df2", "comment": "Malware payload (Quakbot)", "value": "1685cb604d40a8b0b87823d76027eab42e9224e7ead29ac73d1a9cc37a0bb364", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659485, "uuid": "9f181e7c-5a0a-4d4c-bfcf-9c6e02d99612", "comment": "Malware payload (Quakbot)", "value": "223f08fbd13cab9e3ed59d648460a6e2fd310ae7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659485, "uuid": "510e6d0e-5a36-4e5c-be60-bd7c09a2cae2", "comment": "Malware payload (Quakbot)", "value": "9c3f4b05bb16dd96a593563b8068dc0f19227ce3df6456785c29acddd17cb26907e98df63f8466e060e2368a78cc9763", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659485, "uuid": "19cb4038-09af-4d15-8363-5c107e7a4694", "value": "E8549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659485, "uuid": "1ea6b67e-c641-4d75-9557-6603161c60d8", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659485, "uuid": "b0199076-8753-423d-a84c-e84eddbed65b", "value": "3072:N3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ7/:9vv9sMoXBaRmr/dukbvuZ/7f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659485, "uuid": "a749406a-f104-415f-bb4c-184568a42773", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659485, "uuid": "e7504175-344b-4a29-8438-993bbd46a209", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659485, "uuid": "5cba116c-b53e-4e20-b769-f14b34c09a23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f8d98a-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659489, "uuid": "9f498f9f-947f-4aac-ba6f-eec3be4a8fd7", "comment": "Malware payload (QuakBot)", "value": "0c9ba26f7b9053e2dc8313aa370d3c9a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659489, "uuid": "6f312164-8d66-47bd-82f6-8b239e9021ed", "comment": "Malware payload (QuakBot)", "value": "1687745229f00d45626e341d3ae60e1fb41d3343edfecca1a5f90e659ff02413", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659489, "uuid": "b5bc6366-c064-4390-8ad8-5126aebd98dc", "comment": "Malware payload (QuakBot)", "value": "92db521035755f8dae39cc4e2f6771c4f0b7ac3e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659489, "uuid": "32f334c3-06db-4103-bfa7-dfca029ff8e2", "comment": "Malware payload (QuakBot)", "value": "9c56bcfe1173d9457246206d96c31e0af95b89c3e16be0ff4f9e1489a03805676e40efffc0570093482f26a45b807670", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659489, "uuid": "70f68b9c-30f7-4fb5-b016-792c85b6cf34", "value": "F1549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659489, "uuid": "f61dd03a-85bd-4596-bbe1-a6f767e6a486", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659489, "uuid": "2a43cd84-1520-43a7-a3cd-e7f51bbca511", "value": "3072:03FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZdB:4vv9sMoXBaRmr/dukbvuZ/7fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659489, "uuid": "17ff58ff-1632-4908-94ba-c59dc8ff6313", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659489, "uuid": "7eb9143d-a279-473d-b39d-2a29950965a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659489, "uuid": "73787e68-392f-4e7d-a7f4-775045d6b4df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db54c8c-a8da-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619694166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694166, "uuid": "9974aad7-5ba7-4147-84bb-62fb7e06ab41", "comment": "Malware payload", "value": "1c16747f43cbeeba4cdb0e466ab7dfd6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694166, "uuid": "bfbf51c0-c31e-47c4-bf6d-8c47a619c572", "comment": "Malware payload", "value": "1690f1478436c634e4b6ceb211624836bcba7f2123ad7289098cecb0100f9658", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694166, "uuid": "f44a69c3-5109-4ef9-8aee-c7b3213bd4e5", "comment": "Malware payload", "value": "5810f3ec16c2c99638b75f3a54e312f827d3513e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694166, "uuid": "eaac3c81-f98b-4d0e-855f-c277ffec29bd", "comment": "Malware payload", "value": "2344c43a4c5545b2040fa52ec89fc2b40d313b36c47c8b764046b8931da3943a3ee8bb13e9ab86d89a22d3783881febf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694166, "uuid": "208be190-f414-4d09-a0a0-735c315e5715", "value": "BDF43342B9B2A62F7527FB0C0569403281B604A55BBD95C6FD227CCDC86CB94F87FD22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694166, "uuid": "0ce547cb-91b4-4880-842f-77379f58f276", "value": "24576:+AvYkLR5aP5YFD14Bm8D3LkFcVMKx3r313:+Aw0R2qJgm8LIE7x9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619694166, "uuid": "7fa8ca19-e836-4414-b745-f15d58eedf8e", "value": 788385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619694166, "uuid": "e89264da-3217-46f4-be57-b16f223db093", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694166, "uuid": "e1e115dc-36c4-4453-82c0-26cd858ad4a0", "value": "1c16747f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bd94a2-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659494, "uuid": "59eef600-ae70-45f4-a29c-f533319d64cc", "comment": "Malware payload (Quakbot)", "value": "0e86234c36297b8f446ff42de5ca2b28", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659494, "uuid": "c5c21a01-32b5-4d09-90ec-05ec574b70d6", "comment": "Malware payload (Quakbot)", "value": "169ba29db38640dea59402b1d11a52e4d3731213bab2c9ee0c9dc61d2da58144", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659494, "uuid": "559c0846-b5cb-480b-ab78-0a187cf388af", "comment": "Malware payload (Quakbot)", "value": "729899b25645e9f6950ddd51121603c145d32320", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659494, "uuid": "bb7483e4-4c6f-4c1f-9509-bf1b1fa6dae2", "comment": "Malware payload (Quakbot)", "value": "a86d847c1ccbb8c46291aae8a613a852e32088336c4fa8cbc1d0e0b5daac404e6b9da177bc14cab59ea5d71128a6b4cb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659494, "uuid": "09b39847-5dc0-4ccb-a424-9761c18dd46c", "value": "C2549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659494, "uuid": "50afa580-5c5a-4997-9a15-181d84a6a888", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659494, "uuid": "a6993976-2593-46e5-8099-947ec624ca9d", "value": "3072:/3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZrm:vvv9sMoXBaRmr/dukbvuZ/7fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659494, "uuid": "ef3c99e5-8f3d-44c2-a8cc-e6bad0d97a69", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659494, "uuid": "acf8b55c-df72-4958-b3fa-eff0dc439712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659494, "uuid": "edb42e41-c375-4d76-ab9c-9818bce8e4a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35661719-a93f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619737450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737450, "uuid": "a4b19fc4-1438-4ec1-b238-b197e5224806", "comment": "Malware payload", "value": "f9df727c7ce9ebee16fa5c3dea343829", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737450, "uuid": "77213aaf-e0a7-4061-a38e-172f856eccc3", "comment": "Malware payload", "value": "169c8bd22ee616c4c7c748474c6ef66cadde128843c08ef567741294f493f813", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737450, "uuid": "85e48156-8fef-42e9-92cf-7d0baa823f41", "comment": "Malware payload", "value": "6ea4500630118b626c9a399bd826c7f12e0a6495", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737450, "uuid": "a75e6c05-1461-4a17-bdb7-47d177d4ffaf", "comment": "Malware payload", "value": "8af5d77f157ef8b63b44c80e2e11fe3de069615f91fd38fcecdcc9daa4fcbb485e496f154c742b003dd0623676aabe9f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737450, "uuid": "17e03480-c324-449c-922b-6ef8fe981734", "value": "15F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737450, "uuid": "2482ab8e-98e1-4c0a-abcc-220ab5b57bd6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737450, "uuid": "40708744-e288-41ca-9d49-8a66e2fc6959", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619737450, "uuid": "9bfed937-3ed5-4af3-bcd2-395f9d66fd41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619737450, "uuid": "ef05eac2-8555-4208-8f31-40ce6e6ad0af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737450, "uuid": "defe8a02-0d56-44d0-920f-0423f357c17b", "value": "f9df727c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435df46e-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706980, "uuid": "7e02ce97-3a91-462d-9ac6-07f5035bf26b", "comment": "Malware payload", "value": "d8379197b64ddf3a3e0f57138bc10335", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706980, "uuid": "ed348f45-cfff-4bb8-8a97-a80ecd929737", "comment": "Malware payload", "value": "16af89b7d83c0163425ebccc5719bc4993a57438a98abf6edc19a4747befaf0c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706980, "uuid": "80e04e71-5bed-4cf2-be0d-2de07c4f85ec", "comment": "Malware payload", "value": "291866b9e830bddddbc67e5f350b8ef1cf69b2d1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706980, "uuid": "6982397c-d919-4118-9c92-33f2bf29b113", "comment": "Malware payload", "value": "ca9682ea01a763e787065f903761efbcf49076083c4a3e8a116dc3ffef2aa3a0b12bdb6c2610b173822090387c1e9e7b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706980, "uuid": "a325ff30-e7fd-45dc-9433-06945a04adce", "value": "C933021998DE7529533D20F04581DB4ED9936CAA3C6DC5416CCCF8B9EC091A4117FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706980, "uuid": "dae9c9a4-4be5-493b-8b3c-4aae681e5a18", "value": "1536:iP6z4+ADViS8CWoD94pUnQ64x11RiC3a+K:cPZBiS8jopkUQ64x4+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706980, "uuid": "f039641f-e4b3-4a1d-9b59-bee50bb5aafd", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706980, "uuid": "89a96b53-466b-4195-bfe3-54de508bc672", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706980, "uuid": "74d4f64c-15b5-43d8-95e5-4d5c700b8dc4", "value": "statistic-651353050.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85416687-a915-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1619719545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619719545, "uuid": "abf4eb6e-1ba6-4a65-8e3b-ee32b61a7a85", "comment": "Malware payload (DanaBot)", "value": "c279a62ec30da201ec66c5ff8f4014d2", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619719545, "uuid": "cfa89209-edb6-4d6d-9cbd-8baa12197ba5", "comment": "Malware payload (DanaBot)", "value": "16b4aafdfea48f7e044ad1420b2d14c936fac2881a3fecca360a9692faac2425", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619719545, "uuid": "acb9ae53-2aa5-4b0c-a4ee-7ee689da3f17", "comment": "Malware payload (DanaBot)", "value": "683ddb5789c777fc26fce49e9d2f976f099441e5", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619719545, "uuid": "def15b43-96a0-47ff-9cb4-3be6204f2856", "comment": "Malware payload (DanaBot)", "value": "f735ae1ac1b7f6598119a9e068fc27dd45538574c403f79c4c89339ce660b37e5c176cbccc4f20e18f77c31213225ead", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619719545, "uuid": "7271ef1b-8fa9-4413-b425-63d38c0e86e7", "value": "7C56330630D89076E5C0383A4271DEB66993B464657E8F8F8FAD1CF9AF14BD09B11B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619719545, "uuid": "a60784f2-54c6-4d17-8e56-532f1549fa52", "value": "03ea7c0f38c73d2d72b237bb0cbd5435", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619719545, "uuid": "2e824bbe-d015-4e08-8fc3-cd4c3ea83679", "value": "98304:Xj7WXiNXn/wWMfP2VXcn4xUyEtYNcDgVI2qwaDZ8iy2YrGBA4a:XeXMwliXcn4xUyYss98p28GRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619719545, "uuid": "4fb089d4-7916-47bc-a6fc-b98b19b4e4f3", "value": 6197248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619719545, "uuid": "11679baf-f780-412b-8991-1421b62d0916", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619719545, "uuid": "c6012a41-4987-43a1-ba1f-0f031f9dede1", "value": "c279a62ec30da201ec66c5ff8f4014d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39be039-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702873, "uuid": "5aadba77-4815-4164-9db3-6e33022c1d1c", "comment": "Malware payload", "value": "fc4f70d89b0f1d5e87672f568a52c974", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702873, "uuid": "688767d7-492e-4876-9ad9-3fb40944c6fa", "comment": "Malware payload", "value": "16b72cef7618ee0dd472b52a0d94bba12eb47e78ce5d5e508dc005079362b411", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702873, "uuid": "5cb50b17-af7f-4bcb-a1f5-9fea52748124", "comment": "Malware payload", "value": "e1f5b262e74d51f5562cc2b4c9e095a60fdb472c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702873, "uuid": "ae490411-de83-422e-8113-ce0648b4cc20", "comment": "Malware payload", "value": "5e6f2e1c8d21be6ec142359cf1f9a935fb4a7446cd6e98de93e4232d9cadcaa3b65213ebbdb37259c4f0e41f55e07fbc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702873, "uuid": "922c4e5d-cb52-4fd8-99fe-49f0db6837cb", "value": "6F33021E5CAE3A29573E10E085459F5EE51718DE3C6DCAC21D8CF4AADC052A5027FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702873, "uuid": "1214be04-3b98-4553-a12f-ee62703dedd5", "value": "768:u9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCPXI:fP6z4+ADViS8CWoD94pUnQ64x11RiCPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702873, "uuid": "53f6a854-742b-41f5-9bef-16d2f371e755", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702873, "uuid": "42b70636-6935-4911-9b81-0ab1338c6747", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702873, "uuid": "a4c0ba94-3f9c-4b92-aee6-3414bd1d6060", "value": "diagram-1519690414.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6beb898-a916-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619720139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619720139, "uuid": "115ca42f-8f1f-41cf-bc98-8fde49c61fc8", "comment": "Malware payload", "value": "a2723ffda8d1b64a3ed2b436cc95d055", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619720139, "uuid": "385dd1ea-e311-4613-9df2-93cb78248d68", "comment": "Malware payload", "value": "16b82d957f5ba285cbc5335a8c750ceaa200530b68640772508657030b4e19b5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619720139, "uuid": "1d98c8e0-66c7-4d24-a357-e519e1eea388", "comment": "Malware payload", "value": "dde3d9e9bfab847a1d32eeed19d63d7312c98d04", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619720139, "uuid": "90a8de8c-5592-413f-833b-6e90da689776", "comment": "Malware payload", "value": "0747f11eb9417ed1014979c76be0582291400a044a693ff28afd629508c778435217248d6ef0bd338da321be3529ec29", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619720139, "uuid": "b7dc5265-4423-487a-a932-c4512a26bd70", "value": "3AC533B6FC3349E90850627CDC963CC732D5978F1B2B1DB480698E5C36AEB7E25490A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619720139, "uuid": "c745eec0-788a-41ec-9ccf-a951a2fc1377", "value": "49152:Pwu+7jrrZH2t95iX73sZKpOYOhYPRo5ucU4clTpTApzOOh/KcyHRds:W7zZh7cZDYOhYK5ucyBazO2/Kcyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619720139, "uuid": "c1b4f4dd-2a27-470b-be64-5767e5dad8de", "value": 2527531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619720139, "uuid": "4d8aeadd-f5eb-48be-a9f0-ee6819506c6c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619720139, "uuid": "d8e6d131-8e10-41bf-a65f-d3b3fcedb434", "value": "a2723ffd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb47012-a8a9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619673036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619673036, "uuid": "3c50238c-0979-427b-af74-1a5974eb6766", "comment": "Malware payload (Dridex)", "value": "11ddb6d5e08e716bdc353c6acf6ad03b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619673036, "uuid": "4df30134-39ed-4b0b-b20a-98e60ce46f83", "comment": "Malware payload (Dridex)", "value": "16d3ae3e8d50bcfb27de9b6145105fa194eb371d787c7ddd46a133fe62db8450", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619673036, "uuid": "cd982868-410a-4378-9dc5-55bd11d9cfbd", "comment": "Malware payload (Dridex)", "value": "68e75e52d790286e50084cf38d46fd4651d0f4af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619673036, "uuid": "40f5594f-b386-4de3-b664-036218ea3a42", "comment": "Malware payload (Dridex)", "value": "8f8a29632de868e068f3feca192e5bdbb82f25c79016cb7890d01e2e3e6698683ad755ac9e3cd34c3355fbe5f941a9a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619673036, "uuid": "28c47b90-17c5-44a8-a5fe-6d176c244d57", "value": "8DF3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619673036, "uuid": "0903c4ce-127f-46b2-8bc1-2153859860cf", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619673036, "uuid": "e322344d-e51e-4304-8070-ff927aa0a80b", "value": "3072:7N8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY2Zwd:anClX8WZ7/HrRCADTR0VlwZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619673036, "uuid": "7de8364b-1591-4e3c-9d6a-54c0637dabc5", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619673036, "uuid": "2187b6db-5e50-4037-bff5-4ddff36cfc8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619673036, "uuid": "240f8673-0037-491a-9a52-837a0540248c", "value": "11ddb6d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5edb5b-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707349, "uuid": "673507ad-7cd8-4dba-8a1f-616405a51460", "comment": "Malware payload", "value": "8a6561c0508f1fd18b552982a02a5e02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707349, "uuid": "5678b39d-6a33-4093-94d9-c7329154ab89", "comment": "Malware payload", "value": "16d3d9f4d3cce6f2be2d8ce7e63af61a9889821c7f4fa20ad7560e933dac598d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707349, "uuid": "d10927b3-c283-4359-b0f8-8e65678798fd", "comment": "Malware payload", "value": "9a8e4f7787141f14a23ea181410957e9803352f2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707349, "uuid": "da38a6c2-6e14-41d9-b905-e294275b7384", "comment": "Malware payload", "value": "9b41a8936ee8c451f0deb77d57e3f3079451beda3255f1c2d0886ec7ba252dd85c6e565f6442a838ae1d2dbc749d5c42", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707349, "uuid": "8ac996de-a864-41df-9b34-9ad4f81b6357", "value": "3833021958AEB629532D20F045819B4EE95368AA3C6DC9416CCCF8B9EC092A4127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707349, "uuid": "9cf88c9c-faaa-479b-8d88-6580b5dda2bf", "value": "1536:iP6z4+ADViS8CWoD94pUnQ64x11RiCPa+m:cPZBiS8jopkUQ64x8+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707349, "uuid": "8c31332e-a802-4527-bd18-982c89bc47d7", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707349, "uuid": "f2894cd6-ef18-480e-9d24-88ac3db48e32", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707349, "uuid": "3bdf5a6e-b57c-489f-a047-e33528312ef6", "value": "statistic-917147564.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67d1556-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659499, "uuid": "04f6d984-7e74-4c08-af2a-6ebb79e434b5", "comment": "Malware payload (QuakBot)", "value": "c34aa711f9987c6bef46dab168a58059", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659499, "uuid": "f0eeb970-3f6c-4151-b939-c690e08f0fee", "comment": "Malware payload (QuakBot)", "value": "16e20f3e7e6a320e1c71aeb0160c00466c7dd9d22a2a5e0107e36bb6b0e73837", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659499, "uuid": "24d22726-ea9d-470c-845f-5e7b9d95e75c", "comment": "Malware payload (QuakBot)", "value": "d8edd2deda49cce2eb8df19ed82666064d6c4486", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659499, "uuid": "59d97a5b-0e76-4a18-be34-6950cb25e8a0", "comment": "Malware payload (QuakBot)", "value": "5f025fd0c85d3842c900713525a342d287deaccabb0ff10b4db93bc6de970bc8795a04abe34a7b7f203a2b79a515ebd9", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659499, "uuid": "a4d9af05-cf0d-476b-be35-138537be079d", "value": "B2549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659499, "uuid": "1ecea890-5f9f-4f72-8af9-2e3132f63d67", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659499, "uuid": "0c95c454-0c26-4875-8b37-6955686ce09c", "value": "3072:E3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZLU:ovv9sMoXBaRmr/dukbvuZ/7fG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659499, "uuid": "c2793d3c-a29f-4c31-968b-a38a2c25f605", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659499, "uuid": "d54de7a0-072a-4160-b9a4-93b725303a3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659499, "uuid": "2bcf2c5a-074d-421a-bca5-6066d96115d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c7322b-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707306, "uuid": "b82fe7a5-e5d1-439e-bd4a-42ee58f90f2c", "comment": "Malware payload", "value": "13231ecbb46603014c7fd7297852f732", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707306, "uuid": "a3020011-5ade-497a-ade8-9befb7488c35", "comment": "Malware payload", "value": "16e7eeb04d945e4b3a200e579b1a7be5b42e9ea4db05f1ca3770f562bebd5fe9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707306, "uuid": "1eb09831-5ad3-4586-ae6c-31e9978f11a9", "comment": "Malware payload", "value": "5f4cbf7c3edb7f69480a4ccd924455548b4f9693", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707306, "uuid": "ac17e97a-5f65-4104-9906-2dcdd891caf1", "comment": "Malware payload", "value": "56fa22657b2108abc4de4a0dc5b42bca0120e8de5c7cb2fe41a7f794f3468af69775a99cab4d3e04f8485dedac0b2cc4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707306, "uuid": "f74a54fa-5bcc-4eee-9420-fd5b35dc01cd", "value": "433302194C7DBB2A577D00E445859B4DE643289C3C6EC68218ACB0B5EC0A2E5167F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707306, "uuid": "4bcd1d9c-e5da-4735-9b36-ad0c71a590ac", "value": "1536:IP6z4+ADViS8CWoD94pUnQ64x11RiC92C:+PZBiS8jopkUQ64xuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707306, "uuid": "7b88cd38-afdb-46d2-a67a-e49d050a369e", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707306, "uuid": "6f955d0f-b209-4be1-a63e-155bd218c8c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707306, "uuid": "c414a9c2-d1e3-403d-bbdc-9f09e60c10f7", "value": "statistic-891249477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913c37bd-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700238, "uuid": "c7c0e9fa-de28-41e1-bc49-8bf3d2c7e8c1", "comment": "Malware payload", "value": "a9fde4641a201f039bd86ddae3e9f68c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700238, "uuid": "4408383d-2247-4645-8728-db42d75323a2", "comment": "Malware payload", "value": "16f049f54ca3481c9a09647ff7a3a86a63f1b0fddf063691fb576367e928435b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700238, "uuid": "ebe579f2-7f82-4009-a007-d3d1fc0083cd", "comment": "Malware payload", "value": "daa66fc19acabe3382e653f0b6ea810daf30719e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700238, "uuid": "a4ee6924-822d-4b8c-9e0a-90d16e55efe1", "comment": "Malware payload", "value": "b866caf6dae9f3cc0777663df082ef97e1d78f7a2a916ac2a1a54c993401e4e8a6d0e1f49fafbbdbc499f1c59e4aaab3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700238, "uuid": "7123f9e5-6dd2-4dc3-8262-40e5d83a51d8", "value": "EB33028CDAC8D371A8F670725C7ACA01C978A577481AD56142F346E7BD07AD21B8ECCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700238, "uuid": "90293e97-1866-4329-82d8-21b72e15415b", "value": "768:rwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2o:qFugXVpoD8ZxhrLAuNS07MrxrKsYba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700238, "uuid": "119a80ee-e22c-49ff-8125-dbceaa70902a", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700238, "uuid": "a1305d04-33ed-4a12-beb1-c9148d1ddfab", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700238, "uuid": "f8d6ff7f-c968-4de6-a363-f57c061cd5ce", "value": "catalog-1384829419.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94c87bd-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659503, "uuid": "1abd5709-aa50-4ad2-aba3-3216d493f5eb", "comment": "Malware payload (QuakBot)", "value": "d63b17b99f810fb5c5c84b6b9ece9ded", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659503, "uuid": "0e04e935-0d1a-4ad0-b1b1-11ad8e22a324", "comment": "Malware payload (QuakBot)", "value": "16f130a894eb766fd9ee72639e93c3a64f14d5199da4c1b5f95e9325ac12ec24", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659503, "uuid": "d55f9c16-516a-4755-b768-c4f71caea763", "comment": "Malware payload (QuakBot)", "value": "7dd4f107f8774f413853cd3cf4a8d5590f665920", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659503, "uuid": "0d67b0b3-aa78-4c8c-b0ce-d0bb14649a58", "comment": "Malware payload (QuakBot)", "value": "31abb3d521725764cee414b93b92e2ea1eac3dd670b035c547c451d94fb733930db0cf60ca91de98772bcf651cbe8b63", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659503, "uuid": "89fddc6c-234f-44c9-89f1-d484179dce7f", "value": "00549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659503, "uuid": "11d86bc5-bcf5-4695-9cad-8bcf9b4f711b", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659503, "uuid": "8daa40b7-41af-4835-b14d-71ced9756532", "value": "3072:F3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZqb:Vvv9sMoXBaRmr/dukbvuZ/7f4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659503, "uuid": "86bb1784-d4ea-47ce-a038-a962a80af5ec", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659503, "uuid": "5489c655-ba36-47a0-931d-e7227da07dfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659503, "uuid": "ac1caa4f-2d64-44fe-92d8-d26f5f530446", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1afb26-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659508, "uuid": "9ab67c82-4c1d-43f1-b322-cc6b3dced526", "comment": "Malware payload (QuakBot)", "value": "9a200dd9a9edc3dd8ba7ecf2c0d061b6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659508, "uuid": "9e233fb1-ddb6-4503-97e5-01a76361d776", "comment": "Malware payload (QuakBot)", "value": "16f515d00c53cc2f96c4be62429748a8b592953eb7cf460f04a3c6add877b013", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659508, "uuid": "18487581-2044-41e4-aa8c-1c2780992462", "comment": "Malware payload (QuakBot)", "value": "256074597cd774ca020f6277e06a183f8c4d19e8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659508, "uuid": "ea0eda4e-399f-40e7-8af1-bc21679438c9", "comment": "Malware payload (QuakBot)", "value": "502cbe038d69570279ea7c5f5e5f01fa311717fa32835b1cabb13efbbaf0f8c905b5648a124922e2ffb210de149d7045", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659508, "uuid": "5a6ff5bc-6eef-4dde-9c2d-c2338becfea6", "value": "2574BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659508, "uuid": "5b31e4e5-3443-40b5-ac77-f5e8ced927ad", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659508, "uuid": "21bfd0f0-5164-48fe-907b-2cde5622255d", "value": "6144:RnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuA:uFrkNK11G9AEtMxQyOi6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659508, "uuid": "9002a3ef-6893-4616-acb1-438f63008a16", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659508, "uuid": "e8c65c5c-6afa-44ea-857e-1a30ab6bdda6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659508, "uuid": "57bf6daf-fddc-4ace-8c28-c5d8b9a77f53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf98e7bc-a909-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619714489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619714489, "uuid": "35476c0f-9859-4616-b81f-f66cbe3c8ff4", "comment": "Malware payload (Dridex)", "value": "3a65d459e08709d1fcec3825b24e063d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619714489, "uuid": "cbc50f19-7c26-4998-b4d2-5caeee082410", "comment": "Malware payload (Dridex)", "value": "1704f1c9bfbfd00a4f074922ec01a69cce003f30331afa9d5c8a6d3789f425c1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619714489, "uuid": "9857d0bf-636b-4a4b-bc3b-81a4d20e06f7", "comment": "Malware payload (Dridex)", "value": "62d7d1a71eb3410d0d5aa1b6c52d3923bd20e887", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619714489, "uuid": "357ae832-cdd8-431b-89f9-58deaac6c7c0", "comment": "Malware payload (Dridex)", "value": "368cdae787a158ca996cfec94970019fc81ad5a66ff7379e9c733bfa4cb1a7af22416e70a504f210db85997df001066f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619714489, "uuid": "ab515f6a-0451-42a1-8d92-fd4a83fac515", "value": "7CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619714489, "uuid": "fd93fc12-d04d-4633-9e81-3f0dc908400d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619714489, "uuid": "aa48b270-4dd1-44c1-a233-b270885710a5", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619714489, "uuid": "38837f21-2628-4739-bc8e-ed3a78a505ca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619714489, "uuid": "74940e16-bd83-43f5-b516-224f4ccc5e83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619714489, "uuid": "8d3d0ed3-ca31-419a-b152-439628f4c045", "value": "3a65d459_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8dac1f-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701282, "uuid": "07b9cc5c-a7bd-45df-ae38-9e0b76aaa80b", "comment": "Malware payload", "value": "c82322e12071fbbe8bd32e62eb098a3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701282, "uuid": "8a11af3c-45cd-454e-8d1d-815dc372878e", "comment": "Malware payload", "value": "1716172930b0f8e93ff8a3d8344e38badfce587293f75832a3795ea6eae6db46", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701282, "uuid": "f25b0bde-5994-40c1-b924-f771e791f212", "comment": "Malware payload", "value": "a3cdad41c648432beedbce8a642772639039b5f5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701282, "uuid": "946f5645-a9f4-4b37-8c5d-69d0df733311", "comment": "Malware payload", "value": "091d6cad79402657e209f5ba0d29b1cc7a55efbd1231f041556cdc42b1ae8a7f764474f487a882cce0ee33b6f8170606", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701282, "uuid": "1cbfbe3d-52d1-4927-967b-53f804907a41", "value": "DD33F1C8C9C9E331E8F634349C398B02D57CBAAB4416C16181F34EEB79479A52B4ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701282, "uuid": "b9c97a81-f12c-4f2a-bc87-95fb92863c6d", "value": "768:vwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2Y:mFugXVpoD8ZxhrLAuNS07MrxrKsYetP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701282, "uuid": "a7a6d801-235c-4f4b-8c10-7ef4e9c12fa6", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701282, "uuid": "bfb02f7a-0dc9-4232-8a29-120c30f76eea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701282, "uuid": "f9bddfa8-76a3-4a35-adca-862ad399d75f", "value": "catalog-265702405.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d43f6a-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700385, "uuid": "1157c36f-2d6a-460c-b8d8-171d43659813", "comment": "Malware payload", "value": "c99ab0c8fd45cb4f13b0926c693f5b5e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700385, "uuid": "8b9984ad-cec6-4ceb-b9e4-8191d95e3290", "comment": "Malware payload", "value": "17194c3a80ae74f1d1103737c6922ea9ace88ad8ee3a0020c7e40e3db76f9a57", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700385, "uuid": "399394e0-b5eb-419d-af15-f9958bcc737b", "comment": "Malware payload", "value": "c432b75a421f5b7c271f4f800e3800dfc35d417b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700385, "uuid": "8e6273c1-3b5a-4d83-97c2-6372bb9b6438", "comment": "Malware payload", "value": "a032b9bde342a7ca2f0de8eaf3b4f09248a7b0cb11496bb9636f0ccaa30a7703d0c023483bb2495aaf073427b60bf8f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700385, "uuid": "1df136c2-6bd1-4ed8-8935-bc531168916c", "value": "E733F2CCC6CDD332A4F578305C79CB02E578AAAF0816856181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700385, "uuid": "90520a01-684f-4e9d-b0c4-aa39d10c3b38", "value": "768:mwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2+:7FugXVpoD8ZxhrLAuNS07MrxrKsY/Od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700385, "uuid": "e5bd647e-c677-4fea-b0dd-efd22b720d60", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700385, "uuid": "08376133-53b6-470d-90ea-6d7ffb1acbba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700385, "uuid": "644d618c-02af-4b50-8a27-6db03f9d3d97", "value": "catalog-1497955690.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d5ddcb-a8c9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619687012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687012, "uuid": "0dee2f60-513a-4fa9-8253-d181d3493b9a", "comment": "Malware payload", "value": "d3d43ca9321ae94069515eae5a901c7b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687012, "uuid": "eab7736e-b2d4-4630-868e-8fb5216129bd", "comment": "Malware payload", "value": "171a5bfa51af9b2be16780bfe95960c111d4dd96b7b3ccc5a63c30919774d7ba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687012, "uuid": "78065d69-89dc-4ad7-b753-bb32211206a7", "comment": "Malware payload", "value": "cca71423c9a3ca3ee041ed692766a3dbd73e3a25", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687012, "uuid": "f55d5e1d-61e2-4412-9973-da347ba70ed5", "comment": "Malware payload", "value": "c49275c7ce62bc88619c16feac8549e4416813b5e35ad56d5c8a3958e748eb6e9312fb2a6211b7b5d1089cd6ff4a0989", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687012, "uuid": "b13c815d-a684-4b04-b1a0-5b24664766b3", "value": "5B429F456600922DEB739A3C837F3ECAB71A892C2B959A2E5860379D045E44F0B837CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687012, "uuid": "a662f990-f9ca-467f-832c-332e79927db4", "value": "192:ZIL/++LQo/JlPYrjr6CMACkh3yOaW83oFzpqmp7fwpVPdEO7C70ssetJ9Zvp7Pkm:mqZO3QrP6CMACS35X2oFzpqGI1kHsetL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619687012, "uuid": "17934298-442f-4bab-9ae1-c1610b7e06a0", "value": 12232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619687012, "uuid": "6499e36f-5dc8-493b-af18-e1168b1af76b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687012, "uuid": "374c5521-2eda-4354-a6f4-8cd059828914", "value": "d3d43ca9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49eb9342-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707420, "uuid": "2b2ae350-4cda-4a0e-8298-ab3aec2e7f97", "comment": "Malware payload", "value": "ec88cf78f817ed498f9190e437a6b4a0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707420, "uuid": "86a3c26f-29a4-4096-9b13-ee97ec2fc8d0", "comment": "Malware payload", "value": "171b978aed22bc530c1f7785f159523c4f259e2c0ae491c40a35e88222917913", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707420, "uuid": "7239cc2f-9a35-454a-9a17-851e3ce926e1", "comment": "Malware payload", "value": "e5dbb25ccd39dde275a4f77533349e36a0df89ac", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707420, "uuid": "e4bba6b5-651e-476c-a962-8f60c9c836ff", "comment": "Malware payload", "value": "dd9f968e34f9ec9023213d084150a03e25c540818a26ffe79fb0d17bbfee41d4ebb04a1308ab1c23941274e446656e69", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707420, "uuid": "57cb2a9d-d6c4-41d3-9246-a38384c88031", "value": "1C3301258C6DBA2A573D10F44588DB5EE6532CDC386DC6420C9CF4B9EC066A8263F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707420, "uuid": "c568a3dd-08ea-4332-b813-24d3aa19a4aa", "value": "768:s9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCc:FP6z4+ADViS8CWoD94pUnQ64x11RiCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707420, "uuid": "ee6f81e5-23a3-43b7-8aff-08f581e69077", "value": 51484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707420, "uuid": "c5006d7b-27de-48bf-b625-b4bf610a6f75", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707420, "uuid": "f6a51671-0fb5-49a3-b4ef-2b785eb31fcc", "value": "statistic-96026839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8beff088-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702806, "uuid": "386a61b1-b159-4dec-96c7-1b2fa6fe8df9", "comment": "Malware payload", "value": "3ac6fda435a411e0d9c03c58c3316b9e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702806, "uuid": "0802be2b-dc3c-47bb-bc95-66f5c72715dc", "comment": "Malware payload", "value": "171d853b433c78e030f970f7be3803acede926a98d9ffeedd995ca5180c26fd7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702806, "uuid": "b279e667-ab91-4306-952c-3c1e0c5f71a8", "comment": "Malware payload", "value": "c66a7106f9e9bf4f308a206d580340484bf4074c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702806, "uuid": "1d946116-7ec8-4a9f-9ed6-a96d267e4295", "comment": "Malware payload", "value": "910727f38a361abe475dbbac41041cc0d2ba0f6a23ae93c490f6ec9c5f27de0b6ecc2be3a14a91e711fe823241e2d4ec", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702806, "uuid": "d5054339-b7ab-47b6-9723-c637ae549041", "value": "3F33022A8C7E7B28533E10F14986DB5EDA076C99382DC545289CB0ADEC067E9113FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702806, "uuid": "062486d2-fd6c-476c-8ddf-42592ffedf26", "value": "1536:tP6z4+ADViS8CWoD94pUnQ64x11RiC6/s:ZPZBiS8jopkUQ64x2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702806, "uuid": "73d97587-793d-4ffe-8178-9eae1fb69bb8", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702806, "uuid": "334840da-429e-4d71-8d74-d815c896ba10", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702806, "uuid": "544573f7-b0bb-44ef-abdf-f0c079928880", "value": "diagram-1465103825.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee49b0d-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659513, "uuid": "76bd98ad-95d6-4823-ab43-3c6ea4966a37", "comment": "Malware payload (Quakbot)", "value": "ed1b540576bf77854df583a2ab208de2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659513, "uuid": "bdec3c44-4718-424a-b23f-91134cc2e5ec", "comment": "Malware payload (Quakbot)", "value": "17552b4477ddfb7250e6932a0b9170d04a952ae1058d0247537fc1bc7a39f52c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659513, "uuid": "01f7cbe6-23be-4ee2-9189-6fd9dfeff614", "comment": "Malware payload (Quakbot)", "value": "9bdbc25ee4180afa1d726da58f80304db8d56045", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659513, "uuid": "4270d456-d873-4ba6-adeb-30e7fa27e729", "comment": "Malware payload (Quakbot)", "value": "a899e951881742443d641ade3e7a1cbf92726ec057b161d5f57b55f4bc054c6edcf4c4912b8323ff5697f6d6dd0912a8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659513, "uuid": "0d508330-8a94-4dd6-a360-fbdc0bd13e44", "value": "CB74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659513, "uuid": "46c1dad9-ebe1-4b32-8035-b4384e59e79c", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659513, "uuid": "c951be6e-198e-4e49-b87f-c72d7ec9e034", "value": "6144:OnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuUc:xFrkNK11G9AEtMxQyOi6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659513, "uuid": "9d362a7c-ea25-4b26-abc4-40c352f48846", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659513, "uuid": "37bf424d-697e-4672-9334-c3ab1108cafe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659513, "uuid": "3aaf6b65-2995-4845-8299-af05ff6dbd11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe40e697-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706005, "uuid": "fec62397-75d2-4bb5-ba00-a57c886c0e8b", "comment": "Malware payload", "value": "de621feba2e7f111ed79d2b57638f49b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706005, "uuid": "96f99aa5-bf58-4260-9b7c-1bcc3210950e", "comment": "Malware payload", "value": "176560eda9c614b15d55d8490397c8b1d9a122af79edb56006c0fb73d1585b04", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706005, "uuid": "a23af39e-af34-4f45-b845-9efa30bf7b9d", "comment": "Malware payload", "value": "be36cb1af297b0f393073542857e9ecc17c3e486", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706005, "uuid": "84a09d78-4388-47e8-a9c2-b31d22e56685", "comment": "Malware payload", "value": "b3b665cbcc9c129f30a94a4d57b1df5e38ecbd500fa992fe76f85147a805ee9c7abf5620f832f9e163cdadbdddbd01fb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706005, "uuid": "c0ff4795-0b95-4090-a776-1b690c1e3492", "value": "CE3302294C6E761D5B2E00F4C0499B4EEA6769CD3C6DC5821D9CF4A9EC01A9D113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706005, "uuid": "066baa0b-9157-4379-b0f3-b09280535a27", "value": "1536:vP6z4+ADViS8CWoD94pUnQ64x11RiC2t7aI:3PZBiS8jopkUQ64xMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706005, "uuid": "0d0ad88a-a9c9-43f7-b868-0fccaecc7101", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706005, "uuid": "efcd91a6-0bcf-4155-a20b-3d32e5d9ca10", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706005, "uuid": "587e9e08-9f11-4ec3-a3fa-52fd5f88642a", "value": "statistic-1948040345.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe23116-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619733978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733978, "uuid": "3d39dffa-35d0-4a6c-8d1d-e975c01d61dd", "comment": "Malware payload (Dridex)", "value": "3cb66da6a17d8294462e21ddc49bb55e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733978, "uuid": "142cbdc9-2017-4920-85a4-ae071f2dc69e", "comment": "Malware payload (Dridex)", "value": "1769acd8fcca7766d1123a2a04f3e79b38efcafc81cd3cdc59b212612c6a27bd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733978, "uuid": "6ab0afcb-249a-4724-b734-fac15df56e05", "comment": "Malware payload (Dridex)", "value": "489b8c9fec57f66ab8f1203bdbf2168e625b67a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733978, "uuid": "46fb6c73-036c-4386-8946-56fa2c65e31f", "comment": "Malware payload (Dridex)", "value": "e76545ae30d65401f33b57fb1b9b42de4a7572045e0aad645a0defeb470342a90179a60b940f80fc7f97a6311f0e5e98", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733978, "uuid": "4e505cf4-390a-42ad-af50-ca9a89562ab5", "value": "55F3CF82D702C1A9FE212C7A28E677753D5837905E58CA69E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733978, "uuid": "e8ca184b-bd46-4518-89f7-004a6438e830", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733978, "uuid": "676ed495-f5ea-4202-8279-a81c8d9a04ca", "value": "3072:G05RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh8XH6:552j4pk5zMbVO6/HUIXU8KgMyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619733978, "uuid": "2f2902da-64da-47d2-af49-2c3ff68b2b6a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619733978, "uuid": "3570e6c7-8a8d-497a-8c24-4c08218c869e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733978, "uuid": "321a1f4b-3b1f-4b6d-a8d2-af99e5f94e71", "value": "3cb66da6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e49d289-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705414, "uuid": "8c9524d2-560d-4e6d-a213-52256b7ebea0", "comment": "Malware payload", "value": "2a1e2562173e8018ccb6cd6cf1afd708", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705414, "uuid": "f4b33610-6e37-4e5e-bb48-71f70f38ae4d", "comment": "Malware payload", "value": "1776b0c336e523cfe80152979f1662c9e46c53a861fa1b5db60b467ad287c62a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705414, "uuid": "771c4152-4248-4247-a7a2-08463ca7f957", "comment": "Malware payload", "value": "be29cdb7b6b830275e5c29c82bdb57fabd859259", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705414, "uuid": "e7271136-1bbb-41a7-95b2-01389f834f3d", "comment": "Malware payload", "value": "c42b57b49b46921c2457d082272e401de0e14db4cac110028cad231665bc37aa53cae3d8d2ac4488bed135795c6f8515", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705414, "uuid": "5304687e-7e1b-40a4-9d59-0c7845abc10c", "value": "BC33021958AEB72D532D24B486848B5EE503ADE9342ECA450CDCF066EC066ED163FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705414, "uuid": "783b6403-3eb7-41e5-8e0f-587ab17b323b", "value": "768:r9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCW8X:eP6z4+ADViS8CWoD94pUnQ64x11RiCW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705414, "uuid": "90597fb0-c54a-461b-9ee5-6c899b1b2140", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705414, "uuid": "4cc751ff-c64b-4e1c-81c8-fa495fbe18b7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705414, "uuid": "ceac9517-1e71-4cd6-9147-536bae1a2b2b", "value": "statistic-1480985405.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dfd986-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704778, "uuid": "209e1c94-e6d6-455b-9504-090176b7d37b", "comment": "Malware payload", "value": "9164da8b56a6b8e5690a0f0a00462e69", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704778, "uuid": "92e35562-6008-41c3-b8b8-719010e73306", "comment": "Malware payload", "value": "17789cf4bf06fe7ab1cb00630664f6cc787f50f21d433185cbf83567c8461d0d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704778, "uuid": "cd6b2d92-7a4e-4fbd-b236-5b3f196fed38", "comment": "Malware payload", "value": "0fe7b2758c1513c206a880d2b0293f1059883648", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704778, "uuid": "90204209-4d98-4dc1-9038-70d22c17fb96", "comment": "Malware payload", "value": "0169a6dae6b48c97e5a1ee5837637865e4d877e75a217f6e03a29ecbe34017ad323b5306ec6d8b78306c2aface79f395", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704778, "uuid": "5c75dff7-7d65-4bc5-b8a6-e547df8804ca", "value": "6633022A4A6FBA29172D20F08588C74EE50B649D387DC5D12CCCB476EC0679A063FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704778, "uuid": "c64705a8-7a9a-4b3d-a1da-40be20532466", "value": "1536:XP6z4+ADViS8CWoD94pUnQ64x11RiCoig:fPZBiS8jopkUQ64xmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704778, "uuid": "c9ddbf0a-dfe2-4a22-8670-b77544a1e04e", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704778, "uuid": "6a20de3e-9e88-478c-a59a-0bb2d9de0e96", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704778, "uuid": "a1258151-5786-43a2-ad44-f3945f917750", "value": "diagram-957477757.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21db6fa-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705555, "uuid": "0d1365cd-4da3-4668-9d7e-f64b57d1e7bd", "comment": "Malware payload", "value": "e51a2596616c0b12a7e97181280e4915", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705555, "uuid": "5b5d9d4c-147d-490b-a8d6-52eb8b54bc25", "comment": "Malware payload", "value": "177b428f0f12362d57a44d45c8c7912eccdd9c5448ad79016959d74703854c9d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705555, "uuid": "13aab525-ed12-4e18-ba81-5535de90b005", "comment": "Malware payload", "value": "958c2dbcad8d8c96c6e62be323afc6c3a7b168d4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705555, "uuid": "613db304-7984-45ce-8d7a-c17ef1fe5882", "comment": "Malware payload", "value": "15e5b350206d726a6862ce86a6180e4578fd153a2a7550ab4498405a650daa4e9863bb44f5f6c852c592f2d3658c6593", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705555, "uuid": "f89735c8-ee1c-4536-ad5f-90ee91d7e082", "value": "003302298C6EB629177E10F88585DB0EE91359CD387DCA820CDCF466EC462E9117E77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705555, "uuid": "c63b7a60-9b19-4a00-ba52-ac6b778ce295", "value": "1536:EP6z4+ADViS8CWoD94pUnQ64x11RiCwgTu:iPZBiS8jopkUQ64x+gTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705555, "uuid": "8a1f49e7-71a2-4f66-8b6a-7c8310eb5f2d", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705555, "uuid": "cd9fd89b-a252-4cc6-b836-8b72be42f448", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705555, "uuid": "6d2b04e6-933e-4b86-9ba6-1ffc090d5b5e", "value": "statistic-1593507367.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a9aa64-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659517, "uuid": "90cfb0b8-746b-4e1c-97cc-423d7884db8b", "comment": "Malware payload (Quakbot)", "value": "b81a1b5dab8dfc3dabdd6f7657e0fc88", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659517, "uuid": "ae7c7ba0-7082-47fb-a7e1-28c4da957009", "comment": "Malware payload (Quakbot)", "value": "178a070f201dd8fbe0ef11378c88f421ca25d188c55a245d1576f7faaadeff21", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659517, "uuid": "9b4de10d-1ff0-4687-b0dd-06caa6f8a7a7", "comment": "Malware payload (Quakbot)", "value": "67fdaaa4c3632689860a7ebd3a97df21c78585a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659517, "uuid": "b6002786-9406-4f44-9c20-ebfae0f2e15f", "comment": "Malware payload (Quakbot)", "value": "adeeeab77dfd91f8ceb1e2d54b412ed5426ef5a1faf50e0920a731d65bc6f8bc487574e8582dddcd0c5ec58e7c775ac2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659517, "uuid": "4f12c99c-8e96-4e8b-9cd1-7537ee34ff6c", "value": "4774BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659517, "uuid": "42cc14df-0026-406e-8208-1bf537f18b13", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659517, "uuid": "316abcb4-2f34-460f-a602-b726e4910702", "value": "6144:rnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuK:cFrkNK11G9AEtMxQyOi69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659517, "uuid": "0c24b4e1-9b2e-4a97-b7fc-85f7f5f31476", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659517, "uuid": "17a1c50a-5dbd-4fa6-b00c-c905373e1220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659517, "uuid": "1da8342b-6b15-4d0f-9add-2909c83c8290", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d5a397-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701375, "uuid": "630718ea-2e61-4eb7-bd19-9e5324a81b7a", "comment": "Malware payload", "value": "6045d31b4ec4d5a418d68634a85d8ecb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701375, "uuid": "2bb0961d-7d94-4f9a-9eda-1caf12ae37a5", "comment": "Malware payload", "value": "1792fe0bf6444afbabab959a617a79a78ac91043042a10d23ff6423c7cc0de74", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701375, "uuid": "6cecb727-1058-461c-b7e9-3d5e3ce4cd1d", "comment": "Malware payload", "value": "2e51bc8ca1fe9b7df4548a7c401b0ed15bda7930", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701375, "uuid": "cc01f25e-3800-44bb-bc79-3cdbc8c4a347", "comment": "Malware payload", "value": "cd6303a37fb3cd46ebe148e89d65dbcb0840a9a554e3d52a1fae72305a43ddc2610f86edf2dd9dc1324625a9e4587808", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701375, "uuid": "de97355a-3166-4d24-b823-fedfad083cbe", "value": "4633F1C4C9C8D332A8F57871AC798B02D538A9AE4827C56285F74AD77D03D92274ECDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701375, "uuid": "1bfce0e0-9dac-4787-8ecc-a7dc7f015555", "value": "768:xwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2E:4FugXVpoD8ZxhrLAuNS07MrxrKsY83V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701375, "uuid": "9f6e7f7c-619e-450b-a802-0db7fa994237", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701375, "uuid": "fd059d3f-eb0e-45b8-8ea1-5223c64e93cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701375, "uuid": "2e08cd86-ef0a-4dd7-ad5e-1872bf97a980", "value": "catalog-334918478.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47401f0-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659522, "uuid": "e79b7b26-a7f3-45ce-b39c-a3dbfba8015f", "comment": "Malware payload (QuakBot)", "value": "a573bc4835ee2402feaebab78fb5496a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659522, "uuid": "03ec84fb-f541-4e15-86e7-73473b620b70", "comment": "Malware payload (QuakBot)", "value": "1796b0226a198ad10e9569396c7f750ebe0f81e96c38f197a10d3f31790b1999", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659522, "uuid": "c4c9cfac-c901-4b78-983d-dc261a20cca4", "comment": "Malware payload (QuakBot)", "value": "1ca1c055d19a1e90558a100cff227a6e4795bb69", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659522, "uuid": "cf2000df-4794-4faf-ba13-a47e8f80510a", "comment": "Malware payload (QuakBot)", "value": "b69784133a27f82f24cd218566e9e2e514c603422afea37dbdb98319183ca2a7be15d258511e968b78350c8d77bf1647", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659522, "uuid": "4617fe53-1a8a-4b69-a4b5-7baf211e6dc9", "value": "7F549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659522, "uuid": "e21d3f38-1996-4163-91f0-17023054be94", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659522, "uuid": "4059a9be-38c5-4a7f-ab5c-d46cca27b799", "value": "3072:W3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZke:Svv9sMoXBaRmr/dukbvuZ/7fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659522, "uuid": "24920a22-5c60-4568-a239-9f0dd4c8b518", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659522, "uuid": "15e7ff0a-9483-41aa-b317-4ac981948e44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659522, "uuid": "1b2c4dd2-bf92-4047-b6d7-fffb2cfd8c7a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d98766-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706039, "uuid": "d9596566-69bb-463e-af61-05a533213d33", "comment": "Malware payload", "value": "0fe465728261c69ed40129e7402d2a73", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706039, "uuid": "b143ff6b-fdd2-4954-bc13-5042f39c98d0", "comment": "Malware payload", "value": "17ada61fd035ec8bf36694599eda321466bca2c2c5c472cf1533025bfef840a9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706039, "uuid": "8297834f-5f9d-416b-bceb-bf3302c87d5f", "comment": "Malware payload", "value": "324c76f902342090366982217418caa933eb1500", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706039, "uuid": "376e7cae-001c-4978-a9cc-214a5d25ca72", "comment": "Malware payload", "value": "b1771b653d8af629d65eac52269a272a0ea8e136460c09399ec288acdcea66174d0baa863a0989a2f8a0e9e6878be495", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706039, "uuid": "ce1a5406-f479-45bf-ae46-05f65c750b9b", "value": "9F33023A8C6E7719572D20E44548AB0EE55765D93C7DCA82089CF4B6EC063AD123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706039, "uuid": "5c13c3de-b001-49b7-ada4-c952d565a251", "value": "1536:3P6z4+ADViS8CWoD94pUnQ64x11RiCitow:/PZBiS8jopkUQ64xjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706039, "uuid": "03dc9d20-389b-41ac-98c3-66cd3032e77f", "value": 51482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706039, "uuid": "09e15e1e-a993-4f71-a84e-53208037f25b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706039, "uuid": "6316389c-8a7c-45f3-86a3-83b5d610a060", "value": "statistic-19798885.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73bf40a-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659527, "uuid": "5d2a0135-7546-48f6-babf-8ac071f8ab78", "comment": "Malware payload (Quakbot)", "value": "8bdca386d5e3e359062f285ca613b9a6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659527, "uuid": "104eac13-e315-4563-a416-d7ed7b8e3758", "comment": "Malware payload (Quakbot)", "value": "17c555afbc9a1479471cc860ec034de6d2656e1b0ddbd7327ffacb32ba3b7e66", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659527, "uuid": "2ed3e982-4676-4afc-82b7-cae317d65e9a", "comment": "Malware payload (Quakbot)", "value": "0bb47ec08e51c5376d478aa76406cdece27bec5f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659527, "uuid": "9de396fd-3288-4f3b-8b3b-3e866f40f654", "comment": "Malware payload (Quakbot)", "value": "bd366d946fc6d5c0dcc573356d8646a5741de1323f296cf5c2fd724baae70ce7136e13dab92b7622936bc237a31c5ca1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659527, "uuid": "3d3d2bf4-10a6-41af-8a53-2da6f19889d7", "value": "A374B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659527, "uuid": "d3b2dec3-880c-4321-878b-56ea93f80e93", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659527, "uuid": "b5b078f6-aae4-41d7-b772-7f8bd43f2725", "value": "6144:UTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRu7:Ubi7/xZrkNK11G9AQyOi68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659527, "uuid": "0607fc05-996b-482c-ac54-ab6d2a1e80da", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659527, "uuid": "f73c34c5-06e3-4cf4-b761-7e4d63ee7902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659527, "uuid": "67a7a209-00c6-4070-be71-be38ce20136e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57e5552-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704567, "uuid": "c7acb782-5dae-4406-9466-10defaa40386", "comment": "Malware payload", "value": "83515e082cb43f1c347bc7c8fd44cfd7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704567, "uuid": "24c11186-bce0-4d39-b279-89170e796cbc", "comment": "Malware payload", "value": "17c8cf87673f65e2c67ed3f839c3ee913a55d8133eee2bf11e46d4be3e1231ae", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704567, "uuid": "133a0781-90d8-4b2f-aec4-2c48d52dad1e", "comment": "Malware payload", "value": "a96831db406ef4ddffb42b52a457e2d42b0c5c21", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704567, "uuid": "1e97f10d-c1d0-45c7-8b21-4b9c7633f1b9", "comment": "Malware payload", "value": "e00bf9d9c382c57838852ecd713bb302e3bcadd9d57a893aac4d6ba19e852abe9d863172ce77194444e7cac37a3f31cd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704567, "uuid": "054d3118-ded2-463a-bc35-0c816f4f01df", "value": "B0330229886E761E572C10F04985D74EDA1768DD386DCA831C9CF46AEC056A9123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704567, "uuid": "cb5f81d8-8279-4f2a-9a47-2e39495faab8", "value": "768:d9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCYES:YP6z4+ADViS8CWoD94pUnQ64x11RiCYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704567, "uuid": "34e306eb-cc3d-49a3-9aeb-5e9e3c07a35b", "value": 51475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704567, "uuid": "8bf715ef-8685-4478-92a1-8bad57ac2c98", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704567, "uuid": "74e45e52-d58c-4a1c-b45c-ac8126d915ba", "value": "diagram-83507867.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851960ad-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704083, "uuid": "88e4d1dd-d4ea-4093-bbe8-c81d7db9388e", "comment": "Malware payload", "value": "9120105f4e7216a4f8e7588a37ecf77f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704083, "uuid": "54a0ec3c-1b90-4aa1-90d0-6cf94b5c7aba", "comment": "Malware payload", "value": "17d5b316421357e533fcaa3ace9066c14b0e160b864a283b205dd0c72cf8a27e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704083, "uuid": "3f67693c-f47e-43a9-ab72-a14edfef896e", "comment": "Malware payload", "value": "0d0347ae7ddc2b2241274f15379ef69d561f1dd9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704083, "uuid": "e6d25c17-30aa-4361-8556-103faf294aa4", "comment": "Malware payload", "value": "cd255f0751e9d26404d9cc1c6dfe76349d7b7ca6c7ac7be07c69e93ba4ab6e915a1563512af09330db03466acaa8f158", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704083, "uuid": "62ff9704-0a2f-4fcd-abad-f2033651d55d", "value": "0A3302298C6E762E572C10F04985D74EDA1728DE385DC6C31C9CF06AEC05599123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704083, "uuid": "dbef2034-3a03-441f-8080-bb25b91a2da5", "value": "768:g9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCj0J:BP6z4+ADViS8CWoD94pUnQ64x11RiCjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704083, "uuid": "20cf5c76-0a21-42b5-9c11-81ed87f8f0e7", "value": 51475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704083, "uuid": "b6e64588-c628-4aa9-8b12-f40893ba0d9d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704083, "uuid": "274eb7cc-875a-4e5a-a908-0fef87472aa3", "value": "diagram-47697462.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed1213d-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702274, "uuid": "355feaf0-2f0b-4e6f-98d5-d8f12f45b261", "comment": "Malware payload", "value": "0bb4ad006baafcea252e7dd3bc5e3246", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702274, "uuid": "61baa129-fc3d-4253-ae0c-5627fa3735ca", "comment": "Malware payload", "value": "17d61c94a87de1ae7c181fab892a36c76bcb220fcaea4cce204200234d62714d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702274, "uuid": "81bd7555-e51a-42ba-8f57-c3b85c780a58", "comment": "Malware payload", "value": "0b7ff9d29da8410fe7aa8f689d96b73c92ec4025", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702274, "uuid": "9fd8d6cb-483f-40e8-9bc0-6a381542b332", "comment": "Malware payload", "value": "4926d67998d6c711d7c24fb95cfd85feeb26617c363908dca146f45a6c17df1c73b222ccd2f10ccdba3c3214520b84c1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702274, "uuid": "018889ac-5eaa-4067-a5df-e3364393488f", "value": "DF3302298C7D772D572D20A08585876EE51B28A93C6DC5425C9CF4AAEC023AE163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702274, "uuid": "3e18ee24-3975-4940-91e1-55bb1a21c2da", "value": "1536:wP6z4+ADViS8CWoD94pUnQ64x11RiCYxW:GPZBiS8jopkUQ64xMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702274, "uuid": "0af69c71-b2d9-49ca-ba1a-ab9008bc8b77", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702274, "uuid": "00e8d294-685c-491a-9403-952646cba639", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702274, "uuid": "d39fbb2f-e6f7-4611-89d7-583dab0e9171", "value": "diagram-1029334360.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba8ba09-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704846, "uuid": "c77d6e50-6a77-4edf-8102-fb48f0668ee2", "comment": "Malware payload", "value": "4f8e32d07fafbbfbb83924b7c75bc732", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704846, "uuid": "722ea6b5-7a9c-4c14-82a0-e64e28bdc259", "comment": "Malware payload", "value": "17ea25e1b1bd9cff9b176f5be83294257b309668b8c2c9d80e6a1cae5fdb1f95", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704846, "uuid": "ca73e088-f842-46dc-bd84-518ca818cd8d", "comment": "Malware payload", "value": "87fb6126abaff6a2120630e2f2c874bcd426b2fc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704846, "uuid": "794575d4-9fb1-4966-90b2-8fe84f44699a", "comment": "Malware payload", "value": "c9395221f156d936afd14e62f2ed20d2c57750b2d6709dd6bcbb66765f226eac9ae34413a289ca580f7c89119e029ca2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704846, "uuid": "3a9599c2-b263-4a56-9b1a-b96cb0a2bb1a", "value": "E53301264DAD7A1D532D10E089459B4EF61768AE381DC9C21C8CF476EC062AD023FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704846, "uuid": "04d40a23-d3e8-4897-bef9-8dc6559f1d9e", "value": "1536:wP6z4+ADViS8CWoD94pUnQ64x11RiC5SM:GPZBiS8jopkUQ64xCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704846, "uuid": "b9a6502c-baad-4d87-9e5f-6afc9de31c2f", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704846, "uuid": "0f94d080-1f21-4f26-8f0d-f74729e8924b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704846, "uuid": "201a3dd5-7536-49d7-8789-1ad76410e278", "value": "diagram-998875020.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b24261c-a92e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619730320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619730320, "uuid": "caa62404-20e8-4ff3-a514-24ed0fe371eb", "comment": "Malware payload (Dridex)", "value": "a035fb1b0f6f1527a127c11860623258", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619730320, "uuid": "f2f61356-4029-4ed6-b2e4-67cb51ff0e4a", "comment": "Malware payload (Dridex)", "value": "17eef67eaf23596b84313689a0b3c71b29dccdb097e1801e91d3d68345c12cdf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619730320, "uuid": "43fa9a3f-d7a4-48dc-b210-83d9d637322e", "comment": "Malware payload (Dridex)", "value": "c43e7ee557a7f1ae000a6a5a113d4f36d181ae3e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619730320, "uuid": "7344bc1c-e731-4c26-8972-d5f2fbedc830", "comment": "Malware payload (Dridex)", "value": "e0fcfc02d837e738e54aa7f4d547cfba4039a41dd5de2a78652e8c0389455fe170d9acf0ac06251343433dee34eda472", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619730320, "uuid": "18899810-c496-404c-bae4-a330ec479904", "value": "19F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619730320, "uuid": "ac0e93fa-cca5-4aec-b6d9-9357af211568", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619730320, "uuid": "b4054a6b-ec2d-4cec-a013-361f0065e94c", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619730320, "uuid": "94eb3716-60b8-45a8-b365-516b7f7c5a04", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619730320, "uuid": "1fed6ab0-8633-4fe1-a80b-8132f1a44ab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619730320, "uuid": "67e789d1-f3a9-450c-be41-42aaed89100c", "value": "a035fb1b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a27a00e-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704843, "uuid": "611dccf2-df40-4bf5-8723-b6ef43450a26", "comment": "Malware payload", "value": "26b0db40730710c13250a9723ddf75e6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704843, "uuid": "937507ea-3350-45b5-9c58-f648e98b6d00", "comment": "Malware payload", "value": "180dfd9416f229ca43ce7fb5eb3d6a7485a640ccf4c39a8ad4f0b5354f950574", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704843, "uuid": "1bca0713-338a-4781-b41e-3736e0cf97b9", "comment": "Malware payload", "value": "6edfae863c68de09598b799d6c242d5807b83c18", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704843, "uuid": "9073a2ac-014c-43ee-83f4-31b29d47675f", "comment": "Malware payload", "value": "717f2fb83f905a2ff29bf7d87069c9932aa3b572b3f44cba1fbc9b33e41985d9de0b0dcbe641f22237a2a5c81f0a0fa7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704843, "uuid": "764ca1d3-4a07-4a3b-aa67-54243a2f584d", "value": "2433122A8DAE7A2A5B2D10F04945CB4FE61758CE3C6DC7824CDCB4A6EC056D5063EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704843, "uuid": "4b4b82a4-baf2-4347-a43a-5d9543ea871e", "value": "1536:5P6z4+ADViS8CWoD94pUnQ64x11RiCFbfu:9PZBiS8jopkUQ64xjTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704843, "uuid": "2f7efd7c-8295-4401-b75d-a4e8f508ec37", "value": 51476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704843, "uuid": "5da04309-b271-4c12-a558-c6dda8819305", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704843, "uuid": "b8b1f7ff-803b-43e5-a68a-c6246eb7173d", "value": "diagram-99879352.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbb4f08-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703564, "uuid": "84da0d93-1ebf-4890-92a4-329da059d7eb", "comment": "Malware payload", "value": "a7790450c738fc6ddf5ecf7e78e3af53", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703564, "uuid": "c63e48e1-6037-456c-9cee-8973c8557b7c", "comment": "Malware payload", "value": "181a22603c6646599ece49c50a134ddc0f2161a218ea2cd8b31ab66c089b4772", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703564, "uuid": "79335484-d8c3-4d61-9a75-805575de97a3", "comment": "Malware payload", "value": "9efdce857d135490b4d20cb3806828f6a0672630", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703564, "uuid": "69930ffb-0a1d-4162-a971-a235273caedb", "comment": "Malware payload", "value": "ed547a378e501d7964102a728b8addc413bbb2741c0b9692f28d2f50c06caa8c7dc83c4808fcac9bfd572e977fb6d6dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703564, "uuid": "8ca97d4b-62d5-4292-8a5e-af931a5cf845", "value": "8933022A4C9E7B29537D10E04985CB1ED10769EE3C6DC5412C8CB476EC06BA9123F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703564, "uuid": "e1ca95f5-4f56-4afb-a1ae-949a8dc12222", "value": "1536:YP6z4+ADViS8CWoD94pUnQ64x11RiCBKXGq:uPZBiS8jopkUQ64xuXGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703564, "uuid": "865d9b47-10cb-4229-90b5-be2fda2da3fb", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703564, "uuid": "325127b1-8383-4145-aba2-b1b34cc9ce3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703564, "uuid": "7efa478c-af46-43ca-9abf-a11084c45ba0", "value": "diagram-1995755115.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813c9aa5-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701500, "uuid": "2ee81544-51b3-4bfd-bd2f-aeba3e68ef53", "comment": "Malware payload", "value": "0f94397b1d7af3246fba9f705d241e6e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701500, "uuid": "21733123-3084-4774-9ffd-9b63807ce54b", "comment": "Malware payload", "value": "182f4221a5dd01c862dfac6c866960739f1afb4fae2910356e190c101c994356", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701500, "uuid": "91135237-7136-44f8-b53e-10502a46db4b", "comment": "Malware payload", "value": "02a14dc33e090b3a1a63fdd27f3e310de62e42a9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701500, "uuid": "79a281e9-5841-4759-8ebe-100d17cf7ac9", "comment": "Malware payload", "value": "454549e96d12b6e54b8a831b54aebabd8fd93389e64cc780a18a124e26cd1f9e6a009a1812cde37394fa9436afdaa74f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701500, "uuid": "78a6da64-5dd6-48fd-9798-8f2b60b290b6", "value": "8433028CCACDD37298F57534AC39CA01D474AAAF440B8595C1F787ABBD069912B4AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701500, "uuid": "bb94228d-c587-4370-bf77-792c6344c9bd", "value": "768:twnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2L:MFugXVpoD8ZxhrLAuNS07MrxrKsYpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701500, "uuid": "754634a6-7f2e-438b-9920-2b0b5a37fff8", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701500, "uuid": "2dd3ebf7-51b0-4bbe-b1d1-93ca5727ff70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701500, "uuid": "ca03f5bd-8019-48e2-a17a-952b2f268e37", "value": "catalog-428007279.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833fd869-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705798, "uuid": "1d53f9e4-12f8-4350-b048-04ab976658be", "comment": "Malware payload", "value": "b38192656e8d1cebb697cd47a9eacd02", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705798, "uuid": "ecb3b6ea-4359-4039-8086-e4944f1c9211", "comment": "Malware payload", "value": "184eb69479eef397c16154d2e05dafc4f22e58d2cd1fe4886f91cfdf5b5a254e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705798, "uuid": "7c46f8c9-2d4c-4aa0-a675-3221eb9d36b2", "comment": "Malware payload", "value": "3ffcd4883161e6368a73a3666a9e9dfb2e102d62", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705798, "uuid": "1d1b6d20-d1ab-40ba-84e2-d70dad32b62e", "comment": "Malware payload", "value": "5999738dfe283befa5ed9e06becf28f795bd55b90e3168a588f64222a7426b0372ce7b91477a022d946de92c9041871b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705798, "uuid": "441a1399-00d3-4b1d-a935-3358a873aadb", "value": "74330216486E762D673D10F086868B0ED65398DD786DC6051CDCF87AEC02AE6263FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705798, "uuid": "df2db807-2fba-4283-ba54-b5765c960ced", "value": "1536:0P6z4+ADViS8CWoD94pUnQ64x11RiCiDYz:yPZBiS8jopkUQ64x4DYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705798, "uuid": "886abc95-a703-4561-9ff5-5265139d5ddb", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705798, "uuid": "6a4e347a-04d9-4dd9-8112-0dfc63d451be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705798, "uuid": "8cb6aac5-4a68-4f76-9d12-f56a0b344caf", "value": "statistic-1779687173.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d67d1c-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701915, "uuid": "f3afc263-c6a4-4457-891f-f3396c4e9eb4", "comment": "Malware payload", "value": "e7ad9e4d9ac0001ed8afd6bf1bec26a4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701915, "uuid": "09158c9a-b322-4a60-a16e-32308900f6ed", "comment": "Malware payload", "value": "185784657805228ed111586efab2e4eccda1f8abfbddc0f160396627cd5d4314", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701915, "uuid": "8da5e986-ac29-4530-a7ff-296f7c151bc9", "comment": "Malware payload", "value": "6df1471581961a29a9736d3432ca02033542db1d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701915, "uuid": "cc31da9b-a19d-4ff9-82da-f855ad761b4c", "comment": "Malware payload", "value": "6e5e555e9c5917fac3fe7c13ce1d68e86eef466ba82068e5a099bc4db1d2c4606cec4385880c8adc50288b7fbdab8214", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701915, "uuid": "3314bdee-c6ef-4e2c-815e-b0f9f2294f6d", "value": "EB33F18CD6C8E33298FA79326C7ACF02E97CE65A0416845181F78ADB6903C91174FDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701915, "uuid": "cfbb8b18-0115-4f2b-85f5-e9db60f7c8b5", "value": "768:0wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2k:JFugXVpoD8ZxhrLAuNS07MrxrKsYu4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701915, "uuid": "9090b8a3-0355-4064-9f0f-545eca327e99", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701915, "uuid": "a6ff8070-3566-4198-8336-03d9fa019376", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701915, "uuid": "24de68cd-c380-46d2-bee0-b1b9ce54d79b", "value": "catalog-75487635.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b03cfae-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707073, "uuid": "789849f4-f2ce-482e-8dce-e58408185dbc", "comment": "Malware payload", "value": "85f310ae69a3de559f474280e25c3877", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707073, "uuid": "d856f3fc-02dd-4e03-8fd0-117e1216681d", "comment": "Malware payload", "value": "1863240c3ceac8ed86a85acad6086a36fcff70fc3f26c1d84532780d00b69468", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707073, "uuid": "40bb966c-4644-4257-aa36-b074467b9ccd", "comment": "Malware payload", "value": "2456f00228c9b23fd9eac388051654adbbf2a6ed", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707073, "uuid": "48f2548c-f918-47da-bde7-9024d368135c", "comment": "Malware payload", "value": "1107474235ae2fc2fbcb15849811270cd39dca835a6b6f75dabbdcda211f5aa85a8872387faca1028a7f03ae4cdbd6f5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707073, "uuid": "2ee7f200-fed4-4f73-b602-21e921d42ca8", "value": "F633022D586DBB29632E24B48685DB5EE11328DD386DC6821CDCF475FC0569D023E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707073, "uuid": "4d90fbd7-aa36-4509-97ba-f0b65185c8d4", "value": "768:e9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCSUZ:PP6z4+ADViS8CWoD94pUnQ64x11RiCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707073, "uuid": "abd5ecc3-9540-431f-95b6-cf5c08c71d80", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707073, "uuid": "a051ade6-e7e2-43ff-9843-ea0374a319be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707073, "uuid": "20f746df-64d6-4f5e-985d-4077dd2584ec", "value": "statistic-733365732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badc5b4d-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702885, "uuid": "2becebab-6d81-412f-937e-89250dfb2745", "comment": "Malware payload", "value": "a5bf8cdb00247b49110b471fffa82e8d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702885, "uuid": "876ddd17-fb1b-45b3-bb2a-76b2e3a5791b", "comment": "Malware payload", "value": "1866557124bead7f67de6fa2a78e5810d1b95f035e7fddd0362938d07e649f6f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702885, "uuid": "3f34d829-262a-4756-a9b0-8958b149628a", "comment": "Malware payload", "value": "bbe6730dc7fb870436e089c1b83385435ca0bd1f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702885, "uuid": "cb466c4b-1d59-4daa-ac0a-acb995c7b360", "comment": "Malware payload", "value": "4d3210db34d1eab3d29e6fa28fdf9e06814c7b45fa42d7b9d1d360b25bad76b372b9db6fe5420b2ca42d0371335ef85f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702885, "uuid": "2a612eb0-1aa7-40e9-9552-14886c5718e0", "value": "B433012588ADB73D637D10A089859F1EE91B2C9A3C1DC1D21D8CF4ABEC05669117FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702885, "uuid": "0399f834-23f6-4757-b348-7fe72ed727b5", "value": "768:S9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCQUz:bP6z4+ADViS8CWoD94pUnQ64x11RiCQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702885, "uuid": "47b463b8-2524-4b0e-92d9-55b1ea80a25b", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702885, "uuid": "7d4dc59e-93ae-4213-b287-bf4d97803f6b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702885, "uuid": "041c6055-98f6-4f78-8080-d99838c24ce8", "value": "diagram-1529468307.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b4c2fa-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705801, "uuid": "84d37da4-8eb2-4cd9-9564-43a26775018b", "comment": "Malware payload", "value": "393eb8a7aa94023d93eb2c195b65bf3a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705801, "uuid": "cad52320-868c-4f8c-ac1c-6f1a2903ff98", "comment": "Malware payload", "value": "18692b577b6c05cad0e59fb130d04d95b44b16fc0c60a0d31833230a9ad29678", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705801, "uuid": "2a62f1ac-3155-4211-95ce-f41727a6d3e2", "comment": "Malware payload", "value": "295f4a3b111381fd31d7cd4e2950a492c6950527", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705801, "uuid": "f63b53c7-08e2-4ac6-8528-ee8b3ffc0d5d", "comment": "Malware payload", "value": "5f202d3497ab321c74b20e07c4a7f81a4d058b233cfdae1187ac9aa8ae4a4675f1fdd07fe3a161cb8dcbcc1553fd4068", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705801, "uuid": "da305050-1395-43e9-b965-55fcbdfb6c38", "value": "9D33012A886E7629473D10B088499B0EE66B189D386EC2821CDCF5B6DC016EC153F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705801, "uuid": "1fafb197-88e8-4488-a2a2-ff628405e77d", "value": "1536:yP6z4+ADViS8CWoD94pUnQ64x11RiCFJPvk:MPZBiS8jopkUQ64xV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705801, "uuid": "dbfc204f-031a-4efe-aa47-05e9f86ba69f", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705801, "uuid": "f7880bb9-f2d5-46cd-9dce-774d1d8082e8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705801, "uuid": "49a27886-7ecd-4ca5-bb5b-3ad6154ccd68", "value": "statistic-1787163033.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d052ca-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701380, "uuid": "d1320219-b6e2-4545-b635-ccb751f8042f", "comment": "Malware payload", "value": "9a4126fca186fd159b6de51f4652d98f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701380, "uuid": "bcdd2340-11ad-4103-9880-ae7593947c86", "comment": "Malware payload", "value": "1892c142c15a60d13144cc801ab35b76b1ba53df98e4ecd79855ea13ffb195a4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701380, "uuid": "8fb7d577-0e72-41df-8f7a-175f3457d9f7", "comment": "Malware payload", "value": "b3604ab86dc498413c6dfcb890063fd4a7761954", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701380, "uuid": "4a729411-fd8c-4785-9511-1195e55d196d", "comment": "Malware payload", "value": "a900ca003204e40e508df7202fccf2a70fc406a7a9ee91ae571487ce03a3de0972337c7b8fc1a29b9226dbeb1ce040d2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701380, "uuid": "3a7a3022-8042-42a0-96f3-4fd66f46d5a0", "value": "FB33F1C8D2C9D37199F17871AC75CB02D478B97B481AC4A281F74AEB39079922B49ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701380, "uuid": "e1378e0c-0df3-4b7c-aeb9-b331644d7e98", "value": "768:pwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2/:wFugXVpoD8ZxhrLAuNS07MrxrKsY9a0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701380, "uuid": "9cfbf70d-644b-40c9-8db1-a3795c7bcf4f", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701380, "uuid": "43e209f6-bb16-431b-9c03-ca3f7bb3b375", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701380, "uuid": "86eecad3-9b44-4418-8d8f-826cb7cc1254", "value": "catalog-337362120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc913ea2-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659536, "uuid": "36cf99e3-4280-4463-bddb-79ac8cb0d3f3", "comment": "Malware payload (QuakBot)", "value": "5a832f1df77fb40a2cd8d9f792c2ffd6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659536, "uuid": "5648b285-5942-4d61-b982-7a3b7523cc70", "comment": "Malware payload (QuakBot)", "value": "18b135cfe0108bdf292830d83eba51769239546d8942143e252c7b0f34417783", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659536, "uuid": "be423f2f-5ed6-4904-8a0f-1617d55af89f", "comment": "Malware payload (QuakBot)", "value": "11e3fa2428a4ce844a3ec82015d000864b0bec36", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659536, "uuid": "9445d723-42a8-4787-9fab-dd7189234e7c", "comment": "Malware payload (QuakBot)", "value": "b8e1955d9a450d98b91056a27397b8a9828d942d37f7205615384d7501ee2265057caa7fd9e9595e1fff660c84ba2106", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659536, "uuid": "ee2c7305-ca70-43d8-b6a3-45474057ccd4", "value": "AF549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659536, "uuid": "c291c38a-2184-4830-9deb-d7fdddc43a81", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659536, "uuid": "e619ae86-205b-4c84-807f-ac21c707bf7c", "value": "3072:g3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZE4:0vv9sMoXBaRmr/dukbvuZ/7fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659536, "uuid": "bb24e0a2-d2b9-4f10-9f16-518385e71f94", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659536, "uuid": "6138b15f-e72e-44e2-88f6-26f6e33d815b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659536, "uuid": "9e3a4435-4975-4fd1-8be5-061df72ee547", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861c3611-a8bc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619681322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681322, "uuid": "dccb244a-b27b-47f2-9c72-34ff6a668b98", "comment": "Malware payload (Dridex)", "value": "76cf05abb5f67b39aaab30d367171009", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681322, "uuid": "e06c80c2-3895-4112-97d3-8d62989f2925", "comment": "Malware payload (Dridex)", "value": "18b214d2d9e4af9714103001f7bbdc15ab89b767633f7cd51fdb41497d213d4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681322, "uuid": "9c65dc70-8631-41f0-be96-bf58d790c357", "comment": "Malware payload (Dridex)", "value": "2aad5c832ed2ce4a44b7dbbc665b4c43738d8d56", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619681322, "uuid": "cba49e64-ed4f-4ca8-b218-6f0a6d086dd0", "comment": "Malware payload (Dridex)", "value": "b501b0e7e3a3f0732043c9cee38c302ed8297ae2a2ee4c6f1669ef850b9c90cf0a0144b8bc88a15baeffc874f1c7cff8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681322, "uuid": "67fdccfa-858a-4c01-9fda-6f97c7a59405", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681322, "uuid": "e802a5b4-bc81-43dd-ba1c-1658a436f5d4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681322, "uuid": "2f8c04ec-0278-4292-bd53-cf7574293d4c", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619681322, "uuid": "e70a1552-162c-4266-91a6-9a3d13f834ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619681322, "uuid": "2c96e5ed-b425-4801-9567-069abcec8cfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619681322, "uuid": "07cca52d-b075-42c1-a785-33b00ab7c055", "value": "76cf05ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cc37fd-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619701264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701264, "uuid": "d200efab-5c67-47b5-a9f9-1eb7fc26b7f0", "comment": "Malware payload (Dridex)", "value": "5e4508f545d7cdc0999aa58e1e8bc6cd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701264, "uuid": "6132a5b9-a0c8-4f3f-8c3b-c176f7bc0a41", "comment": "Malware payload (Dridex)", "value": "18b5a2b4d53c9d85075d3a986ff75cee9a34502a9a7e65e1b9b1114ba38f9442", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701264, "uuid": "1880ea4e-0427-4486-85fc-ee15a0e2ffab", "comment": "Malware payload (Dridex)", "value": "527a97f1f85a550444d9ab96f3a400a5525808ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701264, "uuid": "4b2bb85d-2e33-48dd-9448-77cc4b0de427", "comment": "Malware payload (Dridex)", "value": "8739f0c01df1001296a090f65bd5e84fc971c6b1c5c64a8f39643e2bd0792e3ed9188b040f8f067ea0ca84628fde25d6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701264, "uuid": "bf0c50b2-5fcf-402a-a926-9a8f62554c74", "value": "8CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701264, "uuid": "28f413ef-0946-4f8c-88e9-fc4639c0db03", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701264, "uuid": "6aff282e-c3ce-4e86-9d04-66c696c66f0b", "value": "3072:Mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701264, "uuid": "4eca7252-c7ed-47f6-88fa-5659d0e5993d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701264, "uuid": "5b22e229-c2d5-4243-a379-7a2c10585063", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701264, "uuid": "d169b599-c63a-4993-b372-f875f30295c9", "value": "5e4508f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70eaac58-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700184, "uuid": "b649ff1c-b754-4461-a279-d78ca963acd7", "comment": "Malware payload", "value": "bb95e2e4476d8061c50d80bd26ed00a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700184, "uuid": "9213aebe-362b-4f46-9d16-510c59d89bb7", "comment": "Malware payload", "value": "18b867915b651b645537c967a7d05f331414894cae62c360a67e507dc32f357a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700184, "uuid": "1ae7ead8-1ec9-458a-8c7b-59bb580bc912", "comment": "Malware payload", "value": "1da470fcea12853c58ce3780ed7bd6ef71a0c1be", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700184, "uuid": "bc825204-ac2e-4611-9dae-9ba40f06fd0b", "comment": "Malware payload", "value": "d15bab7277e06eb8ed73c8ab38c7892263369415e1b50d43547a4e8ca4b4159e80c83ea244e94cd54c15b38002a47427", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700184, "uuid": "b2e04855-b3b0-48a1-ad07-16e97baa660b", "value": "A5330284C5CCD271A8F17535AC79C701E478B9AB081AD5A282F78AE7BD079C10B4AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700184, "uuid": "87bac784-36fd-4eea-b2cd-c6e715d03d2a", "value": "768:mwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2a:7FugXVpoD8ZxhrLAuNS07MrxrKsYOzIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700184, "uuid": "16660b7c-dbfd-42a4-8c42-c830269b2fbc", "value": 51497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700184, "uuid": "23b365f5-6dc7-4448-a73b-4387cd7e485e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700184, "uuid": "e9982255-d1c8-490b-8ccd-34783cf26a8c", "value": "catalog-1339572102.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5d9b0f-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659540, "uuid": "219ba1b2-e938-480b-89ef-47c52da13048", "comment": "Malware payload (QuakBot)", "value": "86c7731161b2c965698e22cc3aa734ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659540, "uuid": "124b1431-4cc8-40b0-b640-b59e02be1189", "comment": "Malware payload (QuakBot)", "value": "18b89fa626082d9cdc259155c08eaad233cb2ab92b8601b6b37f401cec647440", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659540, "uuid": "e3bb169e-bcb1-4353-88d6-9f0b2ec2c41a", "comment": "Malware payload (QuakBot)", "value": "59f1bc8ca15b65b2538bb860973b051305fea5eb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659540, "uuid": "b975f095-083a-4bcd-906b-367f60952f7a", "comment": "Malware payload (QuakBot)", "value": "d6d85cc5550fa5143b0b38d15283d97d776026655f914c708204a8b38a9ff5741c5bd2086227a661c84e6fcfeb3836e4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659540, "uuid": "19f8456a-b04f-4f24-8c41-f00627105ac9", "value": "03549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F587EEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659540, "uuid": "2d87ee64-ea34-499e-aa35-735a4f687af1", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659540, "uuid": "4f63253f-9f94-4b0c-aba5-82d81ed053fd", "value": "3072:93FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZBa:Nvv9sMoXBaRmr/dukbvuZ/7fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659540, "uuid": "33370ea1-49f4-4459-9c9c-daf59ee39cf3", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659540, "uuid": "1171f381-c8a1-4464-88b3-66620398e3fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659540, "uuid": "826a7b72-0851-46dc-89ba-5d23645059b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc35796-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699994, "uuid": "57093ff1-ddb3-4de5-ab47-f73e5f552a0e", "comment": "Malware payload", "value": "1c4a13bd238b9628b47535ea6c7cca54", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699994, "uuid": "67789942-b2cf-42d4-a03d-44dd4ae0baac", "comment": "Malware payload", "value": "18c9164cea77b2c9a9732faa2da0298b954720e1c979cfcf0cea534f342d8ba2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699994, "uuid": "9222c330-fdea-45ae-8c20-329cab7fc9de", "comment": "Malware payload", "value": "7fed16e7e3bd3c751e31f38cc168a386a51cc685", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699994, "uuid": "6617c439-fba4-4d09-b6f2-b712cd058905", "comment": "Malware payload", "value": "1a90ba775da2d5870fb7744663c09c564fd7fff298cef09094b6d2691698ba5737307a2c1dbf3253cf42b4429337d90b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699994, "uuid": "f4f57d3f-d3a7-4ec8-9430-3eacf988fb14", "value": "0C330248D6C8D372D8F639319C7AC701DAB89A6B0406C95182F387A77D07AD5274EDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699994, "uuid": "3ddf0d72-c829-4f84-b1e9-6c5bb97954ca", "value": "1536:LCFugXVpoD8ZxhrLAuNS07MrxrKsY03IBMx:wq41rLZNkZLYSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699994, "uuid": "88896017-89f5-4bc4-92ac-13151e81baf5", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699994, "uuid": "7f9da70b-ca94-4d4f-adb9-08c5db131309", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699994, "uuid": "d9447588-630a-4dfe-9814-3ba197e40635", "value": "catalog-1236071318.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737ba484-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706631, "uuid": "eccb2c94-7ad7-4b30-8516-568219d03483", "comment": "Malware payload", "value": "14a30c3c9d2dead8db491e42d0dd5b3f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706631, "uuid": "52454b14-06f8-4d80-bf39-57427a694830", "comment": "Malware payload", "value": "18d25caeba3e778bd3289e6465168a6f3b5f63876fca554495481dd6489551b6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706631, "uuid": "94a26196-4bc2-456a-b1f9-cc945569ee8f", "comment": "Malware payload", "value": "a98095202cbbbb93d4884bd360b6508342b5bc1c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706631, "uuid": "54ffdf02-1252-4579-ac58-cf5ca502362d", "comment": "Malware payload", "value": "056929ccaef4389fc7ff8a91268d7c19a13ba8202c061d8f55935b2e6d311e06588b3c056e68b2f9c18ed09cb88ba870", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706631, "uuid": "c9f0727e-8d7a-4dcd-9ee4-68a7523a8d68", "value": "BB3302194C7DBB2A577D00E44585DB4DE647289C3C6EC6821CACB0B5EC0A2E5167F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706631, "uuid": "cfc623dc-7b23-4b82-8063-456fd089b50e", "value": "1536:lP6z4+ADViS8CWoD94pUnQ64x11RiC92O:RPZBiS8jopkUQ64xuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706631, "uuid": "3dc50b21-aa11-4792-92d0-c0d90ee0e77a", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706631, "uuid": "24df946b-71c8-4584-8bd0-e69aa96311f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706631, "uuid": "4cb5ebb6-318e-401a-a56a-3653357a0d84", "value": "statistic-482463752.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f389b05b-a8b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619677210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677210, "uuid": "06992593-9c36-45b6-b853-9de993d12ad3", "comment": "Malware payload", "value": "f81ece8b2282a9b21ebc335626165f50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677210, "uuid": "334a6fdb-f884-4d6c-92da-57cb1a6fcad1", "comment": "Malware payload", "value": "18f145e3612b9793b9b68ca49a94d74010d09108bca46f15c0f0ce7cde128629", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677210, "uuid": "8886d5f9-1019-4dae-bde4-2913c8273b10", "comment": "Malware payload", "value": "5bdffb834a165d6827008d2982a3023e0a74a762", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677210, "uuid": "d538985b-a910-4d31-b646-3f52363701ed", "comment": "Malware payload", "value": "297e9b382842fd798df7486f5ea18424b4ad26119d260e8252fd48072e8411f4895cd8c84ff4bc2484a4c5695fae7a5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677210, "uuid": "82d0b405-f474-424a-9384-ecffab9d1e95", "value": "CA642379AB3F7205CB68875CA5C816F7D7806992718CB1E3A5B4EF03F294C593A30B61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677210, "uuid": "fc182fb5-0412-4705-b342-f0fec48d46dd", "value": "6144:Gvy7lLw8FdDuiMnvrZoxV9+fdLCzi54/YE+ZxApbYll9AMLyAxMY+FqJp5q9fqQ:Iy7LunvSifdLf5sYZxAuD9PyjkD5yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619677210, "uuid": "55059065-cf06-4834-a69b-688a3a417db0", "value": 334346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619677210, "uuid": "ab9b264a-4b47-400e-a72b-f080feffa067", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677210, "uuid": "087ceeaa-d0f6-4b93-829d-9a4517c00a3d", "value": "Ziraat Bankasi Swift Message.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ad8e34-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700679, "uuid": "8e765e4e-8aea-4a3e-a62b-c3dbb277f4dd", "comment": "Malware payload", "value": "ff6a6e04ac0667c6ba749d6ab4b166a7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700679, "uuid": "0168c79f-2370-42ea-ba29-03595202ed32", "comment": "Malware payload", "value": "192c2505aaceda136d909ba13b4c04ea74e174b4015ea11fab2352e4f7b8ce07", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700679, "uuid": "928e6a42-3de9-41af-855c-692352259e51", "comment": "Malware payload", "value": "b90588ba449bc41bd54ce75d16f345144479dfb7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700679, "uuid": "59b63171-695a-4833-86ff-25bc47efcf4f", "comment": "Malware payload", "value": "290fd4bfe1fe7b5ae4ec64985e1a613477c6c6eb8b5b83c86ed54fa0b5226b990a9110203942cc520109397e3b235ef5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700679, "uuid": "ff2df5e1-b400-4808-9291-2ca7f3b420af", "value": "CC33F1CCC6CDD33294F578315C79CB02D578AAAF0816856181F74A9BBD07AE55B4A8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700679, "uuid": "77729ac4-d798-4e08-8779-115dd9c5aef4", "value": "768:VwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2T:0FugXVpoD8ZxhrLAuNS07MrxrKsY1Oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700679, "uuid": "5299acc8-1279-46ad-a7ba-7116c97d36d5", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700679, "uuid": "442d7905-2cfd-4da7-855b-6091172a0fef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700679, "uuid": "89f3e74b-c327-43e7-bd50-c19065671eb0", "value": "catalog-1729417939.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caf6d87-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704391, "uuid": "7df4723a-3b88-4fd3-b7ef-843513baf29d", "comment": "Malware payload", "value": "97a8de73011833e213f89bb6dda1c9aa", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704391, "uuid": "186b8e26-779c-43b0-b832-4bda8ba79ff4", "comment": "Malware payload", "value": "192da68aa95e79af46f0c8bb6d3d21a26f83090fd004d1ad01f5b5dfcd398e7e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704391, "uuid": "7b810958-a74e-4675-bdef-7252587488ee", "comment": "Malware payload", "value": "77bb3e3b97e51285acc9d357f79c64fc13439fd3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704391, "uuid": "738b02e6-aebe-45ec-8445-978d07ab480d", "comment": "Malware payload", "value": "789a90377204c32607e6d1cbd8c56b2ca2d635def9debaeb158f4f996d0b013887bde8966629309dd4b4fe47efcae199", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704391, "uuid": "144387f2-64d5-4fcf-b09a-b88dbd2bcdbb", "value": "EA33022A8C6E762A173D14F4494A8B1FE517249E387DC9826CCCB477EC056A9113FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704391, "uuid": "ace397ea-19f7-4128-b795-356e0c839d2a", "value": "1536:DP6z4+ADViS8CWoD94pUnQ64x11RiCfNX+:zPZBiS8jopkUQ64xfX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704391, "uuid": "9c00bc69-3fa7-4efd-9677-f4ce5d54dcee", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704391, "uuid": "3b4a58ba-a67f-4d5f-81a4-ff08256df0b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704391, "uuid": "f0bca161-4ca3-45a6-bd39-5fb567addb40", "value": "diagram-722660832.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5d0d59-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706725, "uuid": "4759c4a0-57fc-49aa-9c1f-b798ae309804", "comment": "Malware payload", "value": "b280cde32efb0635a8235219ee2d15ee", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706725, "uuid": "2733ee89-f59d-419e-a7ee-9f54390b2a61", "comment": "Malware payload", "value": "19569b1dddd33ced38221a8662429ad95b007d2f8da0885e9653115bc717c91c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706725, "uuid": "fbf1606b-7ce8-4a31-8724-8ec9b809921e", "comment": "Malware payload", "value": "34094c71fafd3372e24497143822fdf0010a4a72", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706725, "uuid": "9dc9de9b-5493-441d-9c84-888ff22719de", "comment": "Malware payload", "value": "0f65afa4414c376a273a5d433be888a5563ac371e017c3dd6d2506b23484fe840d36dff50b2cdad59d7810667fc0141a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706725, "uuid": "c4687fac-d27e-42bb-b28b-5e1eac7581e2", "value": "CE33021A9C6DBA2D933E24F08541972DD247689D387CC64258DCB4A6EC097AD113FFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706725, "uuid": "facb4c5d-f6a3-469d-a20b-6cc781003099", "value": "1536:TP6z4+ADViS8CWoD94pUnQ64x11RiCzJh:jPZBiS8jopkUQ64xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706725, "uuid": "867afeec-e921-4f0f-a122-e75d57aa2d77", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706725, "uuid": "2cc06470-0974-43ba-ab07-f5459cd1bd48", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706725, "uuid": "c713e4ea-5b3e-4acf-b55f-75b9f0abd744", "value": "statistic-547178333.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2237482-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659545, "uuid": "e52dfb22-fd70-4a46-9c76-5c7f04ed40ec", "comment": "Malware payload (QuakBot)", "value": "7495e5baafd5c89c658b34fee69d75ab", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659545, "uuid": "3bcf5ac3-d3fe-4c30-99ab-c05aedbf0652", "comment": "Malware payload (QuakBot)", "value": "195b8c1e0a94d4848d0fca5d1d929a58b0de2534fd981d15ad1b0d57d52f1bc1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659545, "uuid": "e1f26502-b253-4801-a002-d2656a9f45fc", "comment": "Malware payload (QuakBot)", "value": "f8c22720f39511248b4572ab3610be83d8463782", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659545, "uuid": "e0e5f0e9-cfca-4dd8-bfd2-f8c434612946", "comment": "Malware payload (QuakBot)", "value": "f091b9c95eb174f38707e30515df6d58c8a13eb23a29aaa20819de5628e06c4979fae297de63b2f13f10d44e143abd78", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659545, "uuid": "68208656-a6dd-4b92-9183-bf283d5919c6", "value": "9B549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659545, "uuid": "3c87c98b-d79f-4745-9d93-a96c201896a5", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659545, "uuid": "af83564e-e274-47af-b754-3bc23e6d5c63", "value": "3072:P3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZg7:fvv9sMoXBaRmr/dukbvuZ/7fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659545, "uuid": "23687103-6c53-489b-944c-2b9cdcf9eef7", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659545, "uuid": "3011b82f-c4b7-4ee1-b324-bb5811b1d2fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659545, "uuid": "79403f5a-dfae-4d9a-be33-a18b4f632148", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380edb8f-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705672, "uuid": "e39afea8-0b2e-4248-a32c-b537a8f38d99", "comment": "Malware payload", "value": "96ccff1ac75f1dd9dc9f1d2d24cd2483", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705672, "uuid": "b6e62b8d-3a77-437c-9c4e-a9bd50843c20", "comment": "Malware payload", "value": "195c2438d670eb1ee614bc4e7ead48b13d919b09b830ac1e1e4412cf394c2063", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705672, "uuid": "3302ecca-2458-4267-92ee-ef540d3421c5", "comment": "Malware payload", "value": "2ff14097e66772533123f180e0a90d4c6acce6a8", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705672, "uuid": "118aff37-1f3b-46fe-ae48-5c67c9369094", "comment": "Malware payload", "value": "811bfcb9859170ec5d5cacedbd63926b26bab8f15da1bfc33ca52a4045166f41fab4f4d711398d84b7f40220c47854bc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705672, "uuid": "ac3a324a-90ee-4476-b705-179d372136c7", "value": "AC3302194C7DBB2A577E00E48585DB4EE643289C3C6EC68218ACB475EC0A3E5167F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705672, "uuid": "03b8e1e5-c83f-48a7-a5b8-e02c78015469", "value": "1536:0P6z4+ADViS8CWoD94pUnQ64x11RiC92B:yPZBiS8jopkUQ64xuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705672, "uuid": "74a2a5db-1e1c-4b8b-a7da-e10e749308ce", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705672, "uuid": "c79f082a-c4f1-4e74-8b48-62ff15c74ada", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705672, "uuid": "f209c409-74bc-4422-999a-467788e6ebfc", "value": "statistic-1673842643.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e7631e-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700189, "uuid": "46252252-958e-4cc9-b1df-0833ab019e56", "comment": "Malware payload", "value": "ca16cf1998206db51eea11113e66c599", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700189, "uuid": "d0ece783-d488-4cd2-9bac-e9a7456719f5", "comment": "Malware payload", "value": "19782837db4f671f1a06f609eb46259a9c3e4c740046055db4bc7d5c9633c911", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700189, "uuid": "465df6dd-9ec0-4faa-a5e5-dcac90153f11", "comment": "Malware payload", "value": "32c2f7a55c8ee00108b1e0d864723144075d07af", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700189, "uuid": "e6f79204-0869-48bc-81d0-48a330d7c90c", "comment": "Malware payload", "value": "4875a2eb99724991f1afe83ec073411800aede10118b29fd476b22b52098d638fe610da56916acca872f23d803359f42", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700189, "uuid": "e518675f-67c3-41c2-9e0d-d6a976d84860", "value": "163302C8C689D37698F17835EC79CB01D978AA9E0817846683F74AE7BC07D901B4ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700189, "uuid": "1c9b051f-4523-42d3-824e-624f1aead877", "value": "1536:vFugXVpoD8ZxhrLAuNS07MrxrKsYSh+WTo:nq41rLZNkZLY8+WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700189, "uuid": "52ee4a42-4b12-4dd0-b5cd-913e35af9186", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700189, "uuid": "b1aeb15b-1cb4-42aa-ac42-638b4215dbea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700189, "uuid": "84c5d0ac-91eb-46b5-9d5d-7bb3690d43dd", "value": "catalog-1344822035.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e93fe2-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659550, "uuid": "399112e2-ce72-43d6-9f25-69219c117a60", "comment": "Malware payload (QuakBot)", "value": "6a7b050836764e87d4d999fb0af5ee15", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659550, "uuid": "31047ca9-9b42-47c2-96b7-20133751a72a", "comment": "Malware payload (QuakBot)", "value": "197c12ad29e27c9cbbbaa33ef9dc127235b2a50059e980cea50c8e3a7f9b49ba", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659550, "uuid": "0c6d2105-a7ac-4901-9e22-2e9261a5885f", "comment": "Malware payload (QuakBot)", "value": "96d6dfeda78613e6b04945e1690d04abc424180e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659550, "uuid": "341641ea-1b7a-46d3-866b-6ac863c47995", "comment": "Malware payload (QuakBot)", "value": "9a7ae291729ba20126f391b351c406bd0737054aec25a4ae08830c7f0c8f60a7230e63572c1c6ca2efb9e3d6d226bfba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659550, "uuid": "b28beee1-8c45-417a-9c7b-bdbb11b9bd8d", "value": "C1549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659550, "uuid": "f84b4d36-a70f-4922-8429-a391d4b41225", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659550, "uuid": "177fda96-0383-4688-8fa4-fb62f25fafba", "value": "3072:K3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZgA:mvv9sMoXBaRmr/dukbvuZ/7f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659550, "uuid": "e63756ac-601c-4944-9eb8-bf19243ac739", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659550, "uuid": "cb2128d9-50cd-49d7-b1c5-27d8ae5115af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659550, "uuid": "b6b88bc8-9d79-4f3d-ad7e-3f8f67f3471c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ec9bef-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705259, "uuid": "819f126a-bbc5-4da9-8182-cb8c40b3acec", "comment": "Malware payload", "value": "6827be29b687e23712c6d93e182d8a32", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705259, "uuid": "5783db67-c558-4412-8a58-ee502fa7f30b", "comment": "Malware payload", "value": "198c33254cbc2188f6700ecdfdc797ae39bbf4f03edd4d93015926a9f7b80662", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705259, "uuid": "6b819af2-da39-443d-b8f9-7be6f4d965fa", "comment": "Malware payload", "value": "6e7be417a98293e6bc437b9e29320e5a41c669c2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705259, "uuid": "3a1694f9-67e4-48aa-8982-a01506b58987", "comment": "Malware payload", "value": "08154af901e5a478b750852e2d1d471cc79d84537d93d5bc1ea50509f00047078749c2f4697eb889f45d061274ff3ec8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705259, "uuid": "f874571f-0aa0-48ee-aa19-b5f6819b7d17", "value": "5633022D986E7A29177D10F88588DB4EE55768A93C2DC6821CCCF429EC05AE9117F73C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705259, "uuid": "033d12e5-4817-4384-86fd-50a81bfcb62c", "value": "768:O9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCD:/P6z4+ADViS8CWoD94pUnQ64x11RiCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705259, "uuid": "38f320fe-3ad2-45e4-a041-6256c0d30fa1", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705259, "uuid": "44c9dab5-5e71-40b9-818c-d64aec17b73e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705259, "uuid": "b93f4ee7-0eb5-4783-9288-1429698fecca", "value": "statistic-1320984700.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3f6d4f-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619702273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702273, "uuid": "5834e487-5955-4ab1-b9a6-770c7925c35b", "comment": "Malware payload (Dridex)", "value": "61f66a91427a4f6d37619361e77670a3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702273, "uuid": "49db5a43-386f-4082-806c-adc7423c0547", "comment": "Malware payload (Dridex)", "value": "198fd721821f7cc2162c9f56a08a4c01236e228457eb9569fbe70b92f77a0349", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702273, "uuid": "e86c0831-c6ff-43ac-9b08-ccfab4272310", "comment": "Malware payload (Dridex)", "value": "a4a1dbea5ffa16ba85fe42e38f3c959aa96ea360", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702273, "uuid": "c1cc1c8a-9387-4392-9158-6f8b13809e1a", "comment": "Malware payload (Dridex)", "value": "d215aedeec297ef8aa7ef2f724e1c805802ec4579d14e87a45f6989463425934749c8f69eb4fffea9fa55b3d7bb59a26", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702273, "uuid": "795f2dcc-2c4c-4304-b4e2-beaba3e330c2", "value": "17F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702273, "uuid": "538c55dc-b94b-4dea-8ac9-7a417ca81228", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702273, "uuid": "e7591481-381e-43c0-9552-a8efc96963c7", "value": "3072:hWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:h42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702273, "uuid": "306cab24-f567-4cee-b70a-693feacb69c6", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702273, "uuid": "94450565-65f3-4bae-9965-49b043019949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702273, "uuid": "28d865cc-fd7b-4387-aa04-ace93ad2477b", "value": "61f66a91_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d9b753-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702120, "uuid": "1aadabc9-d8ba-45e3-a590-8695baaab306", "comment": "Malware payload", "value": "5860f7f074fd83d8da5579c60860fbe0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702120, "uuid": "6cf1bd13-95fc-4cfa-9549-7eab46ec373c", "comment": "Malware payload", "value": "199bba3ce1e8a24704eb268aa1cf2fe6acad618485c75e11776e8709b3a785ee", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702120, "uuid": "e480911c-10c2-46b2-9314-b8720d37e9f7", "comment": "Malware payload", "value": "6396620ad519182d5aa015df3a0b4b69c95691aa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702120, "uuid": "4d5efc86-e875-40ba-a06f-ff78503329f2", "comment": "Malware payload", "value": "f10d765bad020e7a2f9773e45605edefa94d4a3c1d2538a4caee2a147c7aec2a967b2fc07935aa0271bffd8a74ff76c6", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702120, "uuid": "fca08822-0681-478f-b12f-10e0b2f31d8b", "value": "9933F188C588D332A4F63531AC79CB01D5B8A96B481AD5A1C2F78EDBBD07ED5170ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702120, "uuid": "f65c4cd3-0908-4283-a6ed-33868b329f41", "value": "1536:iFugXVpoD8ZxhrLAuNS07MrxrKsYl9zmo:8q41rLZNkZLYltmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702120, "uuid": "ce6a6141-2532-4f50-8182-f5dfde255b00", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702120, "uuid": "a6767642-208c-42b5-af34-16a0052f16ba", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702120, "uuid": "ae17ca21-f4be-4627-994d-45459eb3ea5f", "value": "catalog-921245436.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c16628-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705660, "uuid": "8f1e658b-879b-4441-8226-ce40397dae75", "comment": "Malware payload", "value": "2a6d32b103873f98a9da427cc7da69eb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705660, "uuid": "6bb9cddf-f154-4fd9-ba18-6dbc57335b51", "comment": "Malware payload", "value": "199c90fc44d8f133d6b2732cbff931b588937b2be82b8243564a439048a69d2c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705660, "uuid": "6567ca79-0ef8-4b86-9e05-c857dc028b68", "comment": "Malware payload", "value": "507731c36cd9f103ec5299aebd90e156e5558af6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705660, "uuid": "eaaf5e34-abbc-43a9-b4a5-e15661a8b3be", "comment": "Malware payload", "value": "53517079bfaaffbed065862c6cdcbcece3c855beaa2bf4b418cb46148b6ddf1816fb8e3dbe7db5731fa066504a80ba03", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705660, "uuid": "fbf82b4f-84cd-42f2-a690-4c2550f55281", "value": "71330219586DBB29532E24B48A85DB5EE21338DD386DC6821CDCF475FC05699023E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705660, "uuid": "bbee2790-af3c-473f-986c-5b772d11c3e5", "value": "768:sy9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCSF:uP6z4+ADViS8CWoD94pUnQ64x11RiCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705660, "uuid": "9b1a69bb-f07a-4239-b3be-dbb35cfeacc4", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705660, "uuid": "e306f95b-8443-4acd-b0d9-86a01e9a9146", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705660, "uuid": "ce41806c-4e3b-41b2-b293-615294e8236b", "value": "statistic-1665507995.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b02ba5-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659554, "uuid": "f767c1a3-27ab-4830-acb8-09ab50aef886", "comment": "Malware payload (QuakBot)", "value": "1736ea212d520b14a1111b1a9b360c5d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659554, "uuid": "1efba7a5-29ef-430c-a4b9-73ca36b9ef54", "comment": "Malware payload (QuakBot)", "value": "199dc8db0becfcd17f41a79962f940388759a4d2ebbbaa5a7a76df8cd31c240f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659554, "uuid": "e2a418d5-8439-4059-ab7f-a8a70299fcfa", "comment": "Malware payload (QuakBot)", "value": "6a9913f8fddddecdfac58d877f1039b41cd51e8d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659554, "uuid": "16554be0-2623-405d-b0f1-8ebc0e617245", "comment": "Malware payload (QuakBot)", "value": "0ac6b88e9b6d3300245ed616f9f332b11f37972b717fe7610369efaa6364a87289326105444f991f4e33700f1ec94dc4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659554, "uuid": "a3675f14-c702-41e4-a7ea-658f7bd68923", "value": "BD549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659554, "uuid": "dcd070f2-e0b0-45da-9295-694117142e2f", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659554, "uuid": "f3364282-6b0f-4359-a08d-c6dd814ee200", "value": "3072:P3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZvO:fvv9sMoXBaRmr/dukbvuZ/7fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659554, "uuid": "e5f2728b-6c9e-4dbc-81eb-775538c719ae", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659554, "uuid": "e116de70-b94b-4861-a3a8-3625884eddb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659554, "uuid": "b5dfc077-7cd4-4a80-ad7a-ed6da5f8c1f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af658865-a8c8-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619686545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686545, "uuid": "f0b538b7-2856-40d4-a2f0-5603239108a7", "comment": "Malware payload (Dridex)", "value": "6189589b066102a8e921e1e9bbc38979", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686545, "uuid": "4a41b0c7-3263-4231-bae2-82b3a8f0f864", "comment": "Malware payload (Dridex)", "value": "19a6f333974fe1456cf7ad85ab771c4f3dc9ff7991a2946f93ec01bf0505bfc3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686545, "uuid": "24ac9365-e0f6-48d5-8549-9436a7ec337f", "comment": "Malware payload (Dridex)", "value": "3112a3692556dfc243ddb6ace19661bcddb8255f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686545, "uuid": "fa59a56d-143c-4208-a9d8-9a1574fcd6ee", "comment": "Malware payload (Dridex)", "value": "2edf4ccea156d0bf520fff47bc2f598247dcf6b7eac41e8dad7421a6ee7fe195f22b5cb957f497218b15fab058ae1616", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686545, "uuid": "bf923437-aa61-4ca8-96b7-1383863040da", "value": "74F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686545, "uuid": "b11e10c0-3a3c-4559-91fb-5b09cd3c1499", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686545, "uuid": "70eaef66-868b-4818-a716-6ed85e1fba32", "value": "3072:mnT2d85tleLD51fC5AHYEoefukoTFMpGmjh8D:9y5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619686545, "uuid": "e17619d3-d1dc-42c6-b897-36e1b7e83c90", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619686545, "uuid": "ca859acc-f05e-4cb1-8684-a3515d986cdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686545, "uuid": "759e1c21-2a5b-4d03-a286-543c779dcc52", "value": "6189589b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1c2921-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702622, "uuid": "9e4838dc-2a7f-41f2-abac-b8b134f29ad2", "comment": "Malware payload", "value": "f8cdace7e865d0f5771e16f887a6e5bf", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702622, "uuid": "f8e5e494-fa08-48c0-aa8b-9362d91d525a", "comment": "Malware payload", "value": "19a8641a17e849cde8769fd1f0dab5bf9e85d2ee5eb43a0e44f9de7b5c9e4127", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702622, "uuid": "87d9b3d5-e7a5-4014-a33e-f94bb3559830", "comment": "Malware payload", "value": "666478888b2b99e7e2584b682b4e2e58da622a86", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702622, "uuid": "2c2ea6f0-60ad-4009-8678-eab7eb41053e", "comment": "Malware payload", "value": "b6708ee1851206c07edb0029b84fd71a2f788bd086dafc9aba642572988f64de77bf11b94808ef8561843d92e3a0975d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702622, "uuid": "521ca033-60f7-4f81-8ea9-16c25d25b5b3", "value": "F633022D9C6E762D672D00B085899B5DE653289E3C6DC5401D8CF4A6EC037AD127FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702622, "uuid": "340a3607-e20b-4ecf-956a-a727bd47fa1b", "value": "1536:BP6z4+ADViS8CWoD94pUnQ64x11RiCTpF:lPZBiS8jopkUQ64xR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702622, "uuid": "a397cc42-3956-43d1-93aa-9ad7f3e99fdf", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702622, "uuid": "7efddb44-e90a-4bbb-9d0c-db3933883fa1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702622, "uuid": "a9d9aabf-b047-4070-bc52-2e3e44a61b36", "value": "diagram-1342723799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bc8e43-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703900, "uuid": "f50252ab-d31e-42a2-a34d-a1b7991096c0", "comment": "Malware payload", "value": "60c476ca5440b9faf519ddb9974ea48d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703900, "uuid": "4d8dbbba-9332-402a-8646-dd65033df7f3", "comment": "Malware payload", "value": "19ad7da288bad9aea3767574514f6f8370e011c836ac8cd14824cf9066729961", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703900, "uuid": "907d8421-fde8-4950-bdd6-156326763e57", "comment": "Malware payload", "value": "b09d65921c843f6bc4d2a826806853aa77fb000b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703900, "uuid": "8a57e064-4e92-4848-b774-8cad89b0bad2", "comment": "Malware payload", "value": "b50dafc3838eceb0c57c632fdac571c7d29780eaad9229aa8a32f2728ff35bf3fffc7aab88cfef9572170bc606113133", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703900, "uuid": "92648c80-d04b-4e63-97b2-63c569473cd4", "value": "E63302294A6FBA29172D20F0C588C74EE64B649D387DC5D15C8CB476EC0A796063FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703900, "uuid": "e9104d8d-363f-4135-925e-88eaf03a0aa2", "value": "1536:2P6z4+ADViS8CWoD94pUnQ64x11RiCnWk:4PZBiS8jopkUQ64xNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703900, "uuid": "645cfe5a-63ab-4a35-8795-910f1dddac53", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703900, "uuid": "7c00c370-b62f-43e2-a66b-7890d32f1397", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703900, "uuid": "8406d597-1de4-43d1-ac37-694dbc12e20a", "value": "diagram-318838289.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabb5d86-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701999, "uuid": "1323a18f-6788-4fa0-adec-3bbc558a4444", "comment": "Malware payload", "value": "647c6be7c0eebd4f76fa54d128d9faf5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701999, "uuid": "219482aa-511d-4834-87d9-1bd7018dd3a7", "comment": "Malware payload", "value": "19ae958405658f79c8380d5c7deb2cb419dcd0342de8cf5c079d1a50362d3ff5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701999, "uuid": "7cc7afd7-7d59-4a66-aa06-bd7904e6f1a0", "comment": "Malware payload", "value": "b55f3b78bbb5966980c0b5ffddb7e194fa961c99", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701999, "uuid": "730ee050-26df-44d1-8136-a5bbc1ec5e54", "comment": "Malware payload", "value": "edb865ffd97f4854d06d7fc152460ffa21b6d0c575c83c3deddbf5fdd8eb4b6a4cf365f900828ddc8d0903041487a9dc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701999, "uuid": "d6e6a385-38cc-42a1-97bf-f4008557800e", "value": "DD33F188C688D33294F63531AC79CB01D578A96B481AD5A1C2F78EDBBD07ED5170ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701999, "uuid": "2bf99c2f-9fb8-4883-b8d0-8d935f1e39f4", "value": "1536:vFugXVpoD8ZxhrLAuNS07MrxrKsYlhFmc:nq41rLZNkZLYl3mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701999, "uuid": "64ceb04a-bc9a-461e-9090-c39125896d7c", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701999, "uuid": "6ea976fe-be9f-44a9-b600-ae29872102ad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701999, "uuid": "410149c3-5f88-465a-99fe-e31f93292e55", "value": "catalog-825683627.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1105f1-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701144, "uuid": "2473270f-0574-455f-be7b-f2c2ff3e7dcd", "comment": "Malware payload", "value": "8049b31f4575998e288aa8f0da4e1e01", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701144, "uuid": "d6d81b45-b630-4431-bbc3-60fc719e46e2", "comment": "Malware payload", "value": "19b19446b654d3db92c980aacdbfee0e91a6aac6b6578fdb652020543989fa02", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701144, "uuid": "3ae4c6ec-262d-42c6-b54d-8c38554dc4cb", "comment": "Malware payload", "value": "d4b116f76f365480e42dda183d6e0c9b65f9ee82", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701144, "uuid": "3db70240-7430-4df1-a919-d37d5997f587", "comment": "Malware payload", "value": "dab1489d769e604124eb7e2576f2117cfcd13fb176d199aa7a43b8d91644b4153afd437e104af782d2d225d4256fd7e7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701144, "uuid": "6bea4910-b5ea-432e-9254-99b1decdac5d", "value": "10330288D68CD33294FA34355C3ECB01E5B8AA9B4816C66281F78ADB7C07D955B4BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701144, "uuid": "89cfa37b-68ae-4d27-b8e1-3294274aa2a3", "value": "768:kwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2L:5FugXVpoD8ZxhrLAuNS07MrxrKsYMvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701144, "uuid": "c3459550-4c52-4d87-85ff-8241df80370c", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701144, "uuid": "3e914976-1960-43c1-9920-d548139abe64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701144, "uuid": "78107a98-92ef-48f1-b5bc-12be66a5dd1f", "value": "catalog-2100254175.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f841265-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619734058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734058, "uuid": "084b5faf-f7d4-4097-bd65-310592fc0b74", "comment": "Malware payload", "value": "5b8fbe8aeb04582597f3fd16c194be83", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734058, "uuid": "968fe0f3-4b52-481e-9ea5-18cce8d44c6e", "comment": "Malware payload", "value": "19b5014fed1cb49c722ef5d872a4aa60807da30973829231f2a113e1edbc00f0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734058, "uuid": "f12e26a8-6994-4828-b5bc-7bef4e1989dd", "comment": "Malware payload", "value": "4ffd8b75cebf7c03fb96b7cf834140d5138d39ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619734058, "uuid": "f0004f2b-70d4-47d3-8ddd-7ca1a5773541", "comment": "Malware payload", "value": "f05aee26538153454353b6d2d6391c5046a2492985c2b46a8c9ccaf322fd521ab284120ebe5986694a8901675ca8ba25", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734058, "uuid": "a1bf9c96-7dd9-4e96-856b-a992281219b2", "value": "84F3CF82D702C1ADFE212C7A28E677753D5833905E54CA68E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734058, "uuid": "80254e49-eaab-4463-a17a-53dc979a82f6", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734058, "uuid": "7756518d-43c9-45b9-8e28-0f9ab628a2a4", "value": "3072:2Y5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh80H6:R52j4pk5zMbVO6/HUIXU8KgMy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619734058, "uuid": "a46722a5-36ba-453a-b11b-c1f490640a0c", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619734058, "uuid": "29667123-39bc-4371-b557-d4ccf7714f1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619734058, "uuid": "4cc3da99-0a25-45d7-82d7-162d0f02aca9", "value": "5b8fbe8a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75f86b2-a8c3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619684384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619684384, "uuid": "64cb8f5a-e6e4-4de9-89a2-3746991e6b16", "comment": "Malware payload (Dridex)", "value": "e08277575376a7cb088cc1ae1d879d58", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619684384, "uuid": "34ac2b18-a239-4f37-a3d2-66c4626c629d", "comment": "Malware payload (Dridex)", "value": "19c7df6734cc7c4b88687c04d56167f5adc41a9da5fbab1e9b9edd27e5a6d472", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619684384, "uuid": "01344374-8b17-41d4-b267-52f233678c3c", "comment": "Malware payload (Dridex)", "value": "855bb175403964a128919aa7c1187c51c392d7b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619684384, "uuid": "8e06cabc-3bda-4d65-87b6-69a51a8aad1e", "comment": "Malware payload (Dridex)", "value": "ddd314e172b91780d148c4b5fb7eb712b60bd99ad9cdb7a282d63bdc230b5340ae1bc36f0f7367593a031d7e3c70f834", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619684384, "uuid": "34df20fc-1bbe-4281-a115-4ff0f243bb84", "value": "97F3CF41D5A6C458EBDB28B0C114BAEE5310DF929B4BC575F4E0F9DEE76B8A0203B643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619684384, "uuid": "238684e3-29c6-466a-8859-4aa1fbe25235", "value": "c8a1182b55abcee435b2b4653b21c9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619684384, "uuid": "541c374f-fe84-4812-a147-321e8b6a1ca3", "value": "3072:7xT2d85tleLD51fC5AHYEoefukoTFMpGmjY8D:4y5tAL11fNHYafoMpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619684384, "uuid": "15d588a1-b2e3-46f0-bf0e-35b5b59b1d94", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619684384, "uuid": "635857a4-ed66-4cdd-a173-33e02dcaef67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619684384, "uuid": "ad82352d-7d2d-424d-bd4e-67a64816eae3", "value": "e0827757_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc93c4a3-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701224, "uuid": "3ab88d59-dd44-4ac3-b71c-02dfef007cce", "comment": "Malware payload", "value": "55e32f3d907c6f3a699accbaf7368ad9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701224, "uuid": "fdfd951a-147f-4477-875c-f8c00ecb9810", "comment": "Malware payload", "value": "19e2e61d7f5c1fe608c946721cfea28b3b0f2c7674281bcd4d0f6f6b238ffa18", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701224, "uuid": "738b9849-6218-4a4f-aa7a-f21ab136a7dc", "comment": "Malware payload", "value": "98869df206554c2e803c3c3634a1e13ae194a12a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701224, "uuid": "d1fb2925-5c5b-4d23-9f54-e5ce274afa4b", "comment": "Malware payload", "value": "5854cfed6d436258fde615fec7f9c6c4058a5bc4ee787afa511d3c15db90c7d737a3b826d1ab02d2a0e492f5cdddd1ce", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701224, "uuid": "3dc32d91-eff4-4f70-b67c-f6a28500301c", "value": "6133018CDAC8D371A8F670725C7ACA01C978A577481AD56142F346E7BD07AE11B8ACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701224, "uuid": "c60e9086-4596-4670-b11b-b36d2892802e", "value": "768:iwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV23:PFugXVpoD8ZxhrLAuNS07MrxrKsYb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701224, "uuid": "7db75808-a2a5-4cdb-9243-67d74ed53d72", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701224, "uuid": "bffc38c0-cb09-4881-b4a6-00456358325c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701224, "uuid": "e7b65223-8ea7-4f11-b89f-a6180843cc8a", "value": "catalog-232482547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2001f71-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704991, "uuid": "9f4e4d80-cd6f-4624-b7de-5621997a7f66", "comment": "Malware payload", "value": "398b5f08e9f323294b3370b4ffd4f8f4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704991, "uuid": "ae8446ba-614a-4683-ab02-3c1f5ee0632d", "comment": "Malware payload", "value": "19e32a4f3ad53e0676d5cb8e0d4b004be37a743f01de85f79e4dde96cb6f2beb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704991, "uuid": "a7333ad2-c051-4ec7-bc04-a9ac60462168", "comment": "Malware payload", "value": "df76414f3fa24a28825cae54a03824e75d414cd4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704991, "uuid": "2b531ce3-9001-4122-bdd9-44e1863a7a2d", "comment": "Malware payload", "value": "d96a446ce332dca18ba1d6883edb4ae4ebd8a850af417b7535af362841a90f0fc98f36ad5082969527febadc746c47dd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704991, "uuid": "249ba5e3-754f-42a5-b004-7628abec0fb7", "value": "D233021A5C9E362E132E18B09984CB1DE25764AD34ADCA812CDCF472FC057D8223E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704991, "uuid": "8f6a09e9-9353-48ba-b3d2-1936ec4a0f7f", "value": "768:E9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpyX:9P6z4+ADViS8CWoD94pUnQ64x11RiC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704991, "uuid": "429d7ca2-cb46-4eaa-b720-8d5d715fc650", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704991, "uuid": "d77a1fc5-0a50-4ff0-b201-19d06f390d3e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704991, "uuid": "ebf73896-6af0-4fd8-a8c4-290bbeaae532", "value": "statistic-1117888564.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd5fcda-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659563, "uuid": "1e2ccd52-576a-4a94-a38f-4f0586082e65", "comment": "Malware payload (Quakbot)", "value": "e5cf253df50b4ef7e78acaf796f9432c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659563, "uuid": "2cfb05fe-8f0e-42ec-b210-730c8c9e6bc9", "comment": "Malware payload (Quakbot)", "value": "19fa07f4ec76a80216d169db4fcb6115d6df2030b8847eb35c39958cecf49bd6", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659563, "uuid": "0b77d328-226c-42de-bf65-c55bbcfbc35c", "comment": "Malware payload (Quakbot)", "value": "e9e3f9c03c211acb24ca0bedf7f8c8ed051223fa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659563, "uuid": "7112e54d-c64e-4224-af0f-f060f703f829", "comment": "Malware payload (Quakbot)", "value": "9c70277410ad6f8a768a09a1f749271a4a0ac34267994a6ee676f52f6c8fb83d1232f9ce9b0ee4944f07345864974ae7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659563, "uuid": "f2e431e1-7ea8-4909-a2df-0efe5b11380e", "value": "A0549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F587EEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659563, "uuid": "1d6786fc-f242-4995-a616-a1035dbc254b", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659563, "uuid": "9b75d8db-1bf6-429c-9eb4-6b1d55f28b3a", "value": "3072:T3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZac:Tvv9sMoXBaRmr/dukbvuZ/7ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659563, "uuid": "fbf96e85-b899-4a96-89f6-fedc725b5473", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659563, "uuid": "a01f6617-3a2b-401a-ba0f-706b17a15c1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659563, "uuid": "19e67e84-b0d4-4c2f-b7db-56c4ebcbe8a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a394a8-a93f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619737447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737447, "uuid": "46949531-53d3-465d-be8f-67d9ae0c6404", "comment": "Malware payload", "value": "5c27abaeb92fc8305e15db5536cac192", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737447, "uuid": "373aecab-61ec-4074-a8cd-38a3e8be40d3", "comment": "Malware payload", "value": "1a101c4073a642bbcb79ba01b7932926703559aec50729a46a00c653a9796488", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737447, "uuid": "45495324-c042-4c1a-8c03-5fdad5d938b0", "comment": "Malware payload", "value": "f3eec781a1c267db564693fef9fd4aa51004179d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619737447, "uuid": "75a1c774-1474-4766-8e67-4815e75b205e", "comment": "Malware payload", "value": "d016c692acec2c1950c8ac6941f11795fbbc363d1ab8bd64257528a0f302f00f1300a34f1b4224b035ec272e2337509e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737447, "uuid": "1bf3995b-cddb-43e6-98f6-df3eba77bd75", "value": "B7F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737447, "uuid": "54ce0a2f-482e-415d-8086-ca1c0089d979", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737447, "uuid": "c1028280-2533-4c27-ae7b-27c4ff45d739", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619737447, "uuid": "6e0e8129-80ae-4e16-9c0d-2079b4b9418e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619737447, "uuid": "dfead520-0b41-40f4-a9a7-71c3a25c0115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619737447, "uuid": "07ab506b-9fa2-49df-b46c-93aa1d02fb99", "value": "5c27abae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa7909d-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659568, "uuid": "be46c0a8-9683-4f86-bda7-e63002795519", "comment": "Malware payload (Quakbot)", "value": "1a4f1061e928f06fefa4cdda98f1e933", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659568, "uuid": "8b0a6f47-df18-44f0-bcad-9e33c8df08cd", "comment": "Malware payload (Quakbot)", "value": "1a1c1cf2304a86475e39a745354836940d2dd99388f46732d34f17685b88926f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659568, "uuid": "9ba5d6fc-c94a-4d83-bfed-cf658246939b", "comment": "Malware payload (Quakbot)", "value": "09fa0279a4e45e6193c100176a09ddcc433b5956", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659568, "uuid": "5cf401a1-a398-4ddb-948d-37846effa3e6", "comment": "Malware payload (Quakbot)", "value": "3697536e48d20c5ce56d5d7e9630b357f38abe317eb30e7b273bdbd184470f620f3dd172ede1a5f1e5d37991176d3ec2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659568, "uuid": "40d6dad2-e83d-467d-9e4f-19e04a899cf2", "value": "A274BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659568, "uuid": "09f1d570-690a-438f-90b7-4a19ba6a3527", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659568, "uuid": "d2e420af-4a03-4068-b6a4-30aca2dc423d", "value": "6144:UTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRue:Ubi7/xZrkNK11G9AQyOi65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659568, "uuid": "7554299b-b253-47ef-9752-7815150546dd", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659568, "uuid": "82e483c7-e579-4334-8e27-93961b2be41c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659568, "uuid": "6db62988-5be0-46c0-bda2-0dc592283dcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71be1453-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704910, "uuid": "96429736-6496-43d4-a3ad-c6edfe52eef7", "comment": "Malware payload", "value": "5219ea5c87efbf8b0a9971590baa31b5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704910, "uuid": "7a4027b3-e084-44c9-8f2e-988f2ef35b70", "comment": "Malware payload", "value": "1a2a3eb15f46fb3ac314b48fcd465bbbb1c87670f06f40f949ac3dcf5b7b2be3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704910, "uuid": "7a4947fa-eb42-4b3e-8a23-39e1e1f461a7", "comment": "Malware payload", "value": "c6079296dc06e367a47884f5a4e3ad00f70f5773", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704910, "uuid": "992e8fb5-5da3-42f6-9f29-4a84388f65eb", "comment": "Malware payload", "value": "47dfe7ddb97e86fbfcf07fb84f53ede5bc6ecfa265ef384eeaeaa63e9b73adfe92e5d044afa749bb2b90afa148104fd1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704910, "uuid": "bf0a5886-5867-4cc3-bccf-024350d280db", "value": "CA3302198CAEB62E577D20F08589D70DE517256D386CCA852C98F49AFC096E9013F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704910, "uuid": "a619a407-e72e-41f8-869c-0c33d5cd35ad", "value": "768:W9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCStQ:nP6z4+ADViS8CWoD94pUnQ64x11RiC59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704910, "uuid": "53ba76c1-671b-4a3b-bf8c-b1b4e2266e05", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704910, "uuid": "b92046b9-0a64-417d-aff3-8777e8c3b25e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704910, "uuid": "244dea32-1b61-4407-b1b7-0e685f38c8be", "value": "statistic-1047309580.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e275d8e8-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659572, "uuid": "202db4ff-9a34-4a83-8e9d-8cfa98a3a09d", "comment": "Malware payload (QuakBot)", "value": "13c4f946ba85ec4c15f3925de34eab49", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659572, "uuid": "ac9695b7-757b-4c55-b011-3b04e40d629f", "comment": "Malware payload (QuakBot)", "value": "1a2d5f63c24a85efe9b0f7d59369dafb794df920135e724b62558402c4a7bc8a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659572, "uuid": "54cacb1c-aaab-4ef1-8a8e-c8f26662ae1e", "comment": "Malware payload (QuakBot)", "value": "40cfc9029f16e911d8ac68ddae5dc031d968767b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659572, "uuid": "559f054a-8022-4e73-b9ac-9f4085ab1eb0", "comment": "Malware payload (QuakBot)", "value": "0fe03b1bde2c55b6803756cf4ec6481915a8cd4f3e1a47da45ea644ac205dd36a2fa4829b08681dc59c81681544ad5f0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659572, "uuid": "c35989ee-83fd-44f2-94af-fb65fde6b7ee", "value": "6E74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659572, "uuid": "2d746737-824c-4f4e-80c8-5d039a3ff32f", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659572, "uuid": "02db02e3-706c-4785-ae65-5f48fbe03986", "value": "6144:LnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRux:8FrkNK11G9AEtMxQyOi6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659572, "uuid": "8d2bf2ba-c18d-4d18-9afe-7371af44cc8c", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659572, "uuid": "c31c584f-e5ea-4496-9228-4173e7304f72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659572, "uuid": "3aa7c70f-8ad8-4122-b5fb-16a2d697a435", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaab7173-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706294, "uuid": "d25a75fb-0998-4bc9-83e4-5d2bd5ff7127", "comment": "Malware payload", "value": "b207107bb24a4cf97b51ab9e751a0a33", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706294, "uuid": "cfc26df0-dcac-4f31-93fa-33ec08eb5ce4", "comment": "Malware payload", "value": "1a3b2c4ddc13fd1a58c2b6fdd82baea7f62a0a6b67382e36fb175db409070357", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706294, "uuid": "0bd0808f-ddff-46eb-8592-fdc85ae90235", "comment": "Malware payload", "value": "c38f9b1f92df71be2b31d5b57b84145d7cfb6752", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706294, "uuid": "f0ec494e-7a2a-47b9-9536-08e7d1e634cc", "comment": "Malware payload", "value": "76a694afa76a01283742ed56f8dbfb8b2336ab51ec1b977e9a25da87c5c8ba028f6af53c8423dde8aa2d1795121adce8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706294, "uuid": "0a991994-d60e-4b07-8b0a-fde91bb88b25", "value": "6A33021B5C9E762A577E14B08984CB1DE25764AD38ADC9812C9CF472FC067D8223E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706294, "uuid": "c43037d7-29dd-4e84-909b-8cd84676dacd", "value": "768:x9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpD:kP6z4+ADViS8CWoD94pUnQ64x11RiCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706294, "uuid": "e2039554-9b44-4bee-9411-603ae93e69d7", "value": 51483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706294, "uuid": "e07e380f-7987-40e3-a800-a496731e0f77", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706294, "uuid": "95eaa6be-2c90-4682-b646-362c68d9bb13", "value": "statistic-25915571.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5d911b-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703075, "uuid": "307ed822-e2bc-4abd-92fb-76647d651fea", "comment": "Malware payload", "value": "69ff53db647c3e27d5cce5dbd1b5ef29", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703075, "uuid": "7b037ae1-8ed6-4108-a008-83763151938e", "comment": "Malware payload", "value": "1a3f42cb4fe0ae89e7dbfd3a535711807860dcc56754ea0b30d4ab3ac84fa043", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703075, "uuid": "d8dfb50f-7f66-45ac-a31c-aa124aa5fa54", "comment": "Malware payload", "value": "bca66b1696a12d56dac64b549082b0ae6acbcb97", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703075, "uuid": "d2e9bb06-f370-433c-8ee8-6f6789f2d3a9", "comment": "Malware payload", "value": "f6ba2f53dd7137ef4e7d6b48b420aeac130594481a4939bea53385bee12317fbb9a973799ca442bc482b619ffcb013a1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703075, "uuid": "a039a2f7-554b-431b-ae97-b33f488107a8", "value": "8D3302298DAE762D537E20B04A44D74FE14B58DD386EC9811C8CF8B6EC056B9163EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703075, "uuid": "9979d7f1-6c35-4188-b088-66de9b91514e", "value": "1536:tqP6z4+ADViS8CWoD94pUnQ64x11RiCgPuEk:GPZBiS8jopkUQ64xSPu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703075, "uuid": "02c81c5f-864e-436d-92c0-302b4862bda1", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703075, "uuid": "823fd5ce-02d1-4799-9252-2b1e6434bbde", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703075, "uuid": "b0d2bc1e-3d80-4b5d-aeba-0f83a65d9d1b", "value": "diagram-1700397315.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7095701-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619705939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705939, "uuid": "fbea56d2-2a3a-4563-b621-a765179309d6", "comment": "Malware payload (Dridex)", "value": "ab41a30693a463224dd6edb54cb2a5a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705939, "uuid": "95d0bb7c-748b-4a54-aef1-b994fe25d94b", "comment": "Malware payload (Dridex)", "value": "1a42ddfe5d8b94b27db75f798ea3b2399bca6232c34fffc4514e8bf3127fd846", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705939, "uuid": "36622018-dbb2-49b6-a1f6-61454a35854c", "comment": "Malware payload (Dridex)", "value": "12ee92f9fe9eb3ce43723df834513c17e8c0f60c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705939, "uuid": "7285ffa0-da5e-450f-a5c1-bd23733bb051", "comment": "Malware payload (Dridex)", "value": "3c895685e847e4fa08e345416c77e64befffdf20924ebc940d1fcaa82e0e218c6d3bc7b860acbe6c6a440bd66661b802", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705939, "uuid": "e171546d-719c-4b4e-a3b8-84da3203acef", "value": "B1F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705939, "uuid": "abed9403-613f-4a72-85c3-72f333fb7a6e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705939, "uuid": "0e9504cb-2049-47c0-9da8-aadfd32130c9", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705939, "uuid": "71525dfd-9f6d-4cbc-82d2-babe3e2dd9cd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705939, "uuid": "13d258ce-e201-4cb3-bf72-9efb725a901c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705939, "uuid": "ab4b3b7d-a1d7-44c9-a0e8-600f473a72a1", "value": "ab41a306_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c5a4e0-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705047, "uuid": "b3c89c2e-845c-4991-86c3-42eeaa9f6833", "comment": "Malware payload", "value": "f7ca52df8834cd3478d32e5ab44ecd23", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705047, "uuid": "ffd17dd3-ccef-4b72-be1f-8d3d3fbabd82", "comment": "Malware payload", "value": "1a50819138ada7af3659246f1fe38437b95e78febd7df5984e57988d2fc5fbc0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705047, "uuid": "25469641-78cf-44f5-b564-9374c5bad91b", "comment": "Malware payload", "value": "95ca155876d9e4c1b4ee55a4d76b3f08ef72da27", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705047, "uuid": "82b44ded-5050-472d-b74b-776ba7ae02c2", "comment": "Malware payload", "value": "9a2de8af88147713284541ac7520e953f4f6befe6362f282c6daba15107f2b6a87acc82ae37627d5d60f08468dcfcbcb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705047, "uuid": "b5dcd424-4572-4287-b631-dde0bab6b1f7", "value": "BC3301298C6EBA1D677E10F081859B1EE5536C9E386DC5811CDCF869EC0A2E8113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705047, "uuid": "c53da1ec-a622-4781-af0d-b7b4a919ea47", "value": "1536:uwP6z4+ADViS8CWoD94pUnQ64x11RiClGjzL:hPZBiS8jopkUQ64xbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705047, "uuid": "dcc7aee8-6805-4a6e-9976-74ebdbb1a22f", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705047, "uuid": "95e655ce-8c4a-4fcb-bf79-27119a9abaed", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705047, "uuid": "354ff908-f5c7-4ea7-9007-12b8942e40c9", "value": "statistic-1153562382.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5421ef7-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659577, "uuid": "47473405-6d0a-405d-8f1e-151c011df8f6", "comment": "Malware payload (Quakbot)", "value": "cd5503784b2d3f35d5d1e0f29ddd2e46", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659577, "uuid": "89e125e2-b0bd-42f0-89f5-46145cfd5968", "comment": "Malware payload (Quakbot)", "value": "1a54b24d60adac7a2a9900e895d34f0d952154707bc85ddacddfa944ac67f38b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659577, "uuid": "d14ba8ca-9803-4071-9205-788127191301", "comment": "Malware payload (Quakbot)", "value": "401d3c58134f87cea46df3b29779afcd15d01faa", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659577, "uuid": "1b09405e-537c-4cbe-ad73-434646861e0e", "comment": "Malware payload (Quakbot)", "value": "67e4c1edff18f04b6ef6838888652076f50d5884bc677fc8cd4765cbc690b8060e4d8fd08a2dc7b1ac8c033c3da4c8d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659577, "uuid": "4dce5fa5-0999-42f5-ad92-b727737ced94", "value": "A474BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659577, "uuid": "369b2d88-d39e-4395-8013-e79e1823b9a5", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659577, "uuid": "e29b5ef3-1743-4b2a-9769-eca445dd101a", "value": "6144:hnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuw:+FrkNK11G9AEtMxQyOi6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659577, "uuid": "2f8e39d5-f1f4-4103-b56d-9c75321edc72", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659577, "uuid": "f82b0a71-b6ce-41a0-97c8-553ecf449cef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659577, "uuid": "e34bb2b6-3c16-4b07-8352-949771711b5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef815736-a905-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619712852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619712852, "uuid": "ed28be2c-5d1d-4cfe-8082-12a88d839415", "comment": "Malware payload (Quakbot)", "value": "422e4eba00b24dfde1a5f43055204385", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619712852, "uuid": "e5d2c177-b6ee-4c0a-94d0-67ee1cd4c71a", "comment": "Malware payload (Quakbot)", "value": "1a57dd305adb1ae4449a0baa9ee76a1b79477d7e7ad380319429f22fc9e96978", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619712852, "uuid": "7f04f5a5-95b3-4032-9f33-cac4adf15a4d", "comment": "Malware payload (Quakbot)", "value": "e58b71350e66213cb9c4f67b675d27a1bc5c0547", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619712852, "uuid": "68737132-68e9-4b76-987e-e0ae8e554883", "comment": "Malware payload (Quakbot)", "value": "6c5da53b5eeb69440a4b534d02e6966313c157434253f67b403f69f5fe0c7e15fc85298b1007b553a09763d370465a41", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619712852, "uuid": "e9c7d4a7-67b1-495c-b857-6b09aac09eaa", "value": "8C05AD707153C136D2726E35CD0AE5FD1A817C1AEF2A180B36D23FAFBB351614A36269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619712852, "uuid": "5dd7931a-b7e3-4621-8d0d-65372de84ead", "value": "826b8583e9b3c846c8b3c651780f2bd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619712852, "uuid": "b11a15d0-c885-422f-acde-6c85437c23ca", "value": "12288:l50YpKf2Y/wNB+hu8BF2Vk3No+xq7pZ/3F8tTdxcb/7Ry251RvZcCELcmRB3:l50cKF4LoxRyUCZx51RvGb4mRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619712852, "uuid": "e60aa104-2333-475e-bd0d-e001d3939f75", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619712852, "uuid": "f9f2f3c0-14d1-462b-980e-4744bd86d565", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619712852, "uuid": "18f0a298-018d-437f-b8bb-5823cae3596d", "value": "44313,6048108796.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111b3ec3-a8b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619677689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677689, "uuid": "b344f913-46e7-4dc8-9baa-8c24d6a071ef", "comment": "Malware payload (AgentTesla)", "value": "ddd4ff2e7648c71e8ae4f9adca0fe67a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677689, "uuid": "b64a7faf-a033-467c-a6a3-163621bdfa31", "comment": "Malware payload (AgentTesla)", "value": "1a5ab3fc479d127e6d2fc01ee7e6eaa2a76a682068e0e84f00edbaab2c77598c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677689, "uuid": "f8c2eba4-188a-4d5e-aef2-7d1f05f81589", "comment": "Malware payload (AgentTesla)", "value": "0bffeb93ede36d478fe276163a1177e5d68beb05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677689, "uuid": "ef20cc51-b2c0-47fc-852f-1b5a4db2c4a9", "comment": "Malware payload (AgentTesla)", "value": "f9b0544a9a3303da4e2426c4f694b25d0e962a54166d05fa4a38aefab593404983b72ef0e9619f4c7659c87ebc60118a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677689, "uuid": "f241699a-ceeb-496b-b719-98bdfd419d06", "value": "EA059B7953ECCA98E0A9493675935B1076FBAC02BE63FCACDCD464AC44326C43553E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677689, "uuid": "15404b93-edd8-4a46-9ce6-c72a001ba72b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677689, "uuid": "2d818b8f-71a5-4988-8c66-ffa2423d0b1b", "value": "24576:K1TpQ3xnWIJGff6cGsJUx2WdQRCh00YdKwt:KMVyhRJUxfdoCh09d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619677689, "uuid": "70bae4b0-04c1-47b3-b078-91a4796253e1", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619677689, "uuid": "bdee37c0-1356-453e-94bb-655a287fe867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677689, "uuid": "f3e0cea5-90a6-4ff8-9de7-90b37cdfcc38", "value": "DUE INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f1926c-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703608, "uuid": "69667161-b20f-4eba-b592-378e6d5f9653", "comment": "Malware payload", "value": "a5c2fa1fce535c6b2fdd69c80af3180a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703608, "uuid": "8278e858-5e72-4b78-9611-4717c146197b", "comment": "Malware payload", "value": "1a69390082045ef57f8edcb9a5dda015b69c30ca2563a7cecff1f41bc0be9549", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703608, "uuid": "35d20c3d-53dc-455f-a69c-aff88765fc01", "comment": "Malware payload", "value": "321439cd7cca2a113996546ad55bbf01d834e900", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703608, "uuid": "b8438aa6-8387-4a51-aa65-594022f4a115", "comment": "Malware payload", "value": "e3d2623c1faaa604cb180d5a617e256cbd5e5870da53e8178fe9bf02c0ecadfad555497158fc843dee9a3fb7a12a8dcc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703608, "uuid": "42a004b8-1fd5-402b-a27b-1c74f032bc74", "value": "C533022F485EB62A577C10F5C589CB1DE507689E382DC9825CCCB826EC097A9153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703608, "uuid": "3184fa6b-430f-4254-9f6c-b77c45fd5866", "value": "1536:UP6z4+ADViS8CWoD94pUnQ64x11RiC+CJY:SPZBiS8jopkUQ64xcCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703608, "uuid": "076dd120-df14-4c01-9704-1a0426f53c08", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703608, "uuid": "95efcea6-ffaf-4722-a631-a8e1d351c3bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703608, "uuid": "5771851d-f249-4264-a3c9-768c6a063169", "value": "diagram-2025317684.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b462eb-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705232, "uuid": "f56a99a4-93a0-479b-b52a-090df6c61f44", "comment": "Malware payload", "value": "9a89cecb25d74bc2a7e271b058b3f325", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705232, "uuid": "e5c47cad-0126-4d9a-af31-e1877cc65e63", "comment": "Malware payload", "value": "1a7a50e4d9853c5f427c53cbb3ec80ead0d08097eb7ea4c69f12bb7aca17ab70", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705232, "uuid": "7c3bd74f-eff3-4b75-86dd-1ae6d072bdf1", "comment": "Malware payload", "value": "da347ab0d38e5759a885acf50285af4635abfe9e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705232, "uuid": "62993315-5003-4fb1-82ed-cad201d36de0", "comment": "Malware payload", "value": "5dba1a04de01375bbc25325327de601fb5cb204c03dde8db518abb07455cb013b1f3955beb66a0399a04bba15358d444", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705232, "uuid": "07f54776-9b08-4c78-85f7-3d820b739443", "value": "A93301164C6E762E673D10B08686870ED65398DD786DC6050CDCF47AEC02AE6263FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705232, "uuid": "44f65111-e952-4329-998f-82ca1ace09c4", "value": "1536:2P6z4+ADViS8CWoD94pUnQ64x11RiCib+I:4PZBiS8jopkUQ64x4b+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705232, "uuid": "36036e90-3cea-44a5-b667-abdbe86af2d4", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705232, "uuid": "d4f39d90-deaf-4517-aa61-c08a560296bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705232, "uuid": "49febb88-11e5-4548-8319-143955c43d00", "value": "statistic-1301328285.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41041d56-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705687, "uuid": "1d89fd3b-4483-4334-99b3-e19b36d48039", "comment": "Malware payload", "value": "1847a281f60746cacf42c0864249418e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705687, "uuid": "6ee3bd80-44a1-40d4-96c6-9a668e9b8a6a", "comment": "Malware payload", "value": "1a8772b33b6e388762bb2e069867f8d1efb37ad6f8aaf9951db1afcba7fd887a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705687, "uuid": "b28c51af-ba80-462e-82e1-1672b270e89c", "comment": "Malware payload", "value": "d4375580b46e3c4b05226d58a581f8c2c3990870", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705687, "uuid": "5ee684dc-dcc2-4ba6-a642-e7c06f023e9b", "comment": "Malware payload", "value": "13fc4af96075e644386636f51c9a81f1bc1022a60d9730ae0d1930a90a57a70ff42288f4eff6a173cf331d5044e187ba", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705687, "uuid": "7ce48066-ba50-411b-9ed0-977aa3668536", "value": "CD3301268C7EB62D473E20F085849B1EE557789D782ECB405C9CB865EC092E5213FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705687, "uuid": "eb8f02fd-0d1f-4bce-9603-d2f202a5a772", "value": "1536:uP6z4+ADViS8CWoD94pUnQ64x11RiC9XS7ZK:wPZBiS8jopkUQ64xLXcZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705687, "uuid": "22ed4609-cc1b-4b02-b662-cbc97ae60e04", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705687, "uuid": "aa97fb73-8b59-4198-905b-8751d0ebdf6c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705687, "uuid": "217add9a-4177-47f9-9445-917d28ef16ab", "value": "statistic-1689173326.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38a9876-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702470, "uuid": "3940b5b4-0600-4670-99c2-28afeb0602ee", "comment": "Malware payload", "value": "7c229fb5af5ee7622647a2c1b6200ece", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702470, "uuid": "a0f02a5b-423a-436e-b123-4ad2b46f4bb9", "comment": "Malware payload", "value": "1a889873b7faf45a71cee2de4ffa532001ac4c05e49adf7586a8acc90be8ed5d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702470, "uuid": "84f5aa98-76f5-4297-a0b8-4f470b038315", "comment": "Malware payload", "value": "8b8061af76060006a2011978e5720e7f545010eb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702470, "uuid": "a5229f77-6acc-4a9e-bee1-e6c41d431267", "comment": "Malware payload", "value": "039bddb7923efcfc0ece447b65a84bdddea1f812452fa5ce95617b7bfb8122e322ca94a632f19e0fda73951853fa1e94", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702470, "uuid": "e2d963f0-e1a6-4c3f-a2bc-1e2e5e0a32e2", "value": "4033022E4D6E3629172E24F08549CB5EE513749D3C6EC5426C8CF4B9EC056AA023FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702470, "uuid": "c5fabc93-cf11-4f7d-afce-3fc566c8e48d", "value": "768:49cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCEh3:5P6z4+ADViS8CWoD94pUnQ64x11RiCY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702470, "uuid": "91725643-04f3-42b3-9dc6-8c7c13252ab8", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702470, "uuid": "e357e2fb-7805-4a59-b714-2b86e2e2d679", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702470, "uuid": "9dbe3654-198c-4353-a65b-0ce8a4052291", "value": "diagram-119109593.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfd6a36-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701843, "uuid": "2147e9af-02c5-431a-ae12-6d6f1d1976c5", "comment": "Malware payload", "value": "96cf20ebe7f64c087dac51cab5feef6e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701843, "uuid": "889a9724-73f2-4134-87f2-f2a95986a26b", "comment": "Malware payload", "value": "1a8db1ea1a4787d6089c6c6e566da0b6e9cccca56ade81439fe799cce1405831", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701843, "uuid": "71a92eca-c19a-4099-9535-8bb51f63e081", "comment": "Malware payload", "value": "bc2f0a941e6fd92a52f50ba56a3efdec4164718f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701843, "uuid": "3192528f-516e-48d5-a16a-859afbc85e99", "comment": "Malware payload", "value": "c9c66b453fece62b37a497e38c8a55afe97d6f590bd9f7636c1858f248cce66ec44762e33c5c32154684b9f2a4f11c5a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701843, "uuid": "3656bee9-caed-4771-8160-7f3b62e3e77b", "value": "EA33F2CCC6CDD33298F578309C79C702E578AAAF0816855181F74A9BBD07AE56B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701843, "uuid": "f5198387-c178-4488-9dec-c2295d4ccf14", "value": "768:awnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2v:HFugXVpoD8ZxhrLAuNS07MrxrKsYLO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701843, "uuid": "9933783a-d5c4-451f-9fdb-acacfadfb2d1", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701843, "uuid": "d2338088-217b-4c60-9a08-34f591e251c8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701843, "uuid": "3f16aaf6-81cb-4f88-993a-0ef3ba802e88", "value": "catalog-715513101.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82a67d3-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659582, "uuid": "859c4e48-deb6-4735-8a08-18d98c168a93", "comment": "Malware payload (Quakbot)", "value": "7eb3876c87d8e18bcbce5b2251a65fb7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659582, "uuid": "25bd176a-90b9-43dc-898b-79470f02bbe4", "comment": "Malware payload (Quakbot)", "value": "1a95b35ba024ee229bc916bb021c48b2b8d0dc2d9c380256e1759e954d095f67", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659582, "uuid": "0d3a2e29-e721-4963-a54c-eade82aa46e9", "comment": "Malware payload (Quakbot)", "value": "5df95cbdb62a1dba6bcea6e994d3bfdb72b9a13f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659582, "uuid": "5051802d-54d4-4c06-9ff0-eb296c2cb525", "comment": "Malware payload (Quakbot)", "value": "49496006e206c863907c8e84792d23e5a35e793e295778d34b7bdd1b9c17081905a6336158ff57d6503e623f62c311d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659582, "uuid": "ef4009aa-4152-4f36-8c66-509a6668e9ac", "value": "3574BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659582, "uuid": "cb8eca44-9621-47fe-a183-f930ceadf637", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659582, "uuid": "1ab3fd60-e895-4c79-bbd9-d0bcc5f9b71f", "value": "6144:qnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuU:FFrkNK11G9AEtMxQyOi6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659582, "uuid": "02c602b4-c5c9-4a73-a029-4948fc7a0634", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659582, "uuid": "9cd9ed46-d754-4e0c-9ac6-0fa9c0f84e04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659582, "uuid": "8d2be8d1-cc22-4ba6-8ef0-f869124ff2a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044ec5d7-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707303, "uuid": "e79b3cab-e114-49e3-bb08-ed1c6dfdf2c3", "comment": "Malware payload", "value": "449df8c9a8293e0dc87ae707dc44de52", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707303, "uuid": "85b0bac7-5f4f-481b-b668-e7cfdf23621e", "comment": "Malware payload", "value": "1ab00aa608c7579b94bf94a64600a7d8521c61e6c2338e53b276c9b03eba3c55", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707303, "uuid": "7724d80b-5def-4c88-aad1-e74d17a93315", "comment": "Malware payload", "value": "190ccb26e9700fa9532680d255cf9c6fdf88de14", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707303, "uuid": "0d0f7739-e067-464d-b72a-774c24ce761f", "comment": "Malware payload", "value": "7b46bb4792f4efa2eab8b50b8068ccefa8fb67ac24710fdbcbfaa15236156681195f3231a1e93ae77b4212c0e9d68d0c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707303, "uuid": "a95af95a-1bf6-4ea0-ae36-fd1e099c9b24", "value": "8F33021AAD6D762D933E24E08941972DD647689D387DC54218CCB4A6AC097AD023FFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707303, "uuid": "700b999e-0ff2-47a8-b381-94d63075ed58", "value": "1536:aP6z4+ADViS8CWoD94pUnQ64x11RiCRp8:0PZBiS8jopkUQ64x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707303, "uuid": "34d78bf2-9375-4e96-a40d-0bc460abe5f3", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707303, "uuid": "81a6dd3e-2a24-4d84-b73d-a10f0b8686d7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707303, "uuid": "cbbeda3d-1290-456e-a70d-8b2588bcb228", "value": "statistic-889974329.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6ca57e-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704743, "uuid": "00916baa-46a9-4cdb-925b-489b03f125e3", "comment": "Malware payload", "value": "c8b122343b31d0e577b0e8196d60fcea", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704743, "uuid": "ccbe12d9-6403-460c-adaa-839b2133f924", "comment": "Malware payload", "value": "1ac51950f96fcd771d33061417de1e334898bf33bfb99231dac32a1b10737453", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704743, "uuid": "794d1d0f-dabb-4eaf-96dc-a3750361e1d2", "comment": "Malware payload", "value": "3b4b020315f976fd267728f0326d0697d6cff235", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704743, "uuid": "8cf1877e-486c-4647-9802-f68b2290f3f6", "comment": "Malware payload", "value": "b56633af798820f80537f4d53ccc96d697be5f27023780d939db6b1ffbd233e52b219c68f5d08844934e3fa2e31eaec2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704743, "uuid": "1aca4429-9946-4283-a9f8-c99e9256f9e8", "value": "6833021A486EBA29173D20F44549CB5ED60764DD3CADCAC11CDCB46AEC066A5123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704743, "uuid": "4ae6fd0b-155f-4990-8edd-5e423c587e20", "value": "1536:6P6z4+ADViS8CWoD94pUnQ64x11RiC1z2:UPZBiS8jopkUQ64xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704743, "uuid": "0a541e80-703c-463d-8611-e24b4e8ec556", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704743, "uuid": "c0b906e8-e3b3-4648-a080-be5ded5c07c4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704743, "uuid": "9a321f06-1cf8-4619-8c7d-66cd29db6122", "value": "diagram-943078904.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4291a3fe-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702683, "uuid": "f5429f59-2188-4008-acfb-9ea93c118108", "comment": "Malware payload", "value": "6b097d2610a92688bdb25596864be3d1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702683, "uuid": "ad70718c-8c84-48a8-9c26-f26ae9e1f828", "comment": "Malware payload", "value": "1ad7a530445cbf371a417461e815fcd05e930ac368b71af840ed8be8feac6a51", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702683, "uuid": "9b402973-37ec-47f9-8298-ad252a9969dc", "comment": "Malware payload", "value": "f1be0b0af430c0b00c49a1075bdf8fc98aff75e1", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702683, "uuid": "38c2d0a4-f371-4c08-a810-2e5cf63f365e", "comment": "Malware payload", "value": "eb893b20fcca1349353877196710aa0d3ad5f44472ac14538bfb2a054fcbf952742ac238c2b86c0937a4c2698d0e831d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702683, "uuid": "441744e7-cf48-4919-b31a-dfcf8da91a8a", "value": "D033012B8DAE7A29573D10E48541CB5EE617689A3C1DC5406C8CF4B9EC0A3B9163F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702683, "uuid": "70d86e9d-c937-4f99-af64-acd2274677b3", "value": "1536:hP6z4+ADViS8CWoD94pUnQ64x11RiC5ZA:FPZBiS8jopkUQ64xxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702683, "uuid": "3d6a3e19-5e16-4798-8f21-bf59ead26248", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702683, "uuid": "14a1fadb-56e1-44c2-ac60-32da015f7d9f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702683, "uuid": "6d8634bf-8e3f-4f89-a25d-1c54823a6f5c", "value": "diagram-1387413204.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcb632c-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701652, "uuid": "7cc331b4-4efe-4427-afcb-f8f7773a5651", "comment": "Malware payload", "value": "1a403525db3121883e530b2b28b34104", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701652, "uuid": "0ede0fc1-d512-4864-93fb-6147d187ed48", "comment": "Malware payload", "value": "1af94937edda929e042163f37ac7f5844b094b8b30db801b0e7a1d23ca134b41", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701652, "uuid": "cc70f5a6-9f95-43fe-9f73-beb68ce1997e", "comment": "Malware payload", "value": "8ef2873c125b5833fb31797950659c76f5b7237b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701652, "uuid": "99753778-a4f5-439b-9495-a3971fa0bc54", "comment": "Malware payload", "value": "a4bc4ea194249dd49f376d6f7b65997e4bb03fa2b183f1388a1677a6e3d65f901ee347b008293a59ae980ceeb7ff1015", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701652, "uuid": "beb3cc58-a2fc-4dce-a083-7841fef66165", "value": "763302C8D6C9D232A8F574369C398B02D868BEAF4416C5A682F34AA77C0BE51174DDCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701652, "uuid": "3379de54-c33d-45bd-96d7-1b37e83b4178", "value": "768:LwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV25:KFugXVpoD8ZxhrLAuNS07MrxrKsYy6KQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701652, "uuid": "870c95dc-f487-45a1-be89-d9c0534303b6", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701652, "uuid": "e5e698a2-fd2d-4dab-a79c-a426ac2ffbe7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701652, "uuid": "d26b2252-dae4-448d-93cd-f0e522b12bb8", "value": "catalog-566685163.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb10c538-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659587, "uuid": "e3a61b7d-264c-4680-968d-5c5e6eaec111", "comment": "Malware payload (Quakbot)", "value": "191daa286b7b46a99130aa54d0f1c00b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659587, "uuid": "682f99c9-e631-454f-9047-99d513e43154", "comment": "Malware payload (Quakbot)", "value": "1b007485285ade1d5e18dd6be8be05c98c285959526ef10e23ddec14f9ea8f28", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659587, "uuid": "1e9cad52-9421-49a5-a635-2f25c0e5df61", "comment": "Malware payload (Quakbot)", "value": "6c642dfd39541737c8070a00f0f32a779a45809d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659587, "uuid": "09d89773-3222-49b0-b00e-5d79735a9454", "comment": "Malware payload (Quakbot)", "value": "65853b85202c01f0d8ad1723ea16489a7995aa119b5118e92f4e86e7ac71165200631a6315d02c3a61d06f55aed0a892", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659587, "uuid": "0496814e-bc44-4420-a4e0-5b41d173302d", "value": "03549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659587, "uuid": "baa6b49f-f84b-44d4-a47a-d0307f421818", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659587, "uuid": "d8c433e8-73ae-4453-b382-eb89b81fa4cf", "value": "3072:Y3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ4K:svv9sMoXBaRmr/dukbvuZ/7f7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659587, "uuid": "bc2633bf-dbd7-4cf1-a759-be4a5d54a8b1", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659587, "uuid": "e30befc0-051b-43ca-b00b-ed29f8ef5863", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659587, "uuid": "9f48258f-c5ab-4017-8f32-144174fcb923", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46e2c94-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705451, "uuid": "b0c34dd0-d705-4213-af81-8b809236fa1a", "comment": "Malware payload", "value": "5f9e818de85ba429adab22fc0a14e686", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705451, "uuid": "d1bc26da-30ea-40ab-80aa-967d16163b63", "comment": "Malware payload", "value": "1b066b5be466ae51dbf58a0a72367fad4c053fb41596b8a9f5e31c398354db82", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705451, "uuid": "94c31c1f-a2b9-4e08-a5d9-a2b3f73261d9", "comment": "Malware payload", "value": "f84196ed4d8bd3b439f31a4682b15dc85df4f9d7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705451, "uuid": "b0e41887-6e39-4927-941c-5bf8892ef31a", "comment": "Malware payload", "value": "af35f54cb9e79d5c69df689a4989b4cbd3da3d0a86f35e14dd3786e753326921e462f83f3c8d0bf6b6280c3f9496bceb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705451, "uuid": "70028475-8ea5-4815-81bb-ea247d6240d5", "value": "7A33122A986EB536577D10F984848B4DE50758AD38ADC5812C9CF075EC093E8227FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705451, "uuid": "8bf6a6c8-5bed-4108-b13d-bdaac70beffc", "value": "768:A9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpQw:hP6z4+ADViS8CWoD94pUnQ64x11RiCyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705451, "uuid": "671ff5b2-daae-4439-8b7c-01df41fc93c2", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705451, "uuid": "1062b7d1-2494-4026-acb8-688fda5d7b70", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705451, "uuid": "baf07167-6236-4580-8b9b-0ac33d5c4dd4", "value": "statistic-1506813628.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a6f09b-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706181, "uuid": "2ce757b9-7ef4-478b-8dc2-3c4b2b9727c7", "comment": "Malware payload", "value": "e8c788980099f2cceb78eb2f830d54e2", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706181, "uuid": "fa6bfba1-8ad3-4d6a-991b-a1aa2794e8d7", "comment": "Malware payload", "value": "1b08d23cae284e2c23ae62dc90e1333cbf4dd2f267fa7d4056f6ff2327867721", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706181, "uuid": "be84c2da-b77d-4c02-bfaa-e16ce5ca018c", "comment": "Malware payload", "value": "300a7befd385c98ebc1efc78867dca4049f88248", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706181, "uuid": "169006d7-2dfc-4eea-96f1-cb578b8586c1", "comment": "Malware payload", "value": "173550cec38dba24c72266fb75f1673851bd6ce46d1bf0e1ebe5b871f71a06d22a936b9a16c46c851036ded6646a5ebc", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706181, "uuid": "1e1c79b8-179e-491f-992c-ce98fa7ec269", "value": "0633021A5C9E362E572E14B08944CB1DE65764AD38ADCA812C9CF476FC057D8223FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706181, "uuid": "eca4cb33-aa1e-4eb0-ab03-59d621c69722", "value": "768:p9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpRX:cP6z4+ADViS8CWoD94pUnQ64x11RiCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706181, "uuid": "5e66dece-f411-477e-afd6-4a3b0187d6e1", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706181, "uuid": "a4c2c3e3-81be-4ad1-8b0a-93e479c65d25", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706181, "uuid": "8d821424-4aa0-4b49-881c-c7a06f3c0f19", "value": "statistic-2097254039.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3bbd5a-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706994, "uuid": "790a01db-f2bf-4588-93de-dd2024458a4e", "comment": "Malware payload", "value": "06e2af103897abcb60c9eebc236fbee7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706994, "uuid": "72e47257-0cd9-4886-a407-6ae6ceb99a7e", "comment": "Malware payload", "value": "1b137c1b317bb4818e9cf400d6c09564925c351552f5d5f9aab0fead0d580f89", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706994, "uuid": "6ffd4b36-a446-4e6f-9f60-4a7bea4e50cc", "comment": "Malware payload", "value": "3fa10dd17f5cd4fa3a3098bf8a1594d1b4f82033", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706994, "uuid": "9c91c25b-c0eb-4a8b-a247-416034347a5e", "comment": "Malware payload", "value": "54ceaaaddffd500fb84df883468e5911d2964065c946e12ca8dc776b7ca4a22b8ecb08ddc8fe8bc3bb2d6ba6f75dbf21", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706994, "uuid": "8466d5ae-b255-4a0e-9def-2196a9d49f5e", "value": "BB33022A987E762D973E10B44588DB0EE54769DD786CC2811CDCF4BABC056A9023FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706994, "uuid": "fa061015-81cf-4503-ab61-6442a714efe7", "value": "1536:eP6z4+ADViS8CWoD94pUnQ64x11RiC5ZZz:APZBiS8jopkUQ64xnZZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706994, "uuid": "222a86ff-8a34-4099-a217-61cc6b99bdc1", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706994, "uuid": "ae37dd42-abec-4451-875b-97ceb3c4096f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706994, "uuid": "dda02244-fba1-4c13-8277-03f73e541721", "value": "statistic-667003275.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905a78a5-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700666, "uuid": "630537c0-8327-4c50-a958-55e66ce5db35", "comment": "Malware payload", "value": "6e0bf32e907aca87fa936baf65cb162f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700666, "uuid": "11737240-47ca-4c33-8f7e-a0ede9d205a7", "comment": "Malware payload", "value": "1b17057eb40f3217e74ade09f6d8fb30bef123c7e769c3299ef6c9ea3c31beac", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700666, "uuid": "5ab43e31-8de4-46d3-ae4c-3feeb27e77e0", "comment": "Malware payload", "value": "3672227c9392c374df3680f3ecdb09d361efdf6f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700666, "uuid": "2c07bc0d-d24d-448a-82cd-39ea259fcdf6", "comment": "Malware payload", "value": "f645f0ee055b009770ff469764c0fd3cd64df8c5bc2a1f5c564e4fd65679491ed61401c62df85c820ba2954adcde8ae2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700666, "uuid": "89f3cdcb-8076-416f-a303-9e99a64e3123", "value": "103302C8C6CDE271A8F634316C79CB01D668B96B581BD46181F38AEB7C03E95174ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700666, "uuid": "30a248f0-7221-4031-89a3-f0a3a00c8aad", "value": "768:/wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2k:2FugXVpoD8ZxhrLAuNS07MrxrKsYv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700666, "uuid": "c507b2cc-2c5b-41f6-b615-1bdf9d743f0f", "value": 51498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700666, "uuid": "5fb3f474-461f-4e82-8ac5-1e794dd35ee2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700666, "uuid": "f041d4a6-404b-458e-a02f-2a33741e8162", "value": "catalog-1715787495.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd03d40-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659591, "uuid": "7c80a634-4294-4c6e-9c2d-7878856d57fb", "comment": "Malware payload (QuakBot)", "value": "b98c464959549a800fbeca90fe8e2d66", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659591, "uuid": "3df0989b-c4c8-4572-98a1-e2d0f9bc1fd5", "comment": "Malware payload (QuakBot)", "value": "1b296b22ba525b874a298d1e27386a2b4f7cf54fa21fb7b6c76506e62dfc9f30", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659591, "uuid": "80dcdfe3-f28e-4a74-80ad-7894d2e68137", "comment": "Malware payload (QuakBot)", "value": "dc495d993bc5911bd2ee5759fc2156ea04abe797", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659591, "uuid": "9df323e1-303d-4d60-bc60-25cda4161bdf", "comment": "Malware payload (QuakBot)", "value": "3e42e66da1d0602bcde4dda1bdf4b9076d3bb108f8ea94424403a23a472ca9af62d3b19b2e8deec456b42ebf96027726", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659591, "uuid": "b711549f-331a-46a8-8481-e9a74e0482aa", "value": "FB74B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659591, "uuid": "44201053-54db-44c0-9b05-8f9b77d1c27e", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659591, "uuid": "43c9fe66-cd5a-44e9-b338-9ebbbd48c29c", "value": "6144:fTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRun:fbi7/xZrkNK11G9AQyOi6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659591, "uuid": "334d2c75-8a3a-4419-b31a-122f7082e3ad", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659591, "uuid": "c4edeb1b-6e4c-4ced-8b84-5bf0ea492d07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659591, "uuid": "5255bc4e-2867-49d4-b703-93a87104269c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681b9fbd-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699740, "uuid": "8dc3e034-8ba9-4e08-a4cc-66e871009ea8", "comment": "Malware payload", "value": "0cf178758ba2ba2df778ecc79d77ad3e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699740, "uuid": "07150904-5282-4875-a1b2-5be68c3677d0", "comment": "Malware payload", "value": "1b3233fa55951829078f6cb7081ec81145b996a5f92c49336eb867bfea7496b0", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699740, "uuid": "8dae30ac-cc75-4c80-9899-405738e6db4d", "comment": "Malware payload", "value": "ea2d9c1f7b86ba369bf2a894b0557d450cb42484", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699740, "uuid": "509c75be-11f1-4bb9-ab79-73f346ae457d", "comment": "Malware payload", "value": "78669ecf978f10d42bbbe0b959c74b60f6d27109cd7ba814926ae9a4535736a8929e4509f960afb519b59a2d73dc28ac", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699740, "uuid": "078294b8-b909-4d7e-ba15-f7f43381af71", "value": "93330288D68CD332A4FA35355C7ECA01E9BCAA9B4416C56281F78ADB7C07D941B4BDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699740, "uuid": "95b64db7-5164-485a-91b1-da339f251a21", "value": "768:bwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2j:aFugXVpoD8ZxhrLAuNS07MrxrKsYMFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699740, "uuid": "6c1dbd17-ae29-430a-9f76-d8ae07aec918", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699740, "uuid": "d9efe1eb-8016-4d30-b7b5-4844533403cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699740, "uuid": "c336ad41-c1ad-490d-a11b-122d25fa11fd", "value": "catalog-1004622916.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0bba14-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701221, "uuid": "40323b45-11d2-49ca-834a-61a2e9d4cf37", "comment": "Malware payload", "value": "a4940820e381a28290059d13664cf5e5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701221, "uuid": "6d6ec4aa-e14c-480d-9375-c173cd2ec6ca", "comment": "Malware payload", "value": "1b35a3ba67da43a8d4bf5d40cce467f20ab852f40bc1c9820d515eb89f68b789", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701221, "uuid": "9cb8221d-2ea3-4545-a67a-e933574e83ff", "comment": "Malware payload", "value": "38e1122b6a8ca388518bc627dbc034bec79555a3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701221, "uuid": "0a89e458-fd38-49fd-8674-628ab14aba60", "comment": "Malware payload", "value": "5a08cc6778592d6478253481d800cf41c12a24d1891cd21f56c9c6df04734bc5b6ee8bf3e1e1f3cb6e2f9a9ae5230fa3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701221, "uuid": "75975d73-16ea-43a5-8167-e917579e7f90", "value": "E233F1C8C5C9D372A8F678319875C701D478EAAF4817C96282F786D77C07EA4274A9CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701221, "uuid": "4c6ce006-7251-4c8f-bf2e-3bdfbc99ab37", "value": "1536:BFugXVpoD8ZxhrLAuNS07MrxrKsYoR+Pmy:hq41rLZNkZLY+++y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701221, "uuid": "ee50afb5-8f22-4917-a1ed-6ca6f47976b6", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701221, "uuid": "4e9e5f19-6185-4186-9545-a4fc646e10dc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701221, "uuid": "9deeb85f-0b0d-4491-a372-2f754ff5acc3", "value": "catalog-231408979.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efd2e22-a896-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619664801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619664801, "uuid": "1c5c0f95-144f-4ad4-91ed-0464ab3fa858", "comment": "Malware payload (Dridex)", "value": "ad56786f049eed5ab7cf5af71e09f5d8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619664801, "uuid": "8e6e71c2-581c-4c74-8e42-106aa324e13b", "comment": "Malware payload (Dridex)", "value": "1b402d219f100598aef47ccb13c169f5c1764326578ca41c6405fd46174d952f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619664801, "uuid": "de8383d2-cf01-468d-92de-17ed1db35648", "comment": "Malware payload (Dridex)", "value": "239449c5d4db782f03e2eb2b5feb7c1e360a0089", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619664801, "uuid": "da527086-c21c-457d-801c-248ad3502a7e", "comment": "Malware payload (Dridex)", "value": "45dc284b1b32313f8a67f4e3235cbc1406ee021edba50532e13d7544690d0cf75edaa8a1bf097732575e9adb1be1ef17", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619664801, "uuid": "e9a38db6-ab8a-4e90-8bf9-0d2dc77c1503", "value": "99F3D091F25FE2CADC4618340139F77265FD89109B34CC75D61483AEEC879E29BAE89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619664801, "uuid": "a22ce43d-f4b7-4eb2-a740-a00bdf4bfe0a", "value": "b84fd50f2389cfd5bd83e2cf062986d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619664801, "uuid": "b5e47cef-65f1-4a43-bdc8-a39b5896c0f3", "value": "3072:IWX2IjzzpM+PncPeY8+O3AU3HRIHPh3UGfXy0BHNkIv/ScbQQ2y0iNM0+y+N0tc:I42IfzNPnoeY8j3AsHGPXpHNj6rByM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619664801, "uuid": "8382e192-7232-4a45-87ae-f401b5efe686", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619664801, "uuid": "529d5a42-ae06-4551-ac8e-e1ca3df662e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619664801, "uuid": "0c8f7841-7160-4c93-80cd-85ea8f03fb55", "value": "ad56786f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55daad37-a8a7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619672221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672221, "uuid": "37b57866-6ecb-4886-bd15-b4fbb2838d8d", "comment": "Malware payload (Dridex)", "value": "0ba774f15e5f65c4cb5d2824c1c2f440", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672221, "uuid": "d393f915-0b27-4b55-8564-f992ef97a142", "comment": "Malware payload (Dridex)", "value": "1b4e19abe87226e70892af08282a95a5e455f5575547a3bc6b43e7271059974f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672221, "uuid": "2373cfcf-a097-4f81-82d3-b0f59ff1cef0", "comment": "Malware payload (Dridex)", "value": "f41954f2fb8b5075f995490f457a9bcbe441b62d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619672221, "uuid": "a13a29d5-d764-471a-b1aa-6e6fcd8a5b90", "comment": "Malware payload (Dridex)", "value": "8a06cb84756387214861b6d28c5827d73909c38cf7745e35447fb8cd23cfb2c3bbd33d613701ab3c8486ffefa84e291f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672221, "uuid": "57b51271-edd0-4070-a810-6a92469c6f81", "value": "BFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672221, "uuid": "212314b4-8f19-4f54-8ac2-3319dca6e6b2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672221, "uuid": "145f279b-1691-4cde-9fa9-44c336b9d419", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619672221, "uuid": "3e00f518-f57e-4216-9bf9-c9a3a7d7b54e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619672221, "uuid": "3a6064ce-3b73-4eee-9680-086f1f28c07d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619672221, "uuid": "98a9630b-b61f-4234-8dad-e29c6d15a794", "value": "0ba774f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe473534-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619660048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619660048, "uuid": "5a786881-7279-4572-b1c4-0e94a510b113", "comment": "Malware payload", "value": "8ab07993aa4c3db71b44d0552950bd17", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619660048, "uuid": "364a9c56-f9f8-4894-8089-2d9c19db920a", "comment": "Malware payload", "value": "1b532832ecfcffe61f3e7a27c31d95d111b349471bde171afb3751c74d424841", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619660048, "uuid": "4effb8dd-b16b-4a08-8781-343787c65d6b", "comment": "Malware payload", "value": "3e7d90ead707b7b66dc044c53218a92661ad3ebe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619660048, "uuid": "09e0356e-2f30-4c05-9f43-982d7a542210", "comment": "Malware payload", "value": "8ebc014640e54351f81d5ace82c9985b749199bae3382ca3174a95660fd667c0885a641e1c3ee27ae6bf1a42e6efeecf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619660048, "uuid": "6c52b888-2248-4453-a31c-f203af98ee8a", "value": "E1A66C12F69350ECC926C174865BA332B532FC651630ADBF2284FB352F76E901A1EF65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619660048, "uuid": "607b5d48-1f05-4c6c-bc42-addc795a0e17", "value": "196608:jXiZYhXiNsoYrOWsVD7yktOz44JyktOg1:jXiSXiq2D+ktJ4Mktp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619660048, "uuid": "f2ed5371-4b22-4f5f-909d-88ab6c48b4fa", "value": 10074800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619660048, "uuid": "757bebc7-47b1-41aa-bff6-8dbc2fd1a019", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619660048, "uuid": "709bbfbd-4c25-460f-95bc-1b9349cd7130", "value": "wget.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8900e213-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706237, "uuid": "ba78d330-1941-451d-a07b-477a62b6edb1", "comment": "Malware payload", "value": "f2aa3475bea05f7aa8006085a892831d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706237, "uuid": "aae48e81-ddda-4806-a291-9b767ebe913b", "comment": "Malware payload", "value": "1b54bbadeec14f3109a621395fbd1cb160543c0d8b7eae8ef58f39047e3895e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706237, "uuid": "6ac8da0e-fdb1-4c76-93ca-561615a020b8", "comment": "Malware payload", "value": "cc873f12e7ad8adb4f1a271733e8c7d7a40988a2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706237, "uuid": "08ea6924-a816-4bcf-bc95-c76b9d9abccf", "comment": "Malware payload", "value": "d6d6cea0bb8ffaabad3c25f2a366aa66c265f34327e4075770fd57e6caa5e1f73f82e1988b6ac1ebcd1b4fe494304752", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706237, "uuid": "c0b7573e-5850-47bb-af3d-dce5630e9989", "value": "4C33011A581EBA3E532E20F041899B2DE6172C9D386DC6455CCCB8B6EC016F8117F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706237, "uuid": "9e916056-5911-4501-82d9-16ceb21df82b", "value": "768:k9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCZ/Y:dP6z4+ADViS8CWoD94pUnQ64x11RiCdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706237, "uuid": "c2b50e9a-68ad-4efc-b3ed-6884cef74c78", "value": 51489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706237, "uuid": "0d0b3373-1741-4c20-9373-192c5195d12d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706237, "uuid": "48d9a1e0-9eb0-43f0-86b9-7832d9e66560", "value": "statistic-2145230398.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dee6ad7-a8db-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619694649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694649, "uuid": "369f2130-b1fe-4876-85b1-cc8f803de1aa", "comment": "Malware payload (Dridex)", "value": "e8c6c06f2f9e8aa8831be605d2798ba5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694649, "uuid": "8080eebf-a60f-43b9-a92b-85f3f7a7a362", "comment": "Malware payload (Dridex)", "value": "1b61a49d3d17fc1fb1bc89aee2f0ac25bd86449f57b03a1b8584b7463eb2188a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694649, "uuid": "8e536626-6bc4-465c-9086-55bf25371174", "comment": "Malware payload (Dridex)", "value": "030592afa1221f35a6471eabd55b973be5417d44", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619694649, "uuid": "df2ad44f-3692-4222-9f9e-d8f3b3dfac01", "comment": "Malware payload (Dridex)", "value": "52f8dd134319f0c45385df5a36f606e333210fc0e3974f659c0361495a16f83cb724b4a92013678372b7243ac328db1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694649, "uuid": "669ec3a3-bde1-4218-93c6-d78a99ce637f", "value": "F7F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694649, "uuid": "8ff13dbc-84c9-42e1-80c7-e8df945a4e7c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694649, "uuid": "6a7d410e-607c-43b7-8928-85e4fef8da95", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619694649, "uuid": "2c2cf740-6e27-408d-9417-13aaa98633c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619694649, "uuid": "778b51ae-8217-4b59-95fe-c2555c4fb7a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619694649, "uuid": "23fbb188-3c5a-41c5-ba3a-26869b1b682d", "value": "e8c6c06f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5412fda1-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703572, "uuid": "e92fa8cd-a7d6-426e-ad6a-d62615a16f42", "comment": "Malware payload", "value": "515ad3a05b5ed979e884881e5854b9d6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703572, "uuid": "a4db595c-2248-4534-b5ef-06ef30aa69aa", "comment": "Malware payload", "value": "1b8173b56143cae451ba84038d08c0c8837cc107a83d203c42052dfc44f6914f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703572, "uuid": "f938f089-fa5c-47c8-8519-e3c303803374", "comment": "Malware payload", "value": "9fa1974691acff46bd9179596ae077c9aa32fa43", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703572, "uuid": "4ed99703-9c7d-4db5-b905-b0551f5f72fc", "comment": "Malware payload", "value": "c9abb06818acf97f34b03d57549c06cea0e2d133b85eb3b2ede8769f9494ab9a604bff9adb6da1385676df29cd7791d7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703572, "uuid": "6ce034b9-73a1-4227-b3e4-a27a706586fb", "value": "F433023A486EBB2E577D20B44544C71EE517A4DE386DC9922C9CB876FC056A0223FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703572, "uuid": "d638735e-3e9b-414e-821b-3bc34ac9fdea", "value": "1536:GP6z4+ADViS8CWoD94pUnQ64x11RiCRG8vPX7:oPZBiS8jopkUQ64xHGuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703572, "uuid": "60d3b503-b9a5-412a-ac6b-15900ad13811", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703572, "uuid": "0352bc10-7ca1-4320-9568-2b4ab9f5ef72", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703572, "uuid": "d1813e17-6acc-4984-9434-2ea6f5388548", "value": "diagram-1999940323.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27ed0a9-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700777, "uuid": "781a6925-8507-44b4-853d-5175442b0ae0", "comment": "Malware payload", "value": "d56e28270d9a349689d396ff8f5c9237", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700777, "uuid": "b115231a-0a3f-438f-b646-49d0c1bd80fb", "comment": "Malware payload", "value": "1b82c4d1d241144eb66ab918f2f94be7fb2fdf2c6b6eb222b9935c6acc583030", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700777, "uuid": "cbacc6e2-3feb-44fb-9228-cb97bd60dd1b", "comment": "Malware payload", "value": "c8601622737878a3540c3e325dd1e63b076c7747", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700777, "uuid": "4677406d-2cdf-4694-9b17-406588a99d26", "comment": "Malware payload", "value": "94971a2682b440d6f30ce5005dea3c0b89f166d8a1ea4df98e17e5b3be6959f939b9862e81e6497eb1cf100cbeea78f1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700777, "uuid": "5a4cbffb-90f5-4c87-b2a2-3dfcf04c3104", "value": "20330188CAC9E331D8F57431AC798B02E478AAAB441BC96581F787A37E06DD1174ADDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700777, "uuid": "a880c46f-d0bf-4334-8a7e-8cb1c61fbff5", "value": "768:NwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2S:sFugXVpoD8ZxhrLAuNS07MrxrKsYUJzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700777, "uuid": "a3d7115e-c841-4fe1-80ab-6da64696a476", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700777, "uuid": "fa5e7829-4fb2-4af2-ba80-6f96b0118f04", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700777, "uuid": "cabdc15c-aba1-48fc-8b65-892d2873785e", "value": "catalog-1816731839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c825ac49-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705055, "uuid": "b3f862d7-9cf5-4e17-b131-a08f1e38b46b", "comment": "Malware payload", "value": "e5eaab96a3788f49c71557c156e3e27b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705055, "uuid": "bb0212b5-dca6-49f2-ab6a-7a4551411a23", "comment": "Malware payload", "value": "1b966f5365c2a1fe8be7fb5d5594c1197b04349dff2962a1641b4afebe2d8ccf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705055, "uuid": "161712a4-0f34-44b1-b104-964901f07a07", "comment": "Malware payload", "value": "ae7241f3fc0bbd5a772eab0d5722198a93bb70d9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705055, "uuid": "ffa27ab7-eac4-4d0f-b608-4d7d52724d24", "comment": "Malware payload", "value": "553fdc0d094d3f2d75543d0e7ca4d004b5438700d8b86ebdf16537142f321fec8875eaef5570b38f2ffc637808c56b72", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705055, "uuid": "1c68393d-f2e9-4e3a-8098-2ef6491b3ebb", "value": "6933022E98AEB629473D10B084498B4EE657189D386EC2921CDCF5B6DC017EC153F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705055, "uuid": "e7a7fe8a-4f10-4e29-a586-6e7a95b66d24", "value": "1536:JP6z4+ADViS8CWoD94pUnQ64x11RiCFiPv5:tPZBiS8jopkUQ64xOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705055, "uuid": "9841d461-f05f-4044-9a4c-ffc26732348d", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705055, "uuid": "815f01d1-67d0-4b04-a3ec-4cfb62e192d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705055, "uuid": "b329f5ee-6d4b-4558-8f90-7010f31b7a38", "value": "statistic-1159654166.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1db92ab-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705527, "uuid": "a791d750-1316-4fb0-ab47-6d7bdefbfc27", "comment": "Malware payload", "value": "229a03f9b4784f1a92447c4abaf4e56d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705527, "uuid": "3af82068-3cd8-4281-88b6-f128112b4551", "comment": "Malware payload", "value": "1ba897be2f43948ded01587711877b2e1f45cd869ad5d221a2ff3948beca0bdf", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705527, "uuid": "c23d5f20-33a8-45c9-808a-acc51f183fa6", "comment": "Malware payload", "value": "229f12074afa70f496e958ea3176468b6756887e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705527, "uuid": "ea8dc049-a7d7-4360-8f5d-0f9f8a3fdc14", "comment": "Malware payload", "value": "8f7a5aa54fa084c583716dcaf066fa87bcb3f465e6dc95ba72a8be7ab6e986139df39cf6b295d28a0585ce8686c6001f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705527, "uuid": "a5ae0e4e-6414-4435-952c-4918de151473", "value": "3833022A586EB629473D10B084498B4EE667189D38AEC2921CDCF5B6EC017EC153F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705527, "uuid": "4170594f-1ead-4440-a034-496fb4e85004", "value": "1536:GP6z4+ADViS8CWoD94pUnQ64x11RiCFMPve:oPZBiS8jopkUQ64xEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705527, "uuid": "5577383d-d0f5-4b8d-8c1a-ca76bc0b4c6b", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705527, "uuid": "0b195a8e-dd80-4e5e-808c-681b2cf46dd1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705527, "uuid": "5a0962f1-1c48-4349-b7c6-e2b69b443c7f", "value": "statistic-1568435784.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f090b7c9-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659596, "uuid": "e9083592-ebd2-4316-b35b-33f7d2cfac2d", "comment": "Malware payload (QuakBot)", "value": "3da30b667373ec059be4330562479cba", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659596, "uuid": "9fadfd4c-61c2-4147-92ba-95742d701ea6", "comment": "Malware payload (QuakBot)", "value": "1bc184c860d2db778b92464f1323a793c3a14c67f68ccda030ba75bbffbcd6db", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659596, "uuid": "03679966-fdb0-4c16-b13f-7d9353b971a3", "comment": "Malware payload (QuakBot)", "value": "41bbcc5a260ac979b79d558bcd06953af70ff864", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659596, "uuid": "1f516d0f-86a7-49e8-a56d-d8679c43bcdc", "comment": "Malware payload (QuakBot)", "value": "373079a0ebca70f1fc24bc8e1e35e9436f4224a6ce92d3e9f15964e25d930f6df02fcae80dbd9c54c7affdc6ff573123", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659596, "uuid": "a71faf89-5f5c-40b5-b05f-12ebbb2ba8f1", "value": "70549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659596, "uuid": "6b0b0ed7-9f37-40c6-acba-3f58572f4b32", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659596, "uuid": "b6caec0c-6d58-4944-9a96-24e3f782cf8f", "value": "3072:o3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZv8:cvv9sMoXBaRmr/dukbvuZ/7f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659596, "uuid": "47922812-aad9-487d-a881-20343c5b2cc4", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659596, "uuid": "95a19099-7575-4be4-b70d-bdce53a6e834", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659596, "uuid": "a767b50d-bd43-4bf7-942b-1d064d025102", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49089d23-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702265, "uuid": "39de8b8a-9bee-4da2-92f4-6fcc4f927d59", "comment": "Malware payload", "value": "76c614cb3cb3a369595d32d057c661e8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702265, "uuid": "f371d123-c87f-42fb-99b1-ff9325f9719a", "comment": "Malware payload", "value": "1bc2b8c99fe64fa58bbdcd4543006e2916565c508c181eabc737b3bdf5735723", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702265, "uuid": "3bf0214e-4fbc-4a14-b724-f3e31a11d9b5", "comment": "Malware payload", "value": "6474d0641b89a764792493d619c2cf024b81af15", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702265, "uuid": "3901184e-55a4-4a96-9e85-72b0204df7b4", "comment": "Malware payload", "value": "4a2e163259cd1cb3a4eff90b5476f9d600a38a4305444038b6d8b05775bfee0b8281f853674499c7ed881c81a9b0cca8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702265, "uuid": "d916a154-5087-438b-a167-82a436b41245", "value": "1133012A4C6EB639072E10F08549D72EE61768DE385DC9812CDCB467DC06AB8013F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702265, "uuid": "a618ca9b-fbb9-4b85-9047-dad010b332fc", "value": "1536:EP6z4+ADViS8CWoD94pUnQ64x11RiCQeN:iPZBiS8jopkUQ64xzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702265, "uuid": "dff45f91-84eb-486b-b002-921bbb9412a5", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702265, "uuid": "3a3d4697-8760-4f0e-a6be-2b81f1895778", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702265, "uuid": "1120f916-353f-4494-bdd5-8129fbedcd7a", "value": "diagram-1024244861.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7883fc36-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701485, "uuid": "0c58dc09-ce4e-4ffb-95f8-975ee24e83bf", "comment": "Malware payload", "value": "ccbf0b96defc8e17a8f95a0ea51f3dd1", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701485, "uuid": "7a05b4da-2b5c-410c-a7df-e5a9fb593242", "comment": "Malware payload", "value": "1bc37c93e282014b7274ed3fc89cd8ab1223cb12201330e0b23ac12ea88293f4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701485, "uuid": "dc2e1a6b-8bcc-4fec-8b9a-6332d67ec36d", "comment": "Malware payload", "value": "c8025facdf0853975bef110987e78a38c9fa62b2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701485, "uuid": "06ad0993-1b2a-4e96-b214-6b71affc77ec", "comment": "Malware payload", "value": "725ce737bec6a78662d1d4037af61c1ae455af8ef97d796cd04dbb8342a140dfde22b6372e045836df6ac921e0a6c1d4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701485, "uuid": "ceb73c64-4f51-4a8c-87df-bf7055c9091c", "value": "6633F2CCC6CDD332A4F578319C79C702E578AAAF0816956181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701485, "uuid": "68bce9b0-65d5-4f52-b904-0ffde384cdd8", "value": "768:8wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2A:RFugXVpoD8ZxhrLAuNS07MrxrKsYqOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701485, "uuid": "f1a75f23-c284-4c8f-93ae-5d500ec4df64", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701485, "uuid": "2ab65fb3-17dd-4fee-8807-dae4b14ad18c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701485, "uuid": "e4bedd24-0b5d-4deb-a8b7-091aed4a5ee6", "value": "catalog-418073422.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e5cafc-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707274, "uuid": "4137e4c6-9d4e-4335-8e2b-2ef984ca4508", "comment": "Malware payload", "value": "20d493982c61f712ccdf60e638b81c05", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707274, "uuid": "03a1f6bf-8d5f-4593-aa34-77692839ad37", "comment": "Malware payload", "value": "1bd5876155967b920b1188ea8077334b01455ee7848fc84a569bff8e81d49007", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707274, "uuid": "89e10db5-70e4-45ad-9720-0ed3b0d787b6", "comment": "Malware payload", "value": "abd3b3c4cfb4bc31798022b4fc674a0afc777e1a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707274, "uuid": "dcad14e2-6a62-496e-adc5-80cfc759e52d", "comment": "Malware payload", "value": "4943ef686d3c7cdf785036844a3b8617061838b3db3e3bfd62e864404b4b1d6d52e55b68ac5bfba4a9cff5923ef53681", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707274, "uuid": "1bbcdfac-e5cb-4675-ba3e-2d0903136f62", "value": "A133021958DEB629532D20F04681DB4EE9536CAA3C6DC9416CCCF8B9EC091A4127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707274, "uuid": "a386a139-d480-44dd-8002-21d724d1852e", "value": "1536:wP6z4+ADViS8CWoD94pUnQ64x11RiCOa+Z:GPZBiS8jopkUQ64xf+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707274, "uuid": "580150e9-5b7e-49a4-b054-8abcbadffc62", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707274, "uuid": "9ba5ec46-a5fc-4e4f-99fc-52281b486f33", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707274, "uuid": "9f225914-b110-4ef4-bf9f-caa1675602af", "value": "statistic-855584050.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28b796d-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1619700831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700831, "uuid": "cbb4f6c9-bf95-4f64-8c8f-817b267004ad", "comment": "Malware payload (Formbook)", "value": "6ce7604bee4507ff4b529aba899a8d23", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700831, "uuid": "bd879ba5-b5e5-4239-9338-94f013ac8479", "comment": "Malware payload (Formbook)", "value": "1bdabfc2816493441e618186ef5c4a2129591b61dc5075909bd6c0e72995078e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700831, "uuid": "af23d055-fb60-4a56-9c31-ff0077546e0a", "comment": "Malware payload (Formbook)", "value": "6fd7d2697d1e03096f394b7501231cdf94ec8cb6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700831, "uuid": "c5e43351-5f34-4314-85bf-0410a25dffaf", "comment": "Malware payload (Formbook)", "value": "3d6c9907b56cf25e54d9c3bf949078c0a41cd11a58eb91d487186c9efca145a676356c9202674be87f9a51c32fc6aac6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700831, "uuid": "e1080f2d-9c7a-47e4-89e2-238306706fa6", "value": "B6553355FAEA8303D8766975892EE4385A59FC00420AAC1736BD37087879FB1B7C335B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700831, "uuid": "a3863796-de30-4567-ac36-8741f7352818", "value": "24576:i2gI/TsxGFsp3tQ+zniH1rO+0jHZ8MRKRTPp/LoWlCAXUS3+nNQslj7/pk1tCdQH:PpTvFslt3iVKbYRTRDoyCAXUS3+nNQsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700831, "uuid": "f069472c-1853-4313-bbe5-f90539639bfd", "value": 1400320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700831, "uuid": "8d5f7966-9614-48cd-aa1d-9226be44098e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700831, "uuid": "0a95cc60-6834-46ed-a007-c35925fde230", "value": "PO20210429.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c406b090-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701612, "uuid": "16a9e9c7-ff39-42f2-b49a-9229820829bb", "comment": "Malware payload", "value": "a5801621f682cec857eb272ba7078d4a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701612, "uuid": "68d29d06-eeeb-4e55-970e-bd066a4d0b03", "comment": "Malware payload", "value": "1bdbde6b49136ffb41474a3e7da3a93486d80493b255b500601e76845e97325e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701612, "uuid": "a56872b3-5a97-44cb-86ce-f5088bd59f11", "comment": "Malware payload", "value": "7d202bbe01f257aacffa8dfb35c541fe298b26f6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701612, "uuid": "dfe0469c-6dbd-450e-8272-7b5c28d26284", "comment": "Malware payload", "value": "8036f63be0215266473010d821e30231464e8621213091052181f4c8516834c97a50d7a7130704adc1618879ae175f4a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701612, "uuid": "e7d09066-ce5a-4b3d-ad00-a028366705ab", "value": "D5330188D6C8E37298FA74725C7ACF02E9BCE65A4816845181F78ADB7903CE1174BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701612, "uuid": "1606ac06-3f6e-482a-ae56-6e36b5a05abe", "value": "768:gwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2i:9FugXVpoD8ZxhrLAuNS07MrxrKsY64C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701612, "uuid": "80934455-405c-4638-9b1a-5faa49ceaf26", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701612, "uuid": "8d72e7ae-e737-423f-aef3-049a84ab951c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701612, "uuid": "76ef9b39-ef57-47c1-a75b-ce10aacba6c7", "value": "catalog-521661608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f351295c-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659601, "uuid": "d4f400f7-26e3-4cef-b3db-63e89c4298d1", "comment": "Malware payload (QuakBot)", "value": "b13f9ad8a35493dd64d92d6091304385", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659601, "uuid": "40c1ef9b-9486-4818-9689-4aef2e842d9f", "comment": "Malware payload (QuakBot)", "value": "1bf066c7936f57c94ad7f6f58b8349e479ca3652dce158a009d640710093e98c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659601, "uuid": "9d87be92-3f95-4cad-b2a0-249335258418", "comment": "Malware payload (QuakBot)", "value": "1f65a4bbf93a945fd0482f666759326544cd7cf7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659601, "uuid": "d56e04fc-72db-483e-9e01-32c159e1c9b5", "comment": "Malware payload (QuakBot)", "value": "2031c8712d6f2895eb2f4d537e3984efe455e386f4cc0548764896113632944ba95c706b29f6bd2751577f49f34300fa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659601, "uuid": "6ce0fe49-df2c-4601-b55e-581b227f53ed", "value": "E8549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659601, "uuid": "ba11f6a7-9559-45d4-b336-d86683bdf747", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659601, "uuid": "17b8fd9a-c887-445a-a919-213765760f72", "value": "3072:V3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZRl:Fvv9sMoXBaRmr/dukbvuZ/7fZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659601, "uuid": "a83ceeed-916e-4320-a815-062dbb624467", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659601, "uuid": "3e5256a2-4abc-4228-9706-63835721869a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659601, "uuid": "1c7b90d3-19c8-4935-bba3-f12a8afd96a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af25cee2-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702865, "uuid": "a946a2e1-fa62-4567-9c49-7ca622088736", "comment": "Malware payload", "value": "dd2603a11b387ec90ae66ad026274b99", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702865, "uuid": "1dd77120-ccb5-49c7-96e5-04eac65436f0", "comment": "Malware payload", "value": "1c0c921f7007df0ae5415dcbc628a636fedd0069d59ae92d1664cfc4449c07e1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702865, "uuid": "eb03f2b3-5161-45cf-b41b-6e32847c9107", "comment": "Malware payload", "value": "81c1245efd8ec087ee0c8893620819ec9f78eb64", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702865, "uuid": "534679e5-f748-4174-8f78-7f40b7b58706", "comment": "Malware payload", "value": "6158abd86825e71f0971aafb25ac7e67b4efd889492b5178cf2b3aee9c89294e863085f7b1b5d02044664c994b465001", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702865, "uuid": "6f2e1152-bdcf-4473-873e-a8bb74b5c42a", "value": "C733021A4C6EBA29133D20F44449DB5EDA0764DD38ADCAC11CDCB46AEC05695163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702865, "uuid": "05b3132a-4107-41db-be06-1c0878e02d56", "value": "1536:pP6z4+ADViS8CWoD94pUnQ64x11RiCS2H:NPZBiS8jopkUQ64x9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702865, "uuid": "d4f9c969-aa71-4e16-b17f-39ac5191c1ef", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702865, "uuid": "479a0bff-2a49-42f6-9841-0c6cad5862c1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702865, "uuid": "f583f039-7354-4d4f-b2d0-f5163ead24dd", "value": "diagram-151117339.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6138539-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659605, "uuid": "f333914c-a1a3-4fd6-834a-249082f590b3", "comment": "Malware payload (QuakBot)", "value": "b7d34e3e3222b8a64da1554d64d1b155", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659605, "uuid": "71e7403c-c151-426b-8f27-bfe3d967a9f4", "comment": "Malware payload (QuakBot)", "value": "1c1c6e96ff820d2912a677a99af5d8a5869ef777529af78bb9c032f048a7be0d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659605, "uuid": "b409ed25-5555-44e8-8389-2e5458987195", "comment": "Malware payload (QuakBot)", "value": "123db3fbcb53a5771b61761a41c54b6a0f95f37d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659605, "uuid": "745a6c1f-e9f9-40ff-b628-7667e958c0e6", "comment": "Malware payload (QuakBot)", "value": "8b11115039a87a1711944fdfe51b6af6e67c20cfb516c91a690df8e8da9b341b8b877320fbb5307d937bd7712021cf9b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659605, "uuid": "8e6b0a18-0945-4b34-b7d9-1efd9ae697bf", "value": "3B549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F587EEA3883D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659605, "uuid": "17795ca7-07a4-4a2c-8135-5b29f5d3ba1b", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659605, "uuid": "b8884191-27e9-44f6-b358-57a6e5117743", "value": "3072:n3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ35V:3vv9sMoXBaRmr/dukbvuZ/7fTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659605, "uuid": "db8be1cc-0997-49cc-82b8-3e5ad1df2c85", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659605, "uuid": "b6c47722-24ef-4401-8a4c-239ca4c62b32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659605, "uuid": "00bb88ee-3acd-4732-a094-34458b526522", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67c1580-a8f3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705025, "uuid": "81ef7f43-d745-4441-8577-01a5df658034", "comment": "Malware payload", "value": "7ef9ccb62a21d915265c8c4eb29c742e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705025, "uuid": "0113acc1-04ce-45da-b230-fc5b58f52791", "comment": "Malware payload", "value": "1c332ec7fe8d9ec8bd2f0244c1e2ac73fffa6663d66b3151e0704f305905a477", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705025, "uuid": "817142b3-45d3-4fba-8291-12669aeaa69f", "comment": "Malware payload", "value": "5ef5d329dfe39bc193c74d1f825e607ccc4bd522", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705025, "uuid": "a07f7c3e-d382-4efd-8b00-e0d2b91715e9", "comment": "Malware payload", "value": "150b25a708f5b0354fb256ba61d2bafbdcd7c69680b897d85c88285ac471298933834324252ac387e84b749d4bce870a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705025, "uuid": "4a30e043-1361-4e78-9f27-e2db33fb8a2a", "value": "5533022A5CAEB629932E04B48588DB5FE50364AE387DC151589CB0B5EC063E9077F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705025, "uuid": "96431c0e-d57c-46be-827c-ef6d16f82eaf", "value": "1536:mP6z4+ADViS8CWoD94pUnQ64x11RiCY+8:IPZBiS8jopkUQ64xq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705025, "uuid": "d2ceaafd-c77d-4bab-9f0c-ab5e5be3f59b", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705025, "uuid": "616e59d7-365f-4694-8fa8-8617e5cf0a7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705025, "uuid": "70c04d57-0435-4f11-827d-6b44c8aef8c6", "value": "statistic-114168816.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f45dbd-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659610, "uuid": "8d30a376-e4a1-4344-9dcc-19140239c32d", "comment": "Malware payload (Quakbot)", "value": "9c82fd8292e565b0bf4d9a3c633f5963", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659610, "uuid": "fc5bd383-38e0-4673-8e47-2179d05e8a3f", "comment": "Malware payload (Quakbot)", "value": "1c3b8ceb73e15a5eab0dda72b0617f5ba668bcdd7311a03c0edda6bd822f3c68", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659610, "uuid": "a0368fd5-f7aa-4d54-879a-217743e6ecf0", "comment": "Malware payload (Quakbot)", "value": "30b8e8fc89e5e7648b91278b7d146829ee489b68", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659610, "uuid": "1ca8dfef-b4f8-411e-ab09-e9fc6602d961", "comment": "Malware payload (Quakbot)", "value": "9bfcee6aad5c8dff851c3c20286a90de02417d91f07429421a211bd4191cf17507231e67b9fe10282f34becccc4d7391", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659610, "uuid": "d2ac20b5-08dc-4a51-9d77-533a3cd50eb1", "value": "FE74BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659610, "uuid": "e05491b9-d5b7-440e-842d-31f991bd7bca", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659610, "uuid": "19be1e9d-4726-4fc5-a786-b3abd4866aa3", "value": "6144:O9nQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuF:TFrkNK11G9AEtMxQyOi62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659610, "uuid": "0067bfe0-6a1c-4f36-ab7e-09040442a907", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659610, "uuid": "5d186bd5-8383-4dba-8caa-63f3ff5ab38e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659610, "uuid": "06cad55d-1918-4a33-aee9-88675a899328", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ef5f8a-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705177, "uuid": "945a0922-dbcb-4f44-aaa2-23e5044f1303", "comment": "Malware payload", "value": "db06a2c62f9febef2d135decacea65c4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705177, "uuid": "bde36e20-19ec-4975-9b5d-49aba31ab029", "comment": "Malware payload", "value": "1c3c9c80b38c3ad73bd06f62eafb7f38c8b89706a4b24fda7bf06bdcff5b3821", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705177, "uuid": "cf9aa02d-66ac-4ed8-97be-f78db3f9c336", "comment": "Malware payload", "value": "11b1bf70dcf8b52a87f9cff26cced0a993420bd0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705177, "uuid": "0ebe4d62-2439-45bd-99a3-c810384213a2", "comment": "Malware payload", "value": "5611e3d379b63015bd51d762ad93e2376973c3cf0feb0558b7f412bcd52e61da86056d25eb9b1bd1aea0f55d743ed006", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705177, "uuid": "8664e17f-e42b-4ada-b887-1d7bdef8a405", "value": "4333122A4C1D772E976D10F00A859B9EE51368DD3C6CCA42589CB4B6FC056E9073EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705177, "uuid": "57abcadf-b239-4a3e-9d63-369539b7081d", "value": "1536:lP6z4+ADViS8CWoD94pUnQ64x11RiCStJzWmf:RPZBiS8jopkUQ64xAWmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705177, "uuid": "fd88bf51-6773-4e2d-9c28-b9846b9405b3", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705177, "uuid": "2390e8fa-e412-4d29-95e5-abb6a7be8704", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705177, "uuid": "2f6016f5-0033-46ed-876d-68d8f19903ee", "value": "statistic-1254250034.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "705fd2e9-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703190, "uuid": "2c7ec748-d469-411f-93d3-9c68ab59a4b4", "comment": "Malware payload", "value": "94e65bdc636011c438000337b7b26d0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703190, "uuid": "c0712129-59a3-4e1e-9c6a-393956317111", "comment": "Malware payload", "value": "1c4fdbcc50346d841abdeb90533c2e5907dc01b4c5e166dab9a328135358a7be", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703190, "uuid": "8b474fbe-6db8-4157-8165-7dac798baa4e", "comment": "Malware payload", "value": "4567c1b1b3aa3ef80f96f994cb3cf1b05377b5ba", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703190, "uuid": "9926203a-14cc-41fa-a1cd-fcdfa76a3fb9", "comment": "Malware payload", "value": "2e5fb076c8983b8a73e0cef16776d551352567081912671253c0e5e0a68f75409246ff87597825825c9067f0ec466554", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703190, "uuid": "251b0a4f-032c-435c-afd6-bdf024a0fd1e", "value": "7633022A496E762C173C20F0868AD71EE51768DE346DD9421CCCF47ADC016AA113FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703190, "uuid": "372d32b7-ff14-4068-aaaa-8281cfd24972", "value": "1536:rP6z4+ADViS8CWoD94pUnQ64x11RiC2ssa4j:7PZBiS8jopkUQ64x94j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703190, "uuid": "ba51aa33-7f3f-4ca6-a089-97b8679d6aeb", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703190, "uuid": "b7e622cb-7b64-4fbe-9b45-6598d24b8713", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703190, "uuid": "07dead2f-4a65-4d5c-8ce7-91b5c760f0c0", "value": "diagram-1797062606.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e7939f-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706657, "uuid": "2b12077b-bc9a-43fd-874f-4c170b51e5bd", "comment": "Malware payload", "value": "a16b31d239a17dcca92f83235232faed", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706657, "uuid": "810e609a-0b53-4828-960c-6c6fef2d7029", "comment": "Malware payload", "value": "1c55b78b0efa50ee03742619ffa8cc072d571a28a7654bb3efc892e896e0641e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706657, "uuid": "4db85a79-e2e6-4c92-baff-68b91e969883", "comment": "Malware payload", "value": "aba60ff996c98f66930cb9fe9b99605d94bd4314", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706657, "uuid": "990ae78d-ee73-462f-8f30-7ffa6d4a0e4a", "comment": "Malware payload", "value": "154d0f65b4d3d2609f0f6832550d81ef498b99532bbebeca0328a277961d1f3e17e42fd0cfa2d6ae030d9bf5c6de2d5f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706657, "uuid": "85717298-00ce-48d1-b6af-cb2c869f7b30", "value": "E333021998EE7629572D20F085819B4ED9536CEA3C6DC9416CCCF8B9EC092A4127FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706657, "uuid": "2adc2ecb-b519-41f9-8de0-ff65a28d31ae", "value": "1536:wP6z4+ADViS8CWoD94pUnQ64x11RiCJa+z:GPZBiS8jopkUQ64xi+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706657, "uuid": "c6758b26-0195-4204-ac73-9097a4edba93", "value": 51484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706657, "uuid": "9f2d2d48-de21-4df6-9daf-33596fa5934c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706657, "uuid": "5c5a8eb4-1cc4-4a44-82bf-0cb1f7b7d45f", "value": "statistic-49796217.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dee285-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702451, "uuid": "4482f1b7-513b-4710-90d1-62e6349ad79a", "comment": "Malware payload", "value": "9321c2240405658d51ba54b9a288633d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702451, "uuid": "45d797b6-76a6-478d-b712-503d92da869d", "comment": "Malware payload", "value": "1c70fe39aa64beb56ae1ee845e68b469c78dc0c9b48c2d69db48ebf383fccd69", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702451, "uuid": "113115bd-77d5-4686-b7b0-9985f2264209", "comment": "Malware payload", "value": "32604a6db4ae4390d7649862a8dd2a9dc69ccf58", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702451, "uuid": "e19cdf56-0b42-412b-bf06-b718add08a05", "comment": "Malware payload", "value": "2d208d9b3f3f39cd3f20a541495a5b3cfb25eb4d08ca02affdda1cc2384a9d000541f8c2839746a591007147a598edaa", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702451, "uuid": "758fa18e-ae2c-40bf-8cb7-c4f03d2444fd", "value": "5E33021A8CAD7639533D10F049849B5ED217789E3C1D86822CDCF46AEC01AAD163FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702451, "uuid": "86e89743-8348-4925-9165-2fa6e910461c", "value": "1536:xP6z4+ADViS8CWoD94pUnQ64x11RiCBKhmP:1PZBiS8jopkUQ64xuoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702451, "uuid": "4ddbcdb2-c2d4-4c22-8df0-b8eeefc50e43", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702451, "uuid": "b6327c96-72ba-4966-8ad5-bd716561a17d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702451, "uuid": "40088614-7352-480e-9883-6f338697f8ec", "value": "diagram-1174303961.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb7d04f-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659615, "uuid": "a2f59b14-efa8-4ef2-8cc4-53aaa055d674", "comment": "Malware payload (Quakbot)", "value": "0352fb525ba9af1a82782373f6a5cdc0", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659615, "uuid": "c1ea6d20-2cbf-4431-b02b-96d79d3ad718", "comment": "Malware payload (Quakbot)", "value": "1c710bddbf3ba0e36ba94611695293df76e21c6561b1130730a7ee09983ff62d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659615, "uuid": "63c7cfdd-e88f-41b3-ad4a-122f61b74f22", "comment": "Malware payload (Quakbot)", "value": "be1069047130e7ed78584adacd80e81a583aa0dd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659615, "uuid": "3629ceab-fff5-438d-858c-caff46c7ab61", "comment": "Malware payload (Quakbot)", "value": "1ae25859ee5de83875f3b80df88819c1e8db01389ce91350a6e4f578c232bc8ae7cfadc5671695bafec236448a47d62c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659615, "uuid": "d89c5be1-e6f5-461f-8ffa-8930708fbf9e", "value": "AF449E7EBE12DC23E25C2BB056C35B581A6BAAD53254210E1AB15F186CEB3947C37F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659615, "uuid": "144956ce-2237-4074-9bb0-10acbc3f5a86", "value": "6fc91e135f967218c3d36d0b14484e5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659615, "uuid": "cc1af60c-8c64-4ae0-8120-dff9cb2583a4", "value": "6144:jwxqaEeZ4POyKmLrLqGvHr0nNK11G9DFC:kHEnxZrkNK11G95C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659615, "uuid": "e15bc0f9-e3e9-4eb0-861b-648b2bdc822a", "value": 266728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659615, "uuid": "340ddb3d-56c8-40b9-96b9-1c37cdc94b6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659615, "uuid": "01bb26a8-45ee-410f-a067-9e9b80c26bcb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b06933c-a8f1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703959, "uuid": "d9d80396-8191-4f25-aa51-0a7c67af014f", "comment": "Malware payload", "value": "4bfd56fa304a216ca722928e05bccdc5", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703959, "uuid": "5486b62d-15bb-4268-b12e-e7e58f915d2e", "comment": "Malware payload", "value": "1c7ff22894fc0ce9e37db9e54fbf61f4752140f152ae9fdd1cbb59886e36ceda", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703959, "uuid": "21838d02-954b-41cf-a50f-de272f0b5a64", "comment": "Malware payload", "value": "4eb42be9f1d6aeadb551b36774652131f9e8badb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703959, "uuid": "32969b95-7ca6-49b7-9083-d356f2750968", "comment": "Malware payload", "value": "f414c3b29b514ec5b321268440ecafef801131521c3f6366906d746b4bae9965d12d2bfdb378f6ece05c08eb13b4a9a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703959, "uuid": "8eae9aea-b1ec-4535-8ced-253aaa63fa81", "value": "A333021A486EBA29133D20F40849DB5EDA0764DD38ADCAC11CDCB479EC057A5123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703959, "uuid": "2c96729f-3667-4e2a-9a64-10e954bf09ca", "value": "1536:wP6z4+ADViS8CWoD94pUnQ64x11RiCRFl:GPZBiS8jopkUQ64xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703959, "uuid": "3e1e4b6f-51eb-4185-8fe4-2b93bdacf405", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703959, "uuid": "036eb17a-1d39-42be-8147-4477c3b4e519", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703959, "uuid": "106f6ed1-baf0-46c0-a585-ae5cbadc3cfd", "value": "diagram-375420493.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227a7a98-a937-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619733983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733983, "uuid": "a4a3d480-6442-4eef-9aae-d6bcc1412b42", "comment": "Malware payload", "value": "a640b8f680e204cf50322c33b208fe72", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733983, "uuid": "ef8bd143-9949-4f80-8770-4ef41233c404", "comment": "Malware payload", "value": "1c81493d83568d9ea04dfe407ab6e44c2b235d9f61982fcca3ab4f584bb12a51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733983, "uuid": "4dc41323-6ef3-4dbd-8482-f069675fe7e1", "comment": "Malware payload", "value": "db53fd75e891f909ec2edb097366e367a79af83a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619733983, "uuid": "3455b039-0399-4557-83d5-6f6f55260163", "comment": "Malware payload", "value": "6fac958271aa541e3749e005222634f5ea1c37c29aa290c6a04d3321eaa2d2f805a72d456132901249af342919918277", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733983, "uuid": "2bac21b3-ced7-4b56-9eb9-19e8e5c16db3", "value": "57F3CF82D702C1ADFE212C7A28E677753D9833905E54CA68E2088F3D5BD35C60DED2AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733983, "uuid": "94a92f4e-5312-482d-8a39-1e96929126e3", "value": "ba4e0256194238dc7d8ad773f3a0bf13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733983, "uuid": "1ae25be1-1cf4-40af-9c7d-b44ce1d8ef32", "value": "3072:QO5RgjZh7gpk57/MbVelsxoNTen1v/HuxbIXU89J3WgMh8gH6:R52j4pk5zMbVO6/HUIXU8KgMyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619733983, "uuid": "03305236-bbc8-469e-93d2-bc42f99d876a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619733983, "uuid": "914b96b2-30b4-4b6e-a80a-04cb14c1cbda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619733983, "uuid": "d4310ef5-e91c-4cb0-8035-4bbbcb0439a4", "value": "a640b8f6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b71756-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707124, "uuid": "5b773712-7cb8-4036-8e48-9ea47c22116b", "comment": "Malware payload", "value": "b83274851bd343e80d10e4dd0b8bff99", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707124, "uuid": "8f9fb3ec-12e0-47e1-89a2-da360d8388ef", "comment": "Malware payload", "value": "1c9407f0fb2c4df0d9d477aae40a66e84a7ae96958f8336971236932fff11bd9", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707124, "uuid": "9e2accda-024f-4150-a20b-0dc12a46f9b8", "comment": "Malware payload", "value": "8a32b6735961d1fa2ab935d5e8d6646cc08c8af5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707124, "uuid": "ce26e408-5dff-43a5-ad8c-730f05016d4c", "comment": "Malware payload", "value": "562849d27a4f22f554c1bc6bcd0160f51dd100470a516d52e7ca4acab33a09645e91a947a17d1419f5e64f8433ad693d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707124, "uuid": "14ac19f2-a9a9-4a47-8ba8-84af5bcc6ca8", "value": "2333020958AEB72D532D24B886858B5EE503A9D9341EC5450CDCF066EC066ED123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707124, "uuid": "9949a39e-fea1-4c03-b6e9-ca2ca4035b11", "value": "768:n9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCB:yP6z4+ADViS8CWoD94pUnQ64x11RiCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707124, "uuid": "6d8b2d9d-7f41-48ef-a55e-53ce7b2f3fef", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707124, "uuid": "e074ea12-1f2f-425d-b5da-d495c5b18468", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707124, "uuid": "a6eb3887-18d7-46a5-a1ae-92db78aac2c2", "value": "statistic-767062388.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a27e05-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702794, "uuid": "181fb161-3c4d-491e-bd08-905d756979c4", "comment": "Malware payload", "value": "136f37ab1a8178e74be6f11e73af65ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702794, "uuid": "0c5f6343-2b53-401e-9b32-fcb2776dcbfe", "comment": "Malware payload", "value": "1c9c82603e63b7cb667f8d07044232c24972d60b94d230274a573e00f970e69b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702794, "uuid": "89262d3e-a67b-4b3f-a5ba-ef83ed94fd0a", "comment": "Malware payload", "value": "9d05bccee4e5674c484949506859d2cdb7e82201", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702794, "uuid": "7f4f57b9-6a1c-45ac-aa48-c83664dea641", "comment": "Malware payload", "value": "7377c1978d50657c04582c7655c8011331afb2b8306cea39dae907aac9be019462aa13531000533bdd1423fbad70202d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702794, "uuid": "d7e5aa59-7331-4927-99ad-f90922cf8b28", "value": "2D33022A4D6EBA29172D20F0C588C74EE64B689D387DC5D15C8CB476EC0679A023FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702794, "uuid": "b3cc0df9-d301-4ab1-9d79-e17ab12a8168", "value": "1536:/P6z4+ADViS8CWoD94pUnQ64x11RiCrtA:nPZBiS8jopkUQ64xt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702794, "uuid": "fd438e37-121b-4c6e-94be-b0c0b31a7844", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702794, "uuid": "83d45bd8-5686-4c3c-b103-42f386f75a1a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702794, "uuid": "5ead9b19-b687-43f0-b352-47807164ea2e", "value": "diagram-1459242640.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8627cd46-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702367, "uuid": "5ec450a7-890e-4328-88b6-c2d5eca08361", "comment": "Malware payload", "value": "45f98b6fb33ca5876a17ad8f9927de66", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702367, "uuid": "c2ad3878-243c-4950-a7b1-3a02a5ca6e1c", "comment": "Malware payload", "value": "1ca6f9d12d1125db3dd017891d3e74c0104df9f698dd5ca6ca2af41e9ec5adc3", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702367, "uuid": "46ffc49e-e8b7-431f-a878-7081354b0c6e", "comment": "Malware payload", "value": "93335feaff358c6f3ba7cdd66dde77b110a08c30", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702367, "uuid": "1d7f2f9e-1914-4c0c-b462-5442874be51e", "comment": "Malware payload", "value": "e9bfb11bfd660fd4e1c2c3070566e85aa8470a762c0a014ec3dc2a05cc1a6644aa2a6600aab465ea8a21a508184fbbfb", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702367, "uuid": "c58c2e56-1f2f-4583-864d-b17a041e35b7", "value": "BC33022B8CAD762E036E10F1498D871EE61724D93C6CC5C22C8CB4A6EC05665167FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702367, "uuid": "2a3cab42-622d-4fed-9859-aa2c999d87f7", "value": "1536:6P6z4+ADViS8CWoD94pUnQ64x11RiC2pwe:UPZBiS8jopkUQ64xEpwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702367, "uuid": "2728d036-aa15-4288-a0b5-086edb20696f", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702367, "uuid": "f098d58f-2e36-4f73-ac1c-3767d973e2b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702367, "uuid": "3665fa42-2bec-4f96-811c-df251c37890a", "value": "diagram-1096227041.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9ab6c5-a889-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659620, "uuid": "362e8fbe-3ebd-4587-9178-5b17daf34d2b", "comment": "Malware payload (Quakbot)", "value": "360526e92235ae72b244a81a59a54fe6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659620, "uuid": "80f449eb-614b-457c-af86-6a1a1ffb805a", "comment": "Malware payload (Quakbot)", "value": "1cc2629d1713b50b01c962fe7597da1fe70a2c0c02adbac4217e0063ac729f9f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659620, "uuid": "7b5fd685-3d55-4f0b-a57d-34dc0a313065", "comment": "Malware payload (Quakbot)", "value": "b8d2d110962dcfee3d871669b8d4337c659d500a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659620, "uuid": "7ac4fd73-c8cc-4e9f-b8a8-d34fd9cfb151", "comment": "Malware payload (Quakbot)", "value": "02d6fff0cd80055544f137058fe2ef66197b342f8680e164ad9208019cd0d135c723a2fbda59990b4ee1b7f79164b078", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659620, "uuid": "858bae07-35d1-4031-a469-d7bf441f1322", "value": "AA74B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659620, "uuid": "edc468d8-0c50-436f-884c-6141ee2684dc", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659620, "uuid": "51190d5f-1873-4ede-ae95-71bc8309e80b", "value": "6144:rTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRu3:rbi7/xZrkNK11G9AQyOi6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659620, "uuid": "973aafd1-c311-424e-a391-45b780869a14", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659620, "uuid": "5fa47368-cef6-4f52-9183-af7356ab150a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659620, "uuid": "406f4480-fa40-40ec-bc12-357c7c2df775", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d05651-a8f8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707115, "uuid": "5f19f4f1-3f4f-4738-b86b-1e63cf9b9ea4", "comment": "Malware payload", "value": "26e5bdad55b49d8a0f3096a304ac239c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707115, "uuid": "85ca0470-5f7d-4162-9ffd-1deb24bef6a9", "comment": "Malware payload", "value": "1cd1524978b51698018a0a1a3bdda11848216b9b1d7c83911c19d9a445ca5fc1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707115, "uuid": "45618daf-b41d-42b0-bb1b-7ccc61956525", "comment": "Malware payload", "value": "b62bf132045243f79d570f3fa70800439a91ca2c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707115, "uuid": "c335407e-bf51-4d7e-8f4d-fe6559c4f438", "comment": "Malware payload", "value": "7af16dc0162252ec7e540e26a69cde5880b5fd0550023fe97e6b1dfd35cb8fdbe55d8cbfb4574840f103d4062896db28", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707115, "uuid": "353002fc-4ab9-4ec1-bef7-d4a528f48d23", "value": "20330229986E7A2A473E30E085858F5EE55768DD3C6DC6815C88F4B1EC493EA023F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707115, "uuid": "5229a14f-607b-4258-9e75-71778ba2dc20", "value": "1536:EP6z4+ADViS8CWoD94pUnQ64x11RiCh+EMe7a7:iPZBiS8jopkUQ64x6EMkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707115, "uuid": "cbff2177-ceee-4102-9728-de0f4fc6c817", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707115, "uuid": "852d1175-c916-4aca-8306-b7fd4b360eea", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707115, "uuid": "c84ac97d-427b-4acc-a4fb-e5495b28fde4", "value": "statistic-764846170.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01600335-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659624, "uuid": "38cfeeab-feeb-406e-9f7a-09d6dfe36880", "comment": "Malware payload (Quakbot)", "value": "585955905aabf3144fbe827ad3938963", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659624, "uuid": "9ff70206-4275-4732-b7ed-62460e35d15c", "comment": "Malware payload (Quakbot)", "value": "1cee588ac27205e0ae16ca30ee02986872e60c27fa437610649c2b39568f8550", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659624, "uuid": "32d690ce-dd9c-4325-89c9-8f11d375b7f6", "comment": "Malware payload (Quakbot)", "value": "f9b767a8cb2d98fc2e0ccffd04fda097578edf42", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659624, "uuid": "2fb444eb-6407-4baf-b2b3-a0bdb3825194", "comment": "Malware payload (Quakbot)", "value": "a99601d850bbc139998edab8a9a00108079a82200c2e447420de08040a8e90237f62f5fa84441aadce7a9395c0af8735", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659624, "uuid": "cf34fec3-d2e3-4a97-91ee-66e0318c236f", "value": "F874BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659624, "uuid": "68024d93-29e5-4e1e-bf86-ee0877dccaed", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659624, "uuid": "2ec11773-4f72-4297-b08a-fbffd575c46c", "value": "6144:tnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuu:SFrkNK11G9AEtMxQyOi6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659624, "uuid": "17d80c12-aa1b-4564-823d-8989be26cd79", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659624, "uuid": "9591e4f9-0383-41c0-b570-984b600c8051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659624, "uuid": "740feb03-4cdd-4cc7-8b78-85c86430de3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1a0463-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701275, "uuid": "3ef1ffac-ec44-47e6-b24a-4fc2ba5a4e7f", "comment": "Malware payload", "value": "0df8c6b9ddc03788da81a052c018a2c6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701275, "uuid": "e7f31d07-c68b-48da-aad9-c1924f4df144", "comment": "Malware payload", "value": "1d00c62ef2eadd2d104017438bbf3aba5d8bc02e4c9fc7992effc3fe78ad4273", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701275, "uuid": "72913c67-af50-4ae0-96af-451eb10c4c1d", "comment": "Malware payload", "value": "3f636a5163412a203abee96f810284bdab5e3aec", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701275, "uuid": "d1120f16-ed56-4afa-b2fd-14087c64e62c", "comment": "Malware payload", "value": "2f81a013440a4e264797df2da4a145b16d92c1303b06c744f0710fd26c74842374cf4b28f2f8f98b8ee474fae1bb725e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701275, "uuid": "9df8bde1-25ce-4359-bc82-56fede1c9ab3", "value": "EC33F28CC6CDD33294F578309C79CB02D578AAAB441A8551C1F74A9BBC07AE56B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701275, "uuid": "20710e33-45bb-44ab-b8f3-7e8ee295cefc", "value": "768:gwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2Q:9FugXVpoD8ZxhrLAuNS07MrxrKsYDOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701275, "uuid": "331f6900-2965-4d90-9ed9-5577623cc55b", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701275, "uuid": "a47d9bcf-1b86-4634-a32c-070a2c053133", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701275, "uuid": "ebc9bc1e-6a0e-4163-b955-c65fefc571b1", "value": "catalog-264042429.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a4994d-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700804, "uuid": "f02447bf-4293-4b0f-a982-b0c885f8ce49", "comment": "Malware payload", "value": "3cfa99a481d44e5db231caab0ec9d1ff", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700804, "uuid": "76a34ff2-dcd9-454f-87e0-52d1e8f6e265", "comment": "Malware payload", "value": "1d0389e74a2475fab47c7e6295ac14586e7adf97b7134d6d9f926c4a130e15c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700804, "uuid": "d7cbc863-84d6-4de4-9099-3e7b5197ef37", "comment": "Malware payload", "value": "def1cadd355342ee5f431cd21e55dd24a411587c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700804, "uuid": "760ff4f9-cf72-4291-a234-eeb36b0a957d", "comment": "Malware payload", "value": "bf323263775ca795d6687c76a6601d7d7f2e2fc80846fc7408451d70725b34d07c968420522cd4a99d2848d1cc5383ab", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700804, "uuid": "87ac2bd3-48cb-49a0-ac29-dd2a265eb50b", "value": "4433F188D6C8D37298F63475AC7DC702D6786D6E441BC5A282F30AE7A807E95174AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700804, "uuid": "43d424c3-2706-4aa8-a392-3dccc0d98141", "value": "768:cwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2B:xFugXVpoD8ZxhrLAuNS07MrxrKsYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700804, "uuid": "27322bce-b3df-40bc-87ed-a099b6e0df40", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700804, "uuid": "3b2f925a-aa2d-4bac-b8a9-3dfbf20542d9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700804, "uuid": "2e748a06-6a30-4761-a59b-bfa03da638c9", "value": "catalog-1838196641.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0421aa4e-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659629, "uuid": "18ff0d96-0805-4b6d-bba1-c95a76869f1c", "comment": "Malware payload (QuakBot)", "value": "06d6b4a58ed2b5e289206e6cf774e1b3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659629, "uuid": "48089713-8857-41ee-bf40-3f1df7304e6b", "comment": "Malware payload (QuakBot)", "value": "1d0b6992f177ae702140b342401d8c555073169ac27a82052ab14dcafd9ce5e5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659629, "uuid": "823b6553-5f77-4380-bd76-09c818f7c2d1", "comment": "Malware payload (QuakBot)", "value": "2f1de78b6e312c704b078604f7ae684ac6b740a6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659629, "uuid": "e336e244-5b3e-4ae7-8b79-7d435b7c067c", "comment": "Malware payload (QuakBot)", "value": "407ca9971182e1178422731a8f71d08fc853d6d2068b68ae30c6b663b758f3a48abad19d32b9126388012d36d76dd892", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659629, "uuid": "eb93853f-999a-4c9a-a663-7bda30ce8949", "value": "4374B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659629, "uuid": "17585be4-1473-452f-bdc5-6db20cacc6d7", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659629, "uuid": "98193647-e285-4cc4-b140-e1513d4dfd14", "value": "6144:DTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuw:Dbi7/xZrkNK11G9AQyOi6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659629, "uuid": "51d6ce8e-4143-44a3-be35-d8252dcd2ce6", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659629, "uuid": "8865b9b3-e580-4c4b-baa2-031d22b537a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659629, "uuid": "28aaa1fd-eb7f-4436-a659-03e73e5ee964", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b892b6-a8b4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619677773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677773, "uuid": "27cb4b0d-8a07-42c5-8acb-39ff82063233", "comment": "Malware payload (AgentTesla)", "value": "4c2addc3d625e639df3939f464a0b961", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677773, "uuid": "ecce947c-1a09-49e4-8178-2c8622356fec", "comment": "Malware payload (AgentTesla)", "value": "1d0d184dd5b9669edf60be389dabb650d427b2d55968128d7047156a21c0d1fb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677773, "uuid": "aa4f0ad6-a713-4858-9070-85915c21f231", "comment": "Malware payload (AgentTesla)", "value": "2391e27d7810651f1aca28f605ff96baf6dca035", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677773, "uuid": "f5be2431-88d3-4d27-a99c-1d2659fa6acf", "comment": "Malware payload (AgentTesla)", "value": "419a558bf29771dd3c963aefc3e2d3060fcf9f965ab8e53e04569829995911cf3b8370f282b5664e909d9107dd5d5736", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677773, "uuid": "ed4b3711-32a6-479b-a028-0957ffdcae88", "value": "775533A39EF959376A49880CFD6A83A57E007457017620FEFE73CA2732E524BF0E5506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677773, "uuid": "d444385a-246d-4bbb-9738-4d6a89e1f7e2", "value": "24576:eqpTbSiJcuFVHoq0tlUcgT/y6PDi3/xgl147UewxwFpit1F7EmtU9lGGd:PpTJcgL0tMj9POv+lBuFpit1hNUHGGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619677773, "uuid": "dafa1524-13e4-42f7-96da-e7d9e249d33c", "value": 1343893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619677773, "uuid": "2b275668-548f-4db4-882f-77f5d442bf90", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677773, "uuid": "76d272ec-1113-4bf0-a13f-ab876fde0910", "value": "AWB-18267638920511_ES.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea792bb-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700422, "uuid": "eb9bef29-6f2b-43dc-9ce7-2d8fd6528a43", "comment": "Malware payload", "value": "2e3bd62ba1e003fb2d85efd62d93a1d7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700422, "uuid": "fdec3db1-02e5-4d35-967e-70af42596f0f", "comment": "Malware payload", "value": "1d0fc823b0ca3b96ed55177b1bfb8cb26adf3eefa8a9004c7cc5229833f215c8", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700422, "uuid": "b0160729-d36d-4aff-843a-1fedcca238ca", "comment": "Malware payload", "value": "77d8c672fcdd8c00ac1bfdd26e7f2f98a264f375", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700422, "uuid": "545bc382-690b-4d98-bf61-0adba1294503", "comment": "Malware payload", "value": "585d07e207269088e6913d71eb33d5229e6971bcc9d57e7dbe26aadd91d418b86f3d2892bd55f2121d4fb7e5ee150dff", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700422, "uuid": "2be22aea-5566-4557-af74-17d8df61c31d", "value": "CF330289C1C8D336A8F535319C79C702C578AAAF480BC4A181F74AAB7D07D95174EDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700422, "uuid": "0e4f8c26-4e43-45dd-98b6-3c962a56c9ec", "value": "768:+wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2f:zFugXVpoD8ZxhrLAuNS07MrxrKsYT+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700422, "uuid": "0bb02dfc-e0fb-4697-996d-4916ad7fd0bf", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700422, "uuid": "14fcb2d2-dfda-4282-8895-907d8f20a634", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700422, "uuid": "9a993a27-2501-4523-a8d6-f3ecac94481b", "value": "catalog-152002859.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e215e2-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700325, "uuid": "ea469db3-dd41-4dea-829e-b3106b302c7b", "comment": "Malware payload", "value": "37576cdeed033eb3d120b84c8194e8d3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700325, "uuid": "01de46e6-5210-4a84-8996-def5012cdfe0", "comment": "Malware payload", "value": "1d1ef885b6643c4a4a5ea0f82bfe197b30b8f2ca76326642f60c6cbf643df037", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700325, "uuid": "3b1c20ce-0dbf-486a-8ffd-4e8b4d7ae54e", "comment": "Malware payload", "value": "8d1d4643947d6d704fd6b978b82994fbb525ec79", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700325, "uuid": "b20767ae-a765-45dc-be08-6bddfacdfc49", "comment": "Malware payload", "value": "9fd37df5f99e339c9a18e2a6aed389559b56a461701bceaf35086ce0022ed18c7c23a1275ae57fc9f8c6e92f20a23461", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700325, "uuid": "31857801-52df-4379-bffc-84c0abb684f8", "value": "07330188D9C9E335D8F47531BC788B02E478AAAB441BC96681F787A37E06DD0174ADCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700325, "uuid": "b0bdbeaa-6047-4686-af97-94cfd8671bde", "value": "768:1wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2s:UFugXVpoD8ZxhrLAuNS07MrxrKsYUJHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700325, "uuid": "fc033cf3-23f2-441e-96ca-b6a8b9405ad8", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700325, "uuid": "3daee0d3-f7a6-4340-8980-59c64bf715bd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700325, "uuid": "9687d1d7-3ba4-43de-b37a-15c68ad26ed9", "value": "catalog-1460400042.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e11276-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659633, "uuid": "47dd7f8d-e50a-4880-8034-3dfb0d17e7e9", "comment": "Malware payload (QuakBot)", "value": "63e33c52de9ca14c340cc77bb04c3b17", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659633, "uuid": "9c96f917-7e9d-43e7-8cdb-482f8810555b", "comment": "Malware payload (QuakBot)", "value": "1d22aea61500a825b4b5b7769b1a6dc5e8420c8c4bca686fa7b941579b235d77", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659633, "uuid": "d32b5d41-8630-4f5f-82dc-288c61724f72", "comment": "Malware payload (QuakBot)", "value": "34c29294dea268d68466f5415aed6739054a9429", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659633, "uuid": "044c665f-9c36-41d1-a0ea-77334813b999", "comment": "Malware payload (QuakBot)", "value": "78241170dfb915c619b681330b30236b5b86d087d4dd85466d76a76db7c113ce322c4e2bb448955b4cced4b14428ecf4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659633, "uuid": "09585ed3-c4d7-4642-9c57-dcfc6889900f", "value": "92549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659633, "uuid": "bb5ad6b4-d49a-476e-aec9-0f7b0709c561", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659633, "uuid": "07693cb9-0114-4ea6-907b-bd004923320e", "value": "3072:33FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ2J:nvv9sMoXBaRmr/dukbvuZ/7fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659633, "uuid": "b79b243c-dba6-4661-9f02-a8ffbb4bb2d4", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659633, "uuid": "5a0ed60f-60fb-4349-b7d6-71a8e55e28e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659633, "uuid": "e8a12ba1-c5dc-4e62-a5c4-902f2688d339", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceff9e09-a8ee-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702919, "uuid": "56774be4-04e5-4dd3-8add-775dd8e50158", "comment": "Malware payload", "value": "4cb9a91f523564977686855d4e5c4ac9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702919, "uuid": "c01ba42e-05c4-450f-bc0b-e824e66887d9", "comment": "Malware payload", "value": "1d2e012ad9578e4d5d421a9b4c309ba2428c4762c51d5a5e4972fa038c216477", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702919, "uuid": "030ec94b-73e6-4475-a8d8-1f0d0d1abb73", "comment": "Malware payload", "value": "597075923216f52955b8eff4740cb848482838b5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702919, "uuid": "19e11af4-328c-4e83-8cd0-0afeb6e5ae93", "comment": "Malware payload", "value": "44a317d6bf2a21d6469a5fe5b1b4743769d1d2ab13dcda063523992df79dc2a54eacdc7606f0f0f75ff04fd7a50762e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702919, "uuid": "be9f4714-e9ba-40f0-9355-8b646c2df99e", "value": "0933023A4CBE7A19573D10F08684CB5EE657599E3C2DC5412C8CF4A6EC056AD027E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702919, "uuid": "b8d30438-fd45-4097-b161-7445dbcd0061", "value": "1536:NP6z4+ADViS8CWoD94pUnQ64x11RiCEdqS:5PZBiS8jopkUQ64xaqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702919, "uuid": "3d5dc569-6bbc-42df-907f-b99378c16ccb", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702919, "uuid": "8f27423a-fca3-44f9-935f-8f6f401c84c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702919, "uuid": "5cdee22b-f569-4f13-840b-028e1c488d84", "value": "diagram-1566626885.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c396e6-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659638, "uuid": "1a72bcaf-d124-4b7f-b339-b53dc8524321", "comment": "Malware payload (Quakbot)", "value": "bcb6fddad8413a2f9e81df9a80b5e764", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659638, "uuid": "de10ed77-54b1-4c0a-92bc-63620fe406a8", "comment": "Malware payload (Quakbot)", "value": "1d3340c181488d7b1f1ba05d537b07ef3e3c46d112856a053ba097537f603187", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659638, "uuid": "6ef49ab0-3ca4-4c6d-8cd6-1b9a5234ca81", "comment": "Malware payload (Quakbot)", "value": "46ee88a2a801edece2c1adafec87c2a800dbafe5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659638, "uuid": "f8aa1e03-39b9-49f7-ad1b-75e3e01ad162", "comment": "Malware payload (Quakbot)", "value": "0a656b7b9f7fce8477454fe260592b441c0d61a0750c9fcfbdf751d1b962f85264c8fa9ab66990c51475f69667c0b37e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659638, "uuid": "48510309-cb0a-4a2e-90ea-fd94ab64b489", "value": "E9549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659638, "uuid": "eba636a3-44a1-4d49-8a79-d0d30f278c6a", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659638, "uuid": "a4ee6612-7b32-42a8-8a1c-59dbbf5415e1", "value": "3072:s3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ8e:Qvv9sMoXBaRmr/dukbvuZ/7fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659638, "uuid": "62fcd4f6-8b86-48c7-ac95-f18856d3caf2", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659638, "uuid": "91ad8116-55b4-4a5c-b4cb-68f7c35519eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659638, "uuid": "113149c3-30fb-4265-8a79-47f752d8c08a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879a34a9-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702370, "uuid": "343fcc9e-e78a-402b-9414-0255d83056ff", "comment": "Malware payload", "value": "5f2993d3a3a1ab332a295b68afed5671", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702370, "uuid": "8807f488-2717-4a3c-b277-d163c094fe81", "comment": "Malware payload", "value": "1d520e182eea9456a226b73e3eff65da0829e54d400a571a5f1bfcb6a53d0a0f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702370, "uuid": "a93515fc-108d-4992-a51c-9f822c519b5f", "comment": "Malware payload", "value": "d84617488e6a0d75171af3176f6e429fa5fbb060", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702370, "uuid": "754151ab-ed62-4201-8700-b0c34a2ff6bd", "comment": "Malware payload", "value": "3266268584c2d1e2a72f2cf53320848be257abb54d90d591f743b90a2e530bc4277afd9f65d0a059c3d7b3b6f06a5866", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702370, "uuid": "8d3d689c-df26-41f2-ad39-08ed62ef8e42", "value": "353302298DAEB62D537E20F04644D70FE54B58DD386EC9801C8CF8B6EC056A9163EB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702370, "uuid": "97af7078-86a4-4584-a060-2e8f1ae06b0a", "value": "1536:eP6z4+ADViS8CWoD94pUnQ64x11RiCgCye:APZBiS8jopkUQ64xSCye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702370, "uuid": "40dd929a-916d-4a77-b381-69fa96117680", "value": 51479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702370, "uuid": "45b069e9-5803-4001-8d65-29bd30da5706", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702370, "uuid": "0fb91da8-a77a-493e-a84f-f9aad4731325", "value": "diagram-1097877612.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76415ea4-a8c9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619686879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686879, "uuid": "530eaa15-c1ca-4484-a31a-8088f9713ebd", "comment": "Malware payload (Dridex)", "value": "8e2406b1f08b9cafbd10713c2056bce5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686879, "uuid": "4cb4d251-43b6-4fd9-a091-cdb7c38aab07", "comment": "Malware payload (Dridex)", "value": "1d65c2d087c58b6004be2fbfdaa94b41ebc593c5e06ed7e1feb4f7aad73e59b1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686879, "uuid": "e63eb6f5-2372-46d7-8968-1c68d2ecf013", "comment": "Malware payload (Dridex)", "value": "5e464d6a5b4e414c9b8567a61e4379821cb24908", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619686879, "uuid": "3c08c0d3-0946-4478-929a-02615016c0b3", "comment": "Malware payload (Dridex)", "value": "b8f345bc05f9d20399d2a4785eec05bcc30b20bdb1cef90a7b4c0c5d720da96c5efb0a7f19fc3b0599c6d491ca100899", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686879, "uuid": "bb29d27d-85b7-4bb8-b061-97e748a7bda9", "value": "1AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686879, "uuid": "0cad3438-2952-48f6-b148-c05ae2d66d31", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686879, "uuid": "34b85233-887a-4291-b7f1-1ac401989c94", "value": "3072:wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619686879, "uuid": "4e97e488-8a3d-4acd-9399-04ee1cae49dc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619686879, "uuid": "3a6c77d0-ab4d-440e-af9d-da995c3f3410", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619686879, "uuid": "6a77d9c0-ca8f-492a-aa16-01140a328ba8", "value": "8e2406b1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e33c1d-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704481, "uuid": "9e7d9a2c-9e10-47d9-8154-f27ac8663e79", "comment": "Malware payload", "value": "3dc64e6e54a31d2c3450150bf922f620", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704481, "uuid": "26933c57-11bc-41e3-838e-cf2afefa01d2", "comment": "Malware payload", "value": "1d6866b039b3d8144793bfe074f9784609e5a0f6d2d91e9ff593d1de90af0697", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704481, "uuid": "741a85eb-d6df-4705-8ab4-4c0392fd95e6", "comment": "Malware payload", "value": "14a2e77794c0b63948a821a5fc859d2a15d9d927", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704481, "uuid": "8dda2344-1039-4566-a2a1-b202b2413e8a", "comment": "Malware payload", "value": "d02e572feb8823839decd4ebe55a36dadb504a25b1458cf2bf2149605b55628c11d04d12ea0f2784f63f35491a6ac3ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704481, "uuid": "062b875f-362c-40b6-b45c-fcd90f14b7fb", "value": "A333021A486EBA29133D20F44549CB5EEA0764DD38ADCAC11CDCB469EC057A5163FFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704481, "uuid": "c46fe0cc-76fd-4843-8bd9-d02fb339d1fd", "value": "1536:csP6z4+ADViS8CWoD94pUnQ64x11RiCXTz+:cKPZBiS8jopkUQ64xV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704481, "uuid": "60ecd977-5a11-48e6-87e1-d8aa914a3ade", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704481, "uuid": "c213d00b-d9bf-4004-9030-e4cf86352709", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704481, "uuid": "8f80cf42-a3e1-4861-8a72-c65d0213c8cf", "value": "diagram-778180528.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8af0c2-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659643, "uuid": "7f3422fa-463a-47a8-824e-f5f7906c3ddf", "comment": "Malware payload (Quakbot)", "value": "fff3d6d4cd439fc5e89c7cf7fbc4f520", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659643, "uuid": "37579df5-878c-4765-bd00-c39bd668726c", "comment": "Malware payload (Quakbot)", "value": "1d7a86ac292aa05824c2e2e3875848f71a94fe7e20ffeedc9da5ce74dfa66da5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659643, "uuid": "d231448f-b7c4-4592-92e6-7318360711c2", "comment": "Malware payload (Quakbot)", "value": "5f0bd4a933baebe7a8381d51e401d8aad90fe1e2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659643, "uuid": "28c6d138-5e89-4c5e-98a4-37348fe312bf", "comment": "Malware payload (Quakbot)", "value": "8638a051284875f0aa7ec8133bb124e139f1d0f6fa984dbf0dfe78386e48434dd782f5f4293cb128dd12059d067e73a5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659643, "uuid": "50e1d385-3b0b-417f-9873-a5e4b6a5e41e", "value": "8E549E7AFA12DC02E7A82BF023C36F581A579AD53120251E55F55F587EEA3843D23F84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659643, "uuid": "8d0751ab-298a-4c51-b36e-a31b702cf0ed", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659643, "uuid": "944fd433-7a16-4efa-881f-0684ab6bdc75", "value": "3072:V3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZe4I:Fvv9sMoXBaRmr/dukbvuZ/7fA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659643, "uuid": "dc4ca296-c658-4313-8ffd-f3dce1a3c568", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659643, "uuid": "a6ed0af5-fdb3-4674-b965-f6e5de9a86c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659643, "uuid": "e8614377-82fb-4039-8df4-467dbcb1e20f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d518878-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703694, "uuid": "83034fdd-93e6-48e7-b98d-c72e75400efd", "comment": "Malware payload", "value": "0b3c5331cf19fc11869c4a4e9adc5f0d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703694, "uuid": "868681f1-9202-41ee-b535-965bca105d65", "comment": "Malware payload", "value": "1db0dd8fda4c9525308fa94a8cb244283aac5ed7d5cf14d73a17baff198a8eb7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703694, "uuid": "425b49b3-c930-4712-aa0a-3b4ad29c0309", "comment": "Malware payload", "value": "e219a42d3437c50cbfa768ba3404f8104c92feea", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703694, "uuid": "8171873b-a95b-4bf2-8f80-83e1a72847f4", "comment": "Malware payload", "value": "c92197a52cd7a6d41971f41f59c37015e22f39407da0223f068a8f412361e936e61ae65bcc90690b8c1176339d80eb31", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703694, "uuid": "6dc39d94-eed8-418f-9e67-f5cc89640f8b", "value": "39330229996D3A2E932D10B08545E75FE60B58DE386DC5816C8CF069FC016A9123FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703694, "uuid": "1d70d52d-b3f5-460a-a21d-b8667f2fc268", "value": "1536:QP6z4+ADViS8CWoD94pUnQ64x11RiC7s0:mPZBiS8jopkUQ64xFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703694, "uuid": "2e5f2668-fd31-4c9d-a140-26ae36c27190", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703694, "uuid": "f94f59da-46fe-4e20-9f92-818f5e41f849", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703694, "uuid": "25d69272-e595-4433-be3e-07905264a5a9", "value": "diagram-2082216925.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4d37a7-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659648, "uuid": "ea16297c-a50b-40f1-9e85-1b1a96978473", "comment": "Malware payload (QuakBot)", "value": "1f71deb589f3b1be830990fceab20bc4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659648, "uuid": "f5c6e95a-c304-4a0c-aa54-33747701862c", "comment": "Malware payload (QuakBot)", "value": "1dbe0871ee1d1446c222329938e9ab595a26f5c602500003f70d22d1e5517398", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659648, "uuid": "5e6bdf04-ab88-4dda-8c9d-ed5698038768", "comment": "Malware payload (QuakBot)", "value": "c9f7bb6305d2df16bfbed00edcf556a0968ab82d", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659648, "uuid": "545e0252-9d01-4351-b514-d66548bd5590", "comment": "Malware payload (QuakBot)", "value": "cc8d98c6434b148e7d25c20ef863f103929e95c486000a332643d7d591d34f6f7b85e764067c4ba2f0fa7f1e1bcfd59d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659648, "uuid": "c6558d96-8f16-4f4e-884d-946c82b189e8", "value": "C3549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659648, "uuid": "628af35c-2e46-41a6-a57a-8d6f5e976379", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659648, "uuid": "4637cd26-94ca-469a-a7d7-1145a77ac821", "value": "3072:E3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZTw:ovv9sMoXBaRmr/dukbvuZ/7fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659648, "uuid": "630ca9cd-9166-4ce8-986e-e85684ef42ca", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659648, "uuid": "b278816d-4498-4f27-9eab-dfaa85188643", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659648, "uuid": "8a861f0a-b469-4aab-894a-d4fd1d5f8a16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bff2e24-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704417, "uuid": "150703bb-592a-4ca0-9d05-983d37654b2f", "comment": "Malware payload", "value": "3bf69b9f430ee9adcf24440136cc0d4d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704417, "uuid": "93cc8ff8-909f-4ebb-86fc-378be5e8048b", "comment": "Malware payload", "value": "1dc176e4793b6f94dd0afe87a79c3798f3aeb584fd5ed8660aab877946eb8a07", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704417, "uuid": "8ed8aebe-372f-4fa0-90e9-d46a6478fa0c", "comment": "Malware payload", "value": "90b208d8f2f0651d7eafefc2b1aa3b9696861ae2", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704417, "uuid": "9815aba0-8ecc-465b-a14c-30d88f28e585", "comment": "Malware payload", "value": "71562e2facbe72d9526af082bacdb719c78c56ce6d4117cf2534a9f05f5aed6daf5cce22432e5fc1f51e623a1a48e9f2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704417, "uuid": "46dcc43a-1bb4-46cf-92fa-06df9d80544b", "value": "7A33022A4C9E7B29577D10A08985CB1ED107A9EE387DC5812C5CB4BADC05BA9123E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704417, "uuid": "2ef81bf1-6ff2-49b2-a24b-c25c9f2473cb", "value": "1536:rP6z4+ADViS8CWoD94pUnQ64x11RiCBKPbE:7PZBiS8jopkUQ64xuPbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704417, "uuid": "17fd8b92-7fda-4ec3-a3e1-5573ba5905cc", "value": 51477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704417, "uuid": "eb655edb-c3e9-4b8f-86f0-0c0aa70454ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704417, "uuid": "d22aa08e-8502-44ea-bf70-9b7e44a0bc5f", "value": "diagram-736711880.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a755756-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706240, "uuid": "a6f5a149-e5ae-4eea-8bd5-f1566f38e1b2", "comment": "Malware payload", "value": "57d6f2d4c8bdcfa79da9e4a277494133", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706240, "uuid": "946a801b-f209-49cd-b776-4991b2ae748d", "comment": "Malware payload", "value": "1dc8c46825cb3040dd30a968c55764c8d47f64d820b260cb9e6f33007a2747ff", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706240, "uuid": "0e11f94e-bb47-4fd2-bf6f-cd2819e543c8", "comment": "Malware payload", "value": "60d3d476e7f2330e3648b2790a294a76514f8e78", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706240, "uuid": "9682533e-da5a-421d-a2ca-4940b3a06442", "comment": "Malware payload", "value": "1d149a5e5c2f242d9581f1d4e32bb91cc0d7f532d4a22a4d2825ecc0a5167cc9d58e2db59b9cf139a3786d7f0489262a", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706240, "uuid": "a6702c43-80d0-470d-9553-a20d0513a495", "value": "2A33022A586E7629473D10B08549DB0EE657189E386EC2921CDCF5B6DC017EC113F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706240, "uuid": "689fbb6e-cfc5-4df5-ba64-d5cdc059f3c5", "value": "1536:fP6z4+ADViS8CWoD94pUnQ64x11RiCFtPvP:HPZBiS8jopkUQ64xhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706240, "uuid": "0d9ebe27-c05d-4d22-a73e-e66e504b77fc", "value": 51485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706240, "uuid": "cc0f3f7d-59c0-441a-8a84-e8f8279eeafb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706240, "uuid": "589d54cf-341d-4538-9f75-db4eebc5fce7", "value": "statistic-215773727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3afab76-a8e7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619699947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699947, "uuid": "a9efc508-0204-4621-91d7-8e218a123d33", "comment": "Malware payload", "value": "b47700f1ef2d5d04acc43e3437b87fc4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699947, "uuid": "d4ddca7d-2207-44b6-89f1-54815cd2b327", "comment": "Malware payload", "value": "1dd2a8435eda623c66926acc11f598a95079720b83902643db489f2a04f9a9ad", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699947, "uuid": "0717b6ee-0363-4c73-a149-93e6a296ea6a", "comment": "Malware payload", "value": "b4d6b70b5fbd11fa5f8a59223ea2567edea922fb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699947, "uuid": "e4e36bda-ea77-4fb7-b274-6e7f784c7e8f", "comment": "Malware payload", "value": "529331c241b27f69f51a6486dfbe192c97dcf90ae88cd3f42c7e7ba4de8d2612f1b17b07676174eeaa9d8dd074a4f245", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699947, "uuid": "f30c36e3-d8d4-4264-8798-c42095dc8773", "value": "C7330188D588D376A8F2B5766C3A8B01D5A8AA7B481BC452C1F34AD7BD07D91270EDCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699947, "uuid": "b188af43-2d88-48cc-9db5-4ca7b1af8474", "value": "1536:AFugXVpoD8ZxhrLAuNS07MrxrKsYhjFAB:6q41rLZNkZLYhjF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699947, "uuid": "8b32df4a-7bc4-4afc-9fac-c65a32d7b491", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699947, "uuid": "55feecda-9660-4074-aea0-7ab535a424b5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699947, "uuid": "4da850ad-5c79-4ad3-b4c8-e6eaf436a395", "value": "catalog-1201008019.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121033c8-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659652, "uuid": "318d60b6-9435-4eb3-8a99-6f046953ea7e", "comment": "Malware payload (QuakBot)", "value": "20bd3faf1409fca455ca0689eaef11df", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659652, "uuid": "8bcb7865-963f-451a-9235-785225c47251", "comment": "Malware payload (QuakBot)", "value": "1dd65ad73f5044a2b53d4ef9bf2d5e075064e9c65c58b3bee861640c994bf4fc", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659652, "uuid": "987eeb8d-4a72-4e3e-ba94-ae712497790c", "comment": "Malware payload (QuakBot)", "value": "4391ab9f51b62e17451bfd3f1192a6f7d85ff775", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659652, "uuid": "476b53eb-7830-48f9-bddf-53a0df9666d6", "comment": "Malware payload (QuakBot)", "value": "f062516b72c5d5a05c26eef3df863352a0c947e1d5a72cc1a29cd73143ae54f7473d4941b84f89413a4fa2637b5a74df", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659652, "uuid": "290d0256-d246-4036-bcc3-093e56318258", "value": "FC549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659652, "uuid": "24f403f5-7716-48bc-8c37-1915ac0d61b0", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659652, "uuid": "a10a8e16-3356-4c33-a4da-7d010521bd4a", "value": "3072:s3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZMa:Qvv9sMoXBaRmr/dukbvuZ/7fL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659652, "uuid": "da193152-0a81-48e9-b655-b20a0fb961a7", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659652, "uuid": "6ba6a03d-acf2-4571-ab38-9fd54f898ccf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659652, "uuid": "bafc4cad-4c55-4ce9-ada1-2fa512ee843c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f551b6b2-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703413, "uuid": "e34aebba-e06c-4777-a012-244c43cc6f7a", "comment": "Malware payload", "value": "0f8b402b68ffd8dc46b57e0c0689b52a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703413, "uuid": "7ffa7eca-5bb0-4157-98ff-7370d6dc242c", "comment": "Malware payload", "value": "1dedd19993b8d245a4c6c6cd3126905994020fd5babf4f76ef5449a7f132ed1c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703413, "uuid": "a1b85756-3c0e-48cd-be5e-2a2c6fcf65b7", "comment": "Malware payload", "value": "a268c640acd9d73d5032ea7d8136bc10a46b60dc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703413, "uuid": "96f9276c-563b-40e5-9f8e-bd7e26938411", "comment": "Malware payload", "value": "88212ecc736dba9250ba9e1d11b16ff0c2a5e045da86cebee5069dd057210795fb9dad7b43934c816a1ca9e6571e614d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703413, "uuid": "016fafdd-6fd1-4690-8914-7380a0680a8a", "value": "F433023A48BD7A19573D10F08684CB5EE657589E3C2EC5412C8CF4A5EC096AD037E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703413, "uuid": "c636b0f1-1ea7-496e-95a7-6e359c163a0e", "value": "1536:kP6z4+ADViS8CWoD94pUnQ64x11RiCEljX:CPZBiS8jopkUQ64xijX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703413, "uuid": "cb4a2116-6cb7-45b4-ae78-988ad727c93f", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703413, "uuid": "5d2852d8-5439-43c5-a614-756410c385b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703413, "uuid": "8d696958-d6ee-40e2-a78a-b75ce275af7b", "value": "diagram-1866326408.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160b014f-a8b5-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619678127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619678127, "uuid": "6764b732-9993-42ac-b674-64e9234a48ac", "comment": "Malware payload (Dridex)", "value": "2fd5ca5268167be7ef3d07132c078f26", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619678127, "uuid": "96eb7510-b2d3-4de4-bcb2-d64a665b9171", "comment": "Malware payload (Dridex)", "value": "1e015d1cc444d8a2ff5312fc9fb1a9684a82d33fa0d3fed28e097c852c753392", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619678127, "uuid": "68b2ba7b-f1fb-453c-a79e-a0b1b7b23ac3", "comment": "Malware payload (Dridex)", "value": "d7212c4310b7b23732de3aba0124a894d001a083", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619678127, "uuid": "7b7ccbcd-2d72-45b2-9600-2d0783c4572f", "comment": "Malware payload (Dridex)", "value": "c8c61394e1e5bb26daa876f2049ec8a7ded38b8e9ee652d875da2fc19be1ef30fd0160814273c3cf5d678a11e7ecf708", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619678127, "uuid": "8f89ef34-26b9-4a61-adf9-89e881b737ce", "value": "07F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619678127, "uuid": "6c8ad20c-5d25-491c-b55d-f327dd7e49aa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619678127, "uuid": "61e727f9-66c3-4fd0-82c1-c4c04e8df9e9", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619678127, "uuid": "ff5d61ec-cbf3-4b37-9d7b-fb01660722aa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619678127, "uuid": "4a9fe14f-df53-484e-9190-6f0cb11fbd2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619678127, "uuid": "655929db-3755-46a4-a7cd-e847830bf53f", "value": "2fd5ca52_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d52de3-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659657, "uuid": "777a1622-db8f-4914-950f-3ddf31f4e01f", "comment": "Malware payload (Quakbot)", "value": "571a56e788dfc42a35bbc1cbbff4802d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659657, "uuid": "e8441e2b-9e19-4706-94cf-67febcd05bac", "comment": "Malware payload (Quakbot)", "value": "1e097f7b30ee08ba0fa94031ea6bc8ffff1c271db732f4327561dba316b0ce57", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659657, "uuid": "01e60ad9-d557-4239-8acc-fcc251e8e841", "comment": "Malware payload (Quakbot)", "value": "63ffbd55e216495d94bfb36a84319cd1696eaacc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659657, "uuid": "f4a15bc2-a384-4dc7-aef1-5ed0a890753d", "comment": "Malware payload (Quakbot)", "value": "058df6f02c5773a2a956ea1f469905aa3a6df37dd60396494481a76a5b5b511f1e7c14c4e3c8db7c2beea84fc88493e1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659657, "uuid": "300487bb-321d-413e-ad92-58f1ea9864a1", "value": "9A74B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659657, "uuid": "acdece45-214b-41e8-9d38-bdf1da6b5b3e", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659657, "uuid": "2689e85b-20f0-4a98-a92e-e2d53b6f27d7", "value": "6144:MTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuz:Mbi7/xZrkNK11G9AQyOi6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659657, "uuid": "30f60b06-4b27-42c3-8592-851f7a144d12", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659657, "uuid": "037f7168-12c6-4b96-aa5a-f96865359569", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659657, "uuid": "9eeed5fc-c8e2-4f09-bd41-96f95917244c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd30cc5d-a8f0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703748, "uuid": "6b903b5d-5e75-47c4-9afd-ad477b1c073c", "comment": "Malware payload", "value": "1044dce30cb003e6aa81aabb8ebdb491", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703748, "uuid": "fff3fd6d-afd8-45db-819c-b3c020549a3d", "comment": "Malware payload", "value": "1e186a75f0e1092dc03e72f8b44d64735ba4561d5a20c76ec15bdb69bcf39179", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703748, "uuid": "f675ffeb-c9bf-42b9-a850-a84222f17b67", "comment": "Malware payload", "value": "603b2566374cedfb1acf7d95575dc22f9f4b7df9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703748, "uuid": "7f79a1f6-01f5-4c8f-bd60-ed7372b731f7", "comment": "Malware payload", "value": "e94fe68faf2c324bddd700e4f0f37c9c864d4e5de38635ee743d8e0f0eed8b17431ca87ecdf5ecf62507334ec3677cf3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703748, "uuid": "f75dfcff-1c2c-4a88-a91e-b6d238fe7dda", "value": "3333022F485DB72A577C10F5C589CB1EE50B689D382DC9825CCCB426EC096A9153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703748, "uuid": "6d3e635e-055a-44c6-bc44-9d5e5e4aaaf4", "value": "1536:PP6z4+ADViS8CWoD94pUnQ64x11RiC+D51:XPZBiS8jopkUQ64xcDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703748, "uuid": "3bcdabc9-9077-44d3-9240-84ab10464294", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703748, "uuid": "792e4784-7a7c-407c-8fcb-ea6f4179769a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703748, "uuid": "8c89e5e6-6c93-443b-8727-7f5b1b59fc51", "value": "diagram-2123806283.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3640f0f5-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619701374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701374, "uuid": "24bac25b-57a8-42b6-bcc7-1874fe036415", "comment": "Malware payload (Dridex)", "value": "5cfed903932636ead8abe6e325da71c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701374, "uuid": "49514260-2507-4ebc-b63e-30ab649ec8e3", "comment": "Malware payload (Dridex)", "value": "1e22e0448e7f3e1e67475cbd0b76a4848705d0283871ac509621779f62af3c75", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701374, "uuid": "f9ea5b87-5170-4fc6-a33d-e6eebc157319", "comment": "Malware payload (Dridex)", "value": "287cdafad07312a65ec31be567e30c62fb282904", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701374, "uuid": "20b9e562-278c-4541-affd-8ca179c172ab", "comment": "Malware payload (Dridex)", "value": "94c239abac7f4fbb4fe8a575c0c117fa749aced2abd778f3bb93f4ad90ad59b7d9c7caf74fda4135a2bfe72cab547628", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701374, "uuid": "d69fbe9e-9be9-463c-baea-04c78b737573", "value": "1DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701374, "uuid": "de7f12db-d6b4-4515-92b7-da5162f8a323", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701374, "uuid": "74f239a2-38b2-45d3-b4dc-90d0d3e4550e", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701374, "uuid": "8fad7099-f44c-42b8-a64a-7c5358740a86", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701374, "uuid": "eab50b27-1c6c-482e-8f6a-889a820272bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701374, "uuid": "fcb1d4f7-70e5-4d1f-b136-9b4048881b04", "value": "5cfed903_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b72c70-a8b2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619677207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677207, "uuid": "969eeec8-d91b-449b-99a0-04f4d36f05c1", "comment": "Malware payload (Dridex)", "value": "7baa575dd62a679704c5553fdb75dff7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677207, "uuid": "fb2a2b2e-cd54-427d-85c0-8fea77648cf6", "comment": "Malware payload (Dridex)", "value": "1e4d12973e9a2bb1f04139f0127487fe37535718a975508718ab73db50adc1d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677207, "uuid": "037a77eb-8683-4f6d-b281-e49d77be8a80", "comment": "Malware payload (Dridex)", "value": "6238dba579de06342a839a24f8df70b0d7797433", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619677207, "uuid": "ffbdc02c-4ef9-49dc-af3f-696b7033e8d7", "comment": "Malware payload (Dridex)", "value": "a49f18a11e87caba9be0be30368ac4bea079e0402cd6c7da5d6356897f0bc397ccfa594f8b0e3a2bd4a2c0e99a3c8915", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677207, "uuid": "e9fa8824-d331-4388-86f8-d5c68185e043", "value": "17F3D0C2E7FFE0D6C42B743389DDB036EF5024988A3ACF35C504882E69D7954AB355A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677207, "uuid": "20f0942b-d129-4aa5-868d-5aaa9239a2d1", "value": "9e8b617b10ada8d5a1fd6f30540a87c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677207, "uuid": "e34515c1-9efa-4f79-9a9a-8e2c2b5da0a0", "value": "3072:vZ8CMtKJlXoDFwXrdV/9/uWIdojDZl4epTGmoAc7iTRilfn6wlYY3Zwd:CnClX8WZ7/HrRCADTR0VlZZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619677207, "uuid": "471908eb-b961-474f-88b5-1914beb1818c", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619677207, "uuid": "c8378004-a285-4c65-94f2-b3027617b9a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619677207, "uuid": "ba62477e-13bb-4481-b955-aaef9272f47e", "value": "7baa575d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a88d011-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702240, "uuid": "774964c3-02e6-4350-b95f-5d2a3d22880e", "comment": "Malware payload", "value": "bbd5d93ffd45a33764ceec1e79fc743d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702240, "uuid": "c7d1006f-cdd5-4464-9bc6-e3bf7114bee8", "comment": "Malware payload", "value": "1e5a8725b4d5de2717d41cbf15c8e25c70bd5e83a09df5f7eea9e1120965e22f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702240, "uuid": "5e766a57-883d-4132-95b5-550094195c8f", "comment": "Malware payload", "value": "61f5ef368078d4e729bb18d6011aea9ffcae195e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702240, "uuid": "e738c597-ba61-4a5e-ba7a-a4c0f7808d7a", "comment": "Malware payload", "value": "5c7c48d449610771d4b70185be2a0eea322518b6d251e51d40b0f41b43868a52c566a4305dd958ff212d27f571dcfd01", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702240, "uuid": "a18f764d-2e70-4c89-a593-a321d396d7d3", "value": "7033011E4D5D762E172D20F5498A9B5ED54B28DE382DC2811C9CB4B6EC04AA8163FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702240, "uuid": "4aae0f5b-cd45-40e4-986a-db70daf66385", "value": "1536:PP6z4+ADViS8CWoD94pUnQ64x11RiC26p:XPZBiS8jopkUQ64xM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702240, "uuid": "743b5b30-4ef4-497f-a2cd-84f36f476a57", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702240, "uuid": "a2058a5a-5d31-4ea7-97ba-1e14f8676b6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702240, "uuid": "cbb668ec-d538-44cc-92e2-38e46fce38f3", "value": "diagram-1001202998.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179826a6-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659661, "uuid": "a03cb9d0-9cc6-44eb-bdd5-5277d6299135", "comment": "Malware payload (QuakBot)", "value": "5d63c77a2f913f5a73d3a4018ba0f648", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659661, "uuid": "96b3aed3-3222-4bf9-acab-8e30ac9752e3", "comment": "Malware payload (QuakBot)", "value": "1e61eca68ee34a3cacdc5448e085aa0d69da9ec4dfb9592652e62235ed9f7157", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659661, "uuid": "9fbbc9dc-6ffd-44b8-8e4b-e3b452147320", "comment": "Malware payload (QuakBot)", "value": "b7c4b21ef8eaeed88ffdd1dae46bb402dd5d4bc4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659661, "uuid": "b1066df9-ca23-4b4c-8b54-4312059ea251", "comment": "Malware payload (QuakBot)", "value": "fcd96fe95dd220a983917fc256a372338329ec27f368a2c9bc1c5fcc0e2cc4f8871bce51d8336918fc8bc799be227bc8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659661, "uuid": "b0ef30fd-e1d5-490e-bd69-f1d7ab5a2170", "value": "81549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659661, "uuid": "f156c030-509f-4021-b977-1ecc4ede58b2", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659661, "uuid": "207e786b-9251-493c-887a-20291a1abe71", "value": "3072:q3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZCj:Gvv9sMoXBaRmr/dukbvuZ/7fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659661, "uuid": "cf097007-c5a0-4cef-9a15-6395eeb0951c", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659661, "uuid": "b670d411-78b2-42fa-a42e-c457a65d5796", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659661, "uuid": "b2046301-13ca-4f94-ba9a-c883828b714c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43649c57-a8f4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705262, "uuid": "79e8fa70-2962-477c-b604-10ba6c65db38", "comment": "Malware payload", "value": "b17f8056e507e3021d47e45abafa1b12", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705262, "uuid": "5b4654f4-5803-40a1-8cf7-2b3d0df51eff", "comment": "Malware payload", "value": "1e658786dd94b8ad08b94cdbea5200a7d53b21f50a4026c02f0100c7a1450139", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705262, "uuid": "c17674d4-0a6c-4218-b86a-a39d1ce02c97", "comment": "Malware payload", "value": "fe9ce668225819c07facf7bae2031397b70c370a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705262, "uuid": "249cd1bd-8378-4198-a143-20db286bc8f0", "comment": "Malware payload", "value": "931e256f32462f7c432146c35a2425f894cc4d190c6fb569740e114e5c65f22d23efd726be54b7633ecc750a578a70cf", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705262, "uuid": "df891fe7-2570-4f48-a554-cca153e6a324", "value": "2133021A5CAE362A573E14B08988CB1DE65764AD34ADC9812C9CF475FC057D8223E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705262, "uuid": "b8a93a1d-03b7-44f1-a70c-f66fb0e290d8", "value": "768:p9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCpBX:cP6z4+ADViS8CWoD94pUnQ64x11RiCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705262, "uuid": "cfc94347-27f3-484a-853c-5c42bd32e71a", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705262, "uuid": "ab6783fb-a298-4c43-a012-52bacf00679f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705262, "uuid": "a774a842-8273-4c6c-a9f2-40eb9c7b410f", "value": "statistic-1324889286.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9393dac3-a8f7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706685, "uuid": "04fcf6f7-8918-4f53-8778-ca2ddf2eef4c", "comment": "Malware payload", "value": "df92e8c8c448941f96ef179e1be3f137", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706685, "uuid": "3afdaa76-30b4-4908-bddc-407e59aab899", "comment": "Malware payload", "value": "1e71d372ce1570afbb008adef3e100e19bd111a81f42e409f08653461d40be3d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706685, "uuid": "a3cc234f-0b07-412b-b6ae-b21020594b84", "comment": "Malware payload", "value": "adf75aeb0b1f9a8026825ffb822e79cb4c61ea86", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706685, "uuid": "80e62e70-4d1f-42f9-a8ab-7adefbd99b13", "comment": "Malware payload", "value": "30bb3aa2cf7668d46b0997385b5b3f232eb248fafa75144f14cac384761fc49d89ce49a544b81258328659ec3e9b3805", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706685, "uuid": "fed2e161-252a-47de-858c-34739d157e36", "value": "6333021658AD7A2E57BE20F48542D74EE91799CC386DC6811C8CF4BAEC057A8053FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706685, "uuid": "48b309e8-9930-40be-9632-44d164251424", "value": "1536:1uP6z4+ADViS8CWoD94pUnQ64x11RiCEw:uPZBiS8jopkUQ64xL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706685, "uuid": "31c8618a-5d7f-494b-a5d4-f03d6c989517", "value": 51484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706685, "uuid": "fbb3aee4-2e50-42ef-96e2-952f5569bb5c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706685, "uuid": "f914148c-2997-46c1-b849-8e9c5d3dcdd1", "value": "statistic-520363793.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5ef0cd-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659666, "uuid": "5cda2749-adf0-48a5-b2d6-84ce05f3922b", "comment": "Malware payload (QuakBot)", "value": "0b1c2677e71ff20a632b8a1f2c97c443", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659666, "uuid": "b8e2ecac-17f1-45bc-9c3c-0b7c1cef2f89", "comment": "Malware payload (QuakBot)", "value": "1e97ad2091e12ba1f0e89ab6a73f1e99571ea049d023d3801cc8cfa6f268a0c7", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659666, "uuid": "2aaef4c2-c6cc-4ca6-9ef8-9893368351a5", "comment": "Malware payload (QuakBot)", "value": "419e92c8a283aca04d1c24db1d9b4fecf2e7854a", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659666, "uuid": "3401ec3d-5dc3-4093-b88a-7127abc3a6b0", "comment": "Malware payload (QuakBot)", "value": "1108732ada5e20d8c3e07a51a84ff6f22a078725249d65aadb68787d0f9a87a3b028053703421acd2b79c1bd15f2d947", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659666, "uuid": "a1ddac64-3a10-4f8d-8e73-8da9cec91a3f", "value": "FC74BF7DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659666, "uuid": "372c2d77-f4e0-4ebe-bc99-a7846ef673c8", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659666, "uuid": "d95d8acf-9a84-4f48-aad1-7ff0d16cfe3a", "value": "6144:UTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRu+:Ubi7/xZrkNK11G9AQyOi6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659666, "uuid": "5eb334bf-ea8f-47f4-83aa-3e28e7e7c999", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659666, "uuid": "387a8eb8-609e-4dd9-aedd-c906104c5c5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659666, "uuid": "625a5a1c-74c0-4d88-b050-bfaee5d2d5f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febd4f31-a8e5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619699133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699133, "uuid": "57f884b0-fbe8-4713-89a5-56caefe0a1c8", "comment": "Malware payload (AgentTesla)", "value": "f86c819aff902d6d5cbfef1d94d632be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699133, "uuid": "648f4872-c931-4971-b1ea-9109a6a6d31f", "comment": "Malware payload (AgentTesla)", "value": "1ea490cb0b6f46e42584f4575880d570123c8b3aed728bdf80ca71584f3075a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699133, "uuid": "b78d6adc-ab61-49ec-bf89-1972502fc142", "comment": "Malware payload (AgentTesla)", "value": "d95315fcf2814357fd1bd4432bb003ee941be9d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619699133, "uuid": "356095db-0147-4efe-bb1c-ce89572720c0", "comment": "Malware payload (AgentTesla)", "value": "468cb50940228950db8c4f6c705e0da3010e924bb333fe82aae96b7bd5556359a1615712f20d862c273e73018ad52884", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699133, "uuid": "ea5f36b2-b419-408d-abe7-8c1659350f0e", "value": "C2257CAC720075EEC2178C3397CE1C11921025756A2BE60B972333BE9A2FE976F355D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699133, "uuid": "0e776f8d-f148-4a80-b8bb-91e2859d10f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699133, "uuid": "d1538b59-28cd-4a84-afa3-d97535c56bca", "value": "24576:SSujoLAUR7e/jrj2+5kNOjYfknE4bfvx4Nk:SpUpknj2++ZgByN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619699133, "uuid": "1b53d8e3-9e20-49b3-94f7-ced362a3ddb9", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619699133, "uuid": "7fe0690d-d97e-4648-8eb3-157a9f030e66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619699133, "uuid": "ee31cfe9-9e8b-4a3b-960f-5a261e31d53c", "value": "DHL DELIVERY DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475a837c-a8cb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619687659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687659, "uuid": "a610ea79-d228-4d1d-9582-516a2359257a", "comment": "Malware payload (Dridex)", "value": "e609b53b321157520017ad16fa3c4b34", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687659, "uuid": "4bf339d7-91b9-4a20-9ae0-8ec154636fa7", "comment": "Malware payload (Dridex)", "value": "1ed248591973435de99ebb52b76b4eb50f7f7bb1959c06cda7ad871ceb8c5310", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687659, "uuid": "9a6fad71-4876-4a07-b839-046dbae513fe", "comment": "Malware payload (Dridex)", "value": "b2dee37a562ac3b3d2cbe4665efae5d2f74e396d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619687659, "uuid": "62001bdc-f13b-4d7f-a5f0-9a66cad01bc2", "comment": "Malware payload (Dridex)", "value": "af2eff6893feb64ebd3633af688019485a29e0ef16b9746c77a51ab1ce60be998d1da430823b21c36dcfb34ee84c2bde", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687659, "uuid": "a8a653aa-8524-49bc-a638-670f500197e7", "value": "D8F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687659, "uuid": "b1a6a310-326b-4630-9812-1fe2f6866bd0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687659, "uuid": "94445d4e-134c-43c3-9a73-76e8870b480c", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619687659, "uuid": "50e3b01b-0ac5-4e79-947a-5c66c1062f71", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619687659, "uuid": "d579a502-90b7-4400-b4da-e8f4a13da12f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619687659, "uuid": "6cbf4e1f-475e-42a2-a74a-56ca7cce5683", "value": "e609b53b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04231c32-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706014, "uuid": "1f6e92bf-a538-4122-99ec-a803e9e93c30", "comment": "Malware payload", "value": "52087b10500614e9cc49f325a1dbc569", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706014, "uuid": "190b7657-3f4a-42c8-9302-50101161947d", "comment": "Malware payload", "value": "1ee6475a43c48f8dc6e0ffaa77a8dc703cbf2aa615e3bf325ba062abff2e665a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706014, "uuid": "2b8f882e-4451-4d8d-9717-401684ca39de", "comment": "Malware payload", "value": "50b7b1529ada05f6b67dc7116f3eb3a9c00c26f6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706014, "uuid": "e220b417-c3da-4e81-99ff-d22a40b097f0", "comment": "Malware payload", "value": "689fb4928b873c337c1d3e02dd7a8ae581f43aa2f5ba2e7d47e58e6d4b8c6cd2fb70f92c910fb77ea9c3c3191a3c9ab0", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706014, "uuid": "16ad5041-867e-4454-a24c-8afe55b69026", "value": "7733022E486EB629473D10B48548DB0EE65B1899386EC2821CDCF5B2DC017EC153F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706014, "uuid": "3b6b599b-f3a2-4e34-84dc-d7c91a13b88e", "value": "1536:pP6z4+ADViS8CWoD94pUnQ64x11RiCFpPvC:NPZBiS8jopkUQ64x1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706014, "uuid": "8095b368-b593-448b-b216-4806b5a80591", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706014, "uuid": "e0b02997-2af7-41f3-a14b-650d6036a904", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706014, "uuid": "99c566bf-1507-4dda-ace1-da7d5e7c2321", "value": "statistic-1951718513.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d202086-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659671, "uuid": "de1c9a83-a542-44f7-b551-8715fc78aacd", "comment": "Malware payload (QuakBot)", "value": "9b674d55b9876cb517ec3f1504cfc6da", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659671, "uuid": "29b0bf3e-d970-4d60-952c-3bd4140a24f8", "comment": "Malware payload (QuakBot)", "value": "1eee6e875dcc39657ac13ffb9f0b78baa2db8bf060373857580c04b36f730a8b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659671, "uuid": "aebfa548-2965-420f-8bf7-a0cdf017ce27", "comment": "Malware payload (QuakBot)", "value": "efe78605399949249ad5d21f7fd7af26c9d188f7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659671, "uuid": "c095e080-af63-44f3-85b3-790710c2bc1d", "comment": "Malware payload (QuakBot)", "value": "49e5a9b623d3fb5dbf560211c19df9ed5fac6c3ca47b088d0dd14d41113ad05d94b907abfd784e6edd0b0181fa76ae1c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659671, "uuid": "95c7b8f4-eb34-4562-858a-09b4d77af8a8", "value": "CA549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659671, "uuid": "a79857ce-eaed-494f-8b90-3f186f633551", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659671, "uuid": "8611ff96-84cd-43b7-ac1e-164009c1ed62", "value": "3072:v3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZXF:/vv9sMoXBaRmr/dukbvuZ/7fn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659671, "uuid": "e03d9220-4552-4999-9b6a-3bde1ce23355", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659671, "uuid": "e617a433-4b00-4ad9-8ac1-9dd3fb4453d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659671, "uuid": "6b734ee5-6962-44d2-a109-8f4f90fd6aca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498fc536-a8e9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700547, "uuid": "a2a8739d-124c-4c72-8f5c-c1b5b2584fc9", "comment": "Malware payload", "value": "69ae60c8a9f42a41f5209551d68972cc", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700547, "uuid": "5070dd85-6943-4d27-8708-d2476567105e", "comment": "Malware payload", "value": "1ef2e6d3a7357b107a1e0df3a04ac0450062fc211054f817f4f86262afc4cf7b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700547, "uuid": "242afacd-0375-48c9-83de-3374a2275dc4", "comment": "Malware payload", "value": "89494b731b1dd62381338ffd6d04b01c164270a6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700547, "uuid": "35ee9d80-e45d-423f-a7b4-75a1066800f8", "comment": "Malware payload", "value": "378190f96a13f3293ad17dac43b65dc106ce4c6df7158083989db8e58d74fbe529960aeab55a8254c18b26d47e308348", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700547, "uuid": "105675f7-8dd7-4e5c-88d3-c6aa22c08059", "value": "6033F2CCC6CDD33294F578315C79CB02E578AAAF481685A181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700547, "uuid": "17e9595a-dc00-4693-82c0-356435ed683a", "value": "768:awnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV24:HFugXVpoD8ZxhrLAuNS07MrxrKsYBOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700547, "uuid": "e755c22a-c94a-4678-bd22-60764488691f", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700547, "uuid": "e6cded73-9843-48fe-bec0-b93e3c799de1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700547, "uuid": "1219d6e1-e53b-4718-b800-6112f7bc2f51", "value": "catalog-1602994209.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f1c968-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700117, "uuid": "fe66a259-04af-40b2-bc4a-834eaab85237", "comment": "Malware payload", "value": "50c8b2284003f8bd656c5ecf67628ff6", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700117, "uuid": "77f20ca6-2d65-41c3-8b6d-4742941c96ff", "comment": "Malware payload", "value": "1efeed3141f49bea35715a041bdd794cefb39ffff743b672f198974a34a21b94", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700117, "uuid": "5b33306a-3f14-4a75-9dbf-080efa3e7b94", "comment": "Malware payload", "value": "c78db5a6ec79246efa2002417bd307348df72013", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700117, "uuid": "1a5abe31-c561-4f97-ab67-37fe15a18ca6", "comment": "Malware payload", "value": "6ddc1350644137500dcba238512d7f25e756fd94fc31c2b0d659bb96c12a25a540281d7ff2e891c60a6f7ce278203b7e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700117, "uuid": "8fc0f626-ba5c-45d7-8538-769eb8235df8", "value": "DF330188CAC9E335D8F47431BC798B02D478AAAB441BC95581F786A37E06DD0178BDDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700117, "uuid": "a27bf222-09de-402e-ac95-c36d1350eabc", "value": "768:iwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV24:PFugXVpoD8ZxhrLAuNS07MrxrKsYUJEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700117, "uuid": "10f9e82a-5fdb-43c9-b600-3277cfa6dc39", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700117, "uuid": "ba3fdc9a-12d4-40e9-8192-7ea28f7737aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700117, "uuid": "16fb4750-3058-4046-a60a-f6ef8dee6d2f", "value": "catalog-1289400087.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b46ab0-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701667, "uuid": "1a003e53-f920-4bf1-8d1d-926dd9ab7219", "comment": "Malware payload", "value": "8fb5b820ef6c76dc6656c51ffb8e795e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701667, "uuid": "50109c77-2340-4079-90a1-b4ef7b7e6816", "comment": "Malware payload", "value": "1f044a0877eb616525ee93f146a2d8aaaa2cfb076a50ef09b45263f4d0e0d031", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701667, "uuid": "cb89720e-d33e-4987-8f1d-64d845655a1b", "comment": "Malware payload", "value": "46ce0aaf96be24d73302db3fbfcadc85d54bd7bc", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701667, "uuid": "1a48523e-d0dc-413f-82ea-3e5bbe482087", "comment": "Malware payload", "value": "4c9c1beac1b2aef0b446f3805aa62583bfbef5c31b024f1100441805c854abbee97c83fd3729c23cf8c064e256ce140b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701667, "uuid": "659a2ef9-7c48-4dea-9b20-683c7ccb4e66", "value": "BF33F1CCC6CDD33294F578319C79CB02E578AAAF4816856181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701667, "uuid": "1b7486b4-d04a-4da3-a76a-f1b1f139712c", "value": "768:jwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2K:CFugXVpoD8ZxhrLAuNS07MrxrKsYbO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701667, "uuid": "9abb3a78-2d7a-49d7-8565-49606393d0af", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701667, "uuid": "a09834bd-3b03-4d84-9947-e130385e2c58", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701667, "uuid": "1a7978ea-c81c-4216-bc6a-8ef5d9539d20", "value": "catalog-582535660.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200a69da-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659676, "uuid": "67bd2741-2c7b-4827-81be-ab87a6df5ec6", "comment": "Malware payload (Quakbot)", "value": "64784e4783abdbdf6d78b17449610b42", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659676, "uuid": "fdbfe9ef-978c-4ff8-a4cf-999137c0eada", "comment": "Malware payload (Quakbot)", "value": "1f064fc8a5fa83fbdacd474038c142fdf4afc6db27e213b9835c957570218b22", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659676, "uuid": "e0e54918-ef08-4e9b-9310-06ed7b2483e3", "comment": "Malware payload (Quakbot)", "value": "d236e9f4d689d95083e141be76434710c693243b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659676, "uuid": "f5a75633-5e52-4167-8194-fde4c04916f4", "comment": "Malware payload (Quakbot)", "value": "479b1d8cb4adb7a9aef1f48a122392f04b06e223f45a746475a3eb8fd07d2a3bc082f27ccd7afb62d7b5e48918dda59c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659676, "uuid": "a8a75b9a-5bcf-4ca8-b4c5-057258914035", "value": "C674B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659676, "uuid": "fa473c12-0286-4c6a-ae09-383106545a8a", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659676, "uuid": "91a1078f-82ec-409c-b961-3fb86e48472d", "value": "6144:dTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuy:dbi7/xZrkNK11G9AQyOi6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659676, "uuid": "7adf5a69-62fa-42cf-9732-9966448c9088", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659676, "uuid": "23bed880-4328-470f-a528-a0829e896d3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659676, "uuid": "68c7e983-6a62-48d1-b61b-c4d76ca4ac55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d21c36-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659680, "uuid": "483ee3b7-b7a2-4ece-bbb2-0432a458bb27", "comment": "Malware payload (QuakBot)", "value": "b092816fedd0f048d4f226b7f064a6ce", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659680, "uuid": "4231d672-90d2-441f-a48e-b60d3bb99ee1", "comment": "Malware payload (QuakBot)", "value": "1f0c74becef73d5f8803da4fbc84ca5ac311705a30f2aeb307898cb470dff8fa", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659680, "uuid": "2748df26-04c8-4f91-91e5-2eb3937d4fff", "comment": "Malware payload (QuakBot)", "value": "8f71ba56f7130b82139e71aec1074fb3c9bf73e6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659680, "uuid": "37d1fc0f-4068-419f-84ba-2577fe4af4d5", "comment": "Malware payload (QuakBot)", "value": "9d937f4e2f9d306ddd24b18c6b2f53e5c5bb4519815060e967e73d4c1c9f2efe784d9952809de31f1537eeffd43a14b2", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659680, "uuid": "e1b9bc3b-7ebe-479a-98e4-d499528ae23f", "value": "85549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251E55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659680, "uuid": "0c8cd7c5-e131-4fe7-80a0-a270c442b9a4", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659680, "uuid": "021943ed-8fe2-457b-afb2-2d021e850196", "value": "3072:W3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZir:Svv9sMoXBaRmr/dukbvuZ/7fA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659680, "uuid": "464eee7b-ecdf-4d59-b6e8-04d5641bc914", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659680, "uuid": "a8347199-b297-4c16-8398-7f086d2b836b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659680, "uuid": "63da18d2-ce8d-4769-a824-a0a41d62bbd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239f0ab3-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705638, "uuid": "4217d4c9-3d35-4734-9e94-e6497184f13b", "comment": "Malware payload", "value": "0694fbbc639fa2ea680ec16323f690d9", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705638, "uuid": "4ca4164b-e674-4597-bb08-dec83f5e2bc1", "comment": "Malware payload", "value": "1f12a4a1ffdb5d45b7e9782304d68a60319bb15becef9da047f4faef7bb982cb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705638, "uuid": "bf5f53a2-51ad-40ec-81ae-032647fe8a8b", "comment": "Malware payload", "value": "002406dcda3bf6c4f72d2696c95766fa6805519c", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705638, "uuid": "ee6bd4ff-5073-4216-bee5-49b4aea695c4", "comment": "Malware payload", "value": "d05c822fe880644abfb2cf29eb755e31516f22b584206fc8ce96e54c7e6c8ddcc2a0fd2f5613b9c19b0eb5cb25e1c1ef", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705638, "uuid": "82c2aec1-5f57-4318-9dd3-6d1b1b4e9a51", "value": "3133020958AEB72D532D24B48A858B5EE503ADE9342EC6450CDCF066EC066ED123FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705638, "uuid": "df464c65-3d4f-40f2-9a3c-e86aa41fa3a5", "value": "768:z9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCZX:GP6z4+ADViS8CWoD94pUnQ64x11RiCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705638, "uuid": "0f270fa9-f267-4551-bedc-24608ab3c64e", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705638, "uuid": "695959d3-949e-4c19-89b8-c94f9617f524", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705638, "uuid": "9f885aa3-7b01-4377-8269-b65f33fa46a4", "value": "statistic-1650449642.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259695c8-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659685, "uuid": "749ef502-c94f-4927-b983-1b6f59c8c16a", "comment": "Malware payload (Quakbot)", "value": "c3f5f4c179aa17b56d48ebb05ee6aba3", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659685, "uuid": "976da282-525b-4af5-84f7-9a05429b1ba6", "comment": "Malware payload (Quakbot)", "value": "1f28bf9529c6397e1861f9af78146487d32b3f03583f3e487091564ca47a8568", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659685, "uuid": "f89d36ee-a6be-45f4-ab26-14e266b49fd8", "comment": "Malware payload (Quakbot)", "value": "40a4e7c4caf0baac881cf0d43c58c3f7c1448377", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659685, "uuid": "ab502653-d058-4ff0-a6af-0abbca4e502d", "comment": "Malware payload (Quakbot)", "value": "84d8d7d7aced30656b4c9597c035c9cc79823087c1f6c90005acab46988797060012cb65a7cab80fe6eb5e2896e44231", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659685, "uuid": "1ca54ddd-19a5-4bea-86ea-0c9e95a48c1f", "value": "A574C07DBB17DC23E26C1BB062D35B581A53DAD63250210A1AB19E58ACE73E47C37EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659685, "uuid": "dbbc78e6-767f-40f9-84b4-7b3537eb6f71", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659685, "uuid": "410eca79-5825-4981-bd71-0a4fa42fe267", "value": "6144:UTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRue:Ubi7/xZrkNK11G9AQyOi6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659685, "uuid": "cb7b9186-8967-4d9d-addc-2b5dc21a2034", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659685, "uuid": "2d463a87-efe0-4c58-a78b-cde396e8bccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659685, "uuid": "e2c19c43-02db-4ccb-bc83-7964b0333384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ef9aa3-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702478, "uuid": "bfc84f3e-c2e8-4e8a-87b6-5c7221a6d7db", "comment": "Malware payload", "value": "7a5f33b9b2c75e125e15f1db553db161", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702478, "uuid": "2da829ca-027a-483f-b8ac-637828f9c50f", "comment": "Malware payload", "value": "1f4ce2fa2e012e1e9d9e091365fd751702b3ff4a1f55afb311074479afba7451", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702478, "uuid": "92b2ec4a-25dc-4849-9cf7-306dd16ab3cb", "comment": "Malware payload", "value": "203d60db270432a32958ac8f205e58df0a35804b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702478, "uuid": "3a025b04-19de-45a4-8710-4af5e27cf2ac", "comment": "Malware payload", "value": "1e1111a5d5d3c3ac8257277720a05dac45b936f8a6e2050b109c8e8d6c531f73327b4e7bdca86c7eb7fb75dc03b8b8b4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702478, "uuid": "92ffa9d6-e6e8-4b1f-9a29-b931fe48ab83", "value": "CE33022A8C6D7B294B2D10B085498B5EE903789D382DC6416CCCF87AEC052AE157F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702478, "uuid": "8a1e2087-de80-43f2-bb73-59179a8d2fa0", "value": "1536:2P6z4+ADViS8CWoD94pUnQ64x11RiCWtdBjb:4PZBiS8jopkUQ64xILBjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702478, "uuid": "22fb17f4-6229-40e2-bf8b-e04927ff8f1d", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702478, "uuid": "b80dc0a0-c158-4487-9b7f-54ed4e43f570", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702478, "uuid": "d787e7e1-9cb1-4c8c-a449-536141c23768", "value": "diagram-1210130825.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6a7f9e-a8e8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700072, "uuid": "28069ddb-3994-43b9-9c4d-0935b59c04a5", "comment": "Malware payload", "value": "b2b5f36a954f00dc608af0b417316e4c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700072, "uuid": "8c010714-cd22-43c0-bb18-e32042019901", "comment": "Malware payload", "value": "1f4de4dbdb0c95ee5c637afbaffe612236a20214e3271b19e789d88e1df7d302", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700072, "uuid": "7cebe382-19db-4f41-8641-18ae6494fb5d", "comment": "Malware payload", "value": "b54299a10b57725abc6e606604aabf0fd676efa3", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700072, "uuid": "1d7026a5-d4da-484e-9fb6-4d73c7222619", "comment": "Malware payload", "value": "d3c2f525f4a70d2be4bf8aa688872f0f029693916b3391912e1cf8c187cd0cdefeda92031c72ac15af25988bbfd03e36", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700072, "uuid": "cabeddce-2831-4f8f-a09d-7fff20528147", "value": "6C33F188C6C8E375A8F17831AC78CB01D578AABB4416C56382F74AE77C4BD91174ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700072, "uuid": "9af0de15-03c5-4b8a-b838-16e7feea0615", "value": "768:fwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2w:WFugXVpoD8ZxhrLAuNS07MrxrKsYyCPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700072, "uuid": "fc481d66-4fce-4761-8b81-9ca777922b22", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700072, "uuid": "39a82c81-2ace-437f-b4ea-b143ce9e1ca3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700072, "uuid": "95019fd0-8ce0-4e11-96a3-f31c134117d2", "value": "catalog-1268877465.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173dff0f-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706047, "uuid": "4855a5b3-16e5-4cb4-b412-4cd9943b5201", "comment": "Malware payload", "value": "efa52fc7fc8613b2d42387dec78652f7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706047, "uuid": "f186dfd5-5e7b-450f-a1cd-f0340f019624", "comment": "Malware payload", "value": "1f51a5f5812aa7e2e4eeeffe271a62f3b10ef35a06886a397628b824a1e48995", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706047, "uuid": "6b3bec03-f4a5-47cd-861c-78fd739f9cc7", "comment": "Malware payload", "value": "d485ff8170a6677e9f055cbf84934c54c6de0ebf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706047, "uuid": "9c8abeb3-3645-4a8c-be35-62ef251a7a26", "comment": "Malware payload", "value": "a29a1f719b5fb79c6223481475f83cf79ba1a5e8850549a09fa60d64b0a365f0e33ae3f3b62995daa69300885ae3bbbd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706047, "uuid": "39e3eea9-91b2-469e-849b-ce88687611be", "value": "D633022948AE3629133E10F4C585EB4EE5536C9D387CC6829CDCF475EC062A9123EBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706047, "uuid": "86222731-117d-4b93-b82a-732b982b4eb8", "value": "1536:/P6z4+ADViS8CWoD94pUnQ64x11RiCuOO:nPZBiS8jopkUQ64xAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706047, "uuid": "a594ea5f-e451-4d4c-acac-0a3424e6ba67", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706047, "uuid": "08d6fec5-95b1-49b5-96a6-eccaa682ccc2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706047, "uuid": "c0c43b93-3192-41ff-ac5a-cbc9c5c80dae", "value": "statistic-1987221763.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33421371-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702228, "uuid": "ee73b90c-1995-4960-bd30-c52a68d72158", "comment": "Malware payload", "value": "c2e2e111a31c76154498de34bb80a3e7", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702228, "uuid": "18807c9d-6e5d-4f70-81ea-00d2b235d80f", "comment": "Malware payload", "value": "1f657e121ced2c8c89b5635bb67c437ea6e34518da1f7aa8882f346749e8b403", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702228, "uuid": "922aa50d-982a-4b2e-aa74-e1b416731582", "comment": "Malware payload", "value": "3a5a6dcf8e85429058c97cad72d689ce3141d422", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702228, "uuid": "2560ec09-ec09-4768-9b21-2ba764656641", "comment": "Malware payload", "value": "edbe6440a601c3a41748d281c12ddf39efc30eae9bdfce9a4210c7e574f2ce8f6859fbdbf37f94a7d72e19dc00e723ca", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702228, "uuid": "5262ba75-97c0-43b1-a2d1-027662d5936e", "value": "F833F1C8C9C8D372A9F678319875C701D474EAAF4817C46282F786D77C07E946B4A9DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702228, "uuid": "e77940fd-7bcf-430a-b360-a19b4f86409a", "value": "1536:+FugXVpoD8ZxhrLAuNS07MrxrKsYoR+/pm8:4q41rLZNkZLY++/s8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702228, "uuid": "6af01c0e-c657-430a-93fe-64f4120e218d", "value": 51493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702228, "uuid": "3b3080de-7c3e-4ff7-b7f2-fd647d6866a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702228, "uuid": "af156384-c55b-444a-a62f-63914a6f684c", "value": "catalog-989897969.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c90890-a8fb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619708376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708376, "uuid": "c1768b7a-087e-4688-9fff-ade01b635e6f", "comment": "Malware payload", "value": "986f1b8f762eaa0d988202bbdfa2f578", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "Servizio fiscale", "colour": "#E53242", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708376, "uuid": "14913808-926c-40b3-a796-d2bc9a846d2f", "comment": "Malware payload", "value": "1f6a51e3994a9dad9fa89a8fa5e6db69407b0680b2beba1eebd39eba5a9088d5", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "Servizio fiscale", "colour": "#E53242", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708376, "uuid": "37fb7ef7-9597-4568-95af-4bd9b668e702", "comment": "Malware payload", "value": "a31f2e0b13ea224096c089f0af42cbd6445b6d23", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "Servizio fiscale", "colour": "#E53242", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619708376, "uuid": "6688f6dd-e51e-4293-8cb5-9448c21f9749", "comment": "Malware payload", "value": "c55e7c789da63718b95073edd683a29725d62e6cc34f6ff99f434cba99cac5a5ec42a5ac0f936e5973a987367f890613", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "Servizio fiscale", "colour": "#E53242", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708376, "uuid": "21881d76-8741-404c-ae54-8cbc2cd22ba9", "value": "43342341F5F07CD0F17B4E2D4C2DA85E5609BC93EDA6CAA08B6CF33A718B318A527165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708376, "uuid": "352b2eef-a5f9-4c7e-a54e-1be103e3a297", "value": "6144:VTQ2IUD1ZtffiO5CXsQF1U/0CbUvXLEt9zpqoIM3k++Erd:VTQbkJff7CXs06/0h74WGl+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619708376, "uuid": "dea91287-9f80-4529-9f2d-ed627411db3a", "value": 250556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619708376, "uuid": "84469b6c-eda7-4cd2-806e-a74c43b2a6a5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619708376, "uuid": "c5b04b31-1df1-454f-a7bc-f1a2c798d454", "value": "Notifiche.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f72738-a8ec-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702011, "uuid": "c61c0ae5-2ab6-49b2-a5e0-7fa79d636ff5", "comment": "Malware payload", "value": "ef13f0096f753be510b458701237f7bb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702011, "uuid": "a8596e1d-8316-46f2-a15f-8d12b029cf0b", "comment": "Malware payload", "value": "1f7e654b5dff89cbb2c87b706ebcac5957486f3ed3f355555e92a1d48e8e4e49", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702011, "uuid": "248a489a-febc-44f1-b818-7ce63c6fa88d", "comment": "Malware payload", "value": "f499060a772e18308103f2d1ead9fb1f31906085", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702011, "uuid": "d5ed8698-7512-46b5-8ac0-60e73ceadf5c", "comment": "Malware payload", "value": "41559bf4213d3dd659657f4509294896be037c5f2f222732c6e16d135d9762023a66f21683c6ac9e0384a0bda46d9e82", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702011, "uuid": "dab1deb1-c251-4eaf-9521-5900a875cc85", "value": "6D33F2CCC6CDD33294F578315C7ACB02E578AAAF4816856181F74A9BBC07AE55B4B8CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702011, "uuid": "4bdc3e5c-c2eb-43d9-974a-08f3554817ff", "value": "768:GwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV26:bFugXVpoD8ZxhrLAuNS07MrxrKsYxOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702011, "uuid": "c46b6d4a-b3a8-4ca0-b371-4db4740d0cd6", "value": 51492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702011, "uuid": "1ada8717-4835-4a5c-9558-2ebe4416dafa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702011, "uuid": "3914bb7c-08bc-46f9-8945-f8b95f144bfc", "value": "catalog-83279904.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28605156-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659690, "uuid": "d371a708-a533-4d73-8446-e189a5923ed3", "comment": "Malware payload (Quakbot)", "value": "7f99f45b5d981bce6f3f39ef56859a6b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659690, "uuid": "2d4de172-1452-498d-8b90-407b17b8ae8d", "comment": "Malware payload (Quakbot)", "value": "1f7ee05b10b8fce63defbb5e6ba4b721f35bebac1fc211994e4558c20b5aa647", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659690, "uuid": "a5ce0112-4bff-44c0-97f7-936a57247f5d", "comment": "Malware payload (Quakbot)", "value": "e55b0f556101ec409d4e22c207be5967ee4664ae", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659690, "uuid": "eb5fe4ce-90be-4cf2-88d9-c09128531561", "comment": "Malware payload (Quakbot)", "value": "0053243f8438eeb38f4aca2d90901bb08932ee1db35b0a34339d9cadeaa9e8297c2e732c588fb17284b48564f20de462", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659690, "uuid": "9f97a597-19c6-409a-98d9-fb786a83db8c", "value": "9874BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A47C37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659690, "uuid": "8e75897c-d6b8-4486-89ae-d5e5f72e62b6", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659690, "uuid": "db82ff22-d8ce-40b7-a309-96116d70dfca", "value": "6144:snQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuA:7FrkNK11G9AEtMxQyOi6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659690, "uuid": "933da1ef-5822-4016-84ed-76201d38c5e2", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659690, "uuid": "aa5110ef-8b76-443d-bb67-329f9ed6a921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659690, "uuid": "ff15a769-e4ef-4918-ae2a-d74b3fe1937a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b22b261-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659694, "uuid": "6ceb3ca8-535a-4ba5-98f8-87c422df4dbe", "comment": "Malware payload (Quakbot)", "value": "ef393523c30a5a89de5a321cc4e78050", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659694, "uuid": "6d10a151-dfef-43c7-871f-98d5dd555af1", "comment": "Malware payload (Quakbot)", "value": "1f9d7e0e606b7bd6f0298976c3ce1a78f70b75a342450d059e9e8c3be6efc6d4", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659694, "uuid": "a3a2ccbf-a20f-4016-bdf2-a07e2e03caee", "comment": "Malware payload (Quakbot)", "value": "9bc7ac33b109e923eb2982d5959d2f09d12e1cd6", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659694, "uuid": "ee93e7ce-a0cd-4c3d-bd3a-0465b34d55c6", "comment": "Malware payload (Quakbot)", "value": "09e64963bb67ddb4e11e778bc9f3ccf6280b37e1ff3dbf2992ff541e7432c94db7e495602f6b895e39fae51916519e99", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659694, "uuid": "3432ad99-829a-448d-add5-d36ca3215fb1", "value": "3374BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659694, "uuid": "0e328585-bab0-4952-84f9-f51f1c2e36f5", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659694, "uuid": "f5757bef-509b-4889-a62d-2915715f8b59", "value": "6144:rnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuN:cFrkNK11G9AEtMxQyOi6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659694, "uuid": "b42271c3-96a6-41e8-bf86-07c234940f22", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659694, "uuid": "9a970e1a-256f-43a0-b025-d8294f45d0aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659694, "uuid": "73c17505-3f50-4860-b014-5bd5592754ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99201d8c-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706264, "uuid": "ef31ac36-6622-4948-8126-d47be2bccfa1", "comment": "Malware payload", "value": "abe2bffb370976c245f62cbfffdfb3d8", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706264, "uuid": "b04a43f6-810e-4107-aecc-cb081d701a9b", "comment": "Malware payload", "value": "1f9fc58e812f62cbad3215f6c1df6f87815c81b692da4c6a9e26fd904c5997cb", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706264, "uuid": "74b65d51-f502-43ad-a9bf-8605fcafb124", "comment": "Malware payload", "value": "c0c07d68dd53a6e425ea71ee1a61f011f1dc6737", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706264, "uuid": "016767bc-628d-4117-a4fe-0e0608d22c70", "comment": "Malware payload", "value": "ef6ff412969a276c199f45f17f73b1f0e070a90f41a0e696db90a3576dafc380e7f79c73f9e22e2a610b86b324a6c905", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706264, "uuid": "6a44297b-9408-4e34-b4ea-a8094a0d40e4", "value": "4D330116486E762D673D10B04685870ED653ACDD386DC6011CDCF8BAEC06AE6267FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706264, "uuid": "49370f41-d159-44a3-b44b-8d3537942c51", "value": "1536:FP6z4+ADViS8CWoD94pUnQ64x11RiCiFVGq:xPZBiS8jopkUQ64x4/Gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706264, "uuid": "6826020d-3fea-43ec-aa76-2b3f0bda7247", "value": 51486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706264, "uuid": "dd94c3e6-3212-42a5-9fd8-a240a19d6f11", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706264, "uuid": "8be83274-87ba-4dc6-b558-e65aac8f5de7", "value": "statistic-233330307.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de8c943-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659699, "uuid": "b6ace25b-35d2-474c-93be-3252d748a3b2", "comment": "Malware payload (QuakBot)", "value": "f00c1ba8ee2e785671cbcacf7aa754cb", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659699, "uuid": "5236b2d2-89af-4603-9e00-55953dfa2b34", "comment": "Malware payload (QuakBot)", "value": "1fa864e202dc4b91fbcbb8b7e124234420455a5d401e455f04e0abc7cdbe612b", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659699, "uuid": "70df15e2-5996-4d73-b9d7-81e42b1259b9", "comment": "Malware payload (QuakBot)", "value": "6462dec53f3e29052c1aa59646cc675f91607452", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659699, "uuid": "36da8981-0dc9-4b4c-bfa7-613d0e2cda6a", "comment": "Malware payload (QuakBot)", "value": "edefcf981d63a4f8ac932b33174c35be2ae83d993b04b03ddb942456f57faa6ad19501e36e0f2227a1d2b3a3ece36a00", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659699, "uuid": "82d28541-2f14-4b83-8d7a-1f9b5eb280a7", "value": "B1549E7AFA12DC02E7A82BF023C36F581A579AD53120251F55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659699, "uuid": "6513e341-9971-4c7d-b433-38e99614f2ec", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659699, "uuid": "74791382-c17c-40bb-a4c3-87815f0aae12", "value": "3072:B3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZhB:xvv9sMoXBaRmr/dukbvuZ/7fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659699, "uuid": "aef13e50-c7ba-4ba5-b89e-b18a6f0f1e5e", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659699, "uuid": "92f5f4f6-3d86-4111-b690-beda1ab08edb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659699, "uuid": "a9e7eef6-9f60-4ca7-8061-5181b14332d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cbd47c-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659704, "uuid": "534aa7da-7448-4db9-aa4c-1fcd1b8f100a", "comment": "Malware payload (QuakBot)", "value": "914b2898a0f8e8e8bb1cf8291d9aae0e", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659704, "uuid": "36f5dec1-bc10-4a6d-aa33-bc074396c221", "comment": "Malware payload (QuakBot)", "value": "1fa95e91b811c1fceab963a1190c45a7a33bb8d9d695c0570f5b1e9e98436d23", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659704, "uuid": "0edb0867-d05f-42d8-9457-5ff9c829a3be", "comment": "Malware payload (QuakBot)", "value": "ec452b22e329a8ea37f754b17ab8477cbd2cc397", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659704, "uuid": "ad633313-75c6-4438-b4f5-11f45e8837e1", "comment": "Malware payload (QuakBot)", "value": "d17552b3a27f63974e16bc5d6aff63891a35ee71451c004478c59dd3d125dff4bcf91291a15b0fb5f6456793e7a03acd", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659704, "uuid": "77fbf8f4-3ace-4a4f-9163-5cd9abab952c", "value": "1C549E7AFA12DC02E7A82BF023C36F5C1A579AD53120251B55F55F58BEEA3843D23B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659704, "uuid": "126869d2-54f5-4a79-ba41-74f3d78a4c09", "value": "43e5d7f630d7b07f03bf2c008cf04285", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659704, "uuid": "450f5721-1096-4430-bb4c-44604e0992e4", "value": "3072:u3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZ3v:qvv9sMoXBaRmr/dukbvuZ/7f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659704, "uuid": "26c1d247-0f19-472e-be65-8e47031fc6a1", "value": 302056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659704, "uuid": "0dac615b-b3db-4397-b4e6-862299ab0a3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659704, "uuid": "2fc38a88-cba0-4c75-b01e-8526ad2cb5de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7a8740-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702267, "uuid": "8e9e42dd-f563-4b86-bba4-9b8af1b531d2", "comment": "Malware payload", "value": "0d1325586191d0219bfbe2f572b23394", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702267, "uuid": "a12418b7-1ba0-4a60-bc94-39a0d3fa3808", "comment": "Malware payload", "value": "1faeba9d9bbb1bee7f891a277a5eb8f199aac357f9a52024a7f8bdd2aedab48c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702267, "uuid": "53730ac3-7c0b-4699-b97d-f42a90debcbc", "comment": "Malware payload", "value": "161d49f78d9633722ec5e99f9a5eb8266f12a3e4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702267, "uuid": "75fbb9ca-130f-408f-8f1d-160de7f9cc3d", "comment": "Malware payload", "value": "bdda737f8c15f12b72000cdc197e1a1b3677e125dc8c577fad8b7e141ee85a2381eed241b64eb0f210a661b01b2aed52", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702267, "uuid": "fe1adabd-3c7f-48bd-9f5b-506c9ff829e0", "value": "2A33022F486DB729177E20B18984872FE2137889382DC9955DCCB4B6B806AA9013F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702267, "uuid": "4e87dd83-9fb6-4b31-bc01-3ca05ea7daea", "value": "768:19cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCoi:QP6z4+ADViS8CWoD94pUnQ64x11RiCoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702267, "uuid": "2becedbf-8e68-43cc-8469-166e1f95ca8e", "value": 51481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702267, "uuid": "34c41b2b-0858-4c7c-911f-05d37cf3d4fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702267, "uuid": "e657e737-a72a-4b9f-8305-acb4a0581dcb", "value": "diagram-1024789086.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195bce64-a8f9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619707339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707339, "uuid": "3572932c-bcbb-47d1-b35d-87fcc663c175", "comment": "Malware payload", "value": "8876c432fb1e52fbd0eea26271502233", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707339, "uuid": "e82137cf-b51a-421f-afbc-8440f2341cf7", "comment": "Malware payload", "value": "1fbd61cf5f376d8c8b8dd7a37326808bc2aac9f91ed5d38a2c178a248be1f41a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707339, "uuid": "8d3a3b36-4f41-42a7-a85d-9847b7ded1d4", "comment": "Malware payload", "value": "d8f5053eb4cdb769e0e03d8f953c7e9989e5eaf4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619707339, "uuid": "64e5201c-7c5b-4469-b085-9bbf4ee154b9", "comment": "Malware payload", "value": "a6d608868a4a90c86ccfae82924c44b1067628339c640ad0ecfbba17821a5c406749cb9b3fa1f8ce46e873cef4062de4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707339, "uuid": "0029beca-8dd4-40d4-83c1-9d6a801d486d", "value": "6933022998AEB52A573E10E486C59B5ED9076C8E3C6CC5811CCCF066DC067AE153F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707339, "uuid": "5c5cc9d5-f8d4-4a37-9210-cc2c00778162", "value": "768:r9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCPIN:eP6z4+ADViS8CWoD94pUnQ64x11RiCPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619707339, "uuid": "adc828cb-51eb-48b3-9c42-8db20e6fe184", "value": 51484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619707339, "uuid": "5aa35e17-b83f-4c94-bfd5-09f2cacc95fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619707339, "uuid": "5e6ab1dc-6b47-4181-88c6-1ee426927732", "value": "statistic-91033389.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c94b607-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700928, "uuid": "50237512-e065-434d-8c4d-4acb4e13a409", "comment": "Malware payload", "value": "8ca5b0de162a30fdd938ae715b6bed05", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700928, "uuid": "e433fae8-2b31-464b-b255-d341234a2e58", "comment": "Malware payload", "value": "1fbf898ad82bb63a3d4fab2d049ab6d6c77262a73799659f12d0c58f67c5513c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700928, "uuid": "435a3094-aca6-4078-ae27-82a2d0c41fee", "comment": "Malware payload", "value": "490b97b954a44563830b1b0e12e1e97d56cbbd8b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700928, "uuid": "db0fbc2c-61f5-43eb-875f-7c843349b22c", "comment": "Malware payload", "value": "5ce341730373018f8e8ef88842aa57ba1ae45da5309b23d0a8493c5e849047cee08b2e2c5c48b5521d8ea321be131cb8", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700928, "uuid": "a8b9b2b5-54e8-41c7-96ed-681a03c87e18", "value": "79330284CACCD272D4F674359C7ECA02DA7469AF4417C96282F34AE77807E95274AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700928, "uuid": "167d0ff1-9fcf-4737-a7b6-2fab08a452f3", "value": "768:5wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2W:AFugXVpoD8ZxhrLAuNS07MrxrKsYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700928, "uuid": "7177f59e-784e-4b51-b85b-eab4ae304590", "value": 51496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700928, "uuid": "292f00a3-3de1-434e-a827-bf208a4d8be2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700928, "uuid": "a2695cea-8609-48c7-8abc-d18b699c90fa", "value": "catalog-1934826683.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c434ed1-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705625, "uuid": "bf72bbe0-ded0-4b48-9fa3-fb6214e85d67", "comment": "Malware payload", "value": "9cac973aff42e074b09e167fe2782897", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705625, "uuid": "88740d3c-56e7-4770-974a-5db10a1d4462", "comment": "Malware payload", "value": "1fd10bfd553d468f852991d4a4e5318ed53e79f906156e57e13c8a2e400f181a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705625, "uuid": "630b3891-05b9-4a1c-a743-7d63175652b8", "comment": "Malware payload", "value": "f819d14fdedb365f5d7f1a6199057e4ad7150101", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705625, "uuid": "ab067c18-b0ee-40f7-9601-c18d7e69d659", "comment": "Malware payload", "value": "0e342c066dce96e6ab49879a12c28af379e648cb21cb0f150c0bacbda851ceac3ba0a7f1448079b6f1a0d5b2d99de6e5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705625, "uuid": "d2049178-ab1f-4fba-81b3-0fe00d5b636d", "value": "E433020D58AEB72D532D24B486848B5EE5036DE9341ECA450CDCF466EC066ED263FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705625, "uuid": "13249acc-bd10-4a36-9add-cf8bc2f2994c", "value": "768:B9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCmX:0P6z4+ADViS8CWoD94pUnQ64x11RiCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705625, "uuid": "49858f1e-8644-4bac-9f13-810abfa27f0c", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705625, "uuid": "68294511-abfb-4ffa-97e2-6baea1081080", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705625, "uuid": "f1b14f0f-8bd4-4a65-8535-c308ea6f31d0", "value": "statistic-1638689965.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d17280-a8cd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1619688547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619688547, "uuid": "3a8cc144-9652-4e79-a00e-972fba7affe9", "comment": "Malware payload (AgentTesla)", "value": "2ff147c559e8e1d1fb3f48be996b3c61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619688547, "uuid": "4bc60576-8f13-4b00-bfc0-858169f8de09", "comment": "Malware payload (AgentTesla)", "value": "1fd2142f935c26010fb1bc1a6497d9650fe07b8c4ef13c778238702edbe0ec95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619688547, "uuid": "ee3b4847-e132-4f1a-95dd-ea062a2274eb", "comment": "Malware payload (AgentTesla)", "value": "1650005f5460d6885441dafa591ff7a993778392", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619688547, "uuid": "7d624d9e-22ea-4f39-abd2-1d97fbbc5554", "comment": "Malware payload (AgentTesla)", "value": "4451de5e8164d98597d620a0932d78f9538473fbd0d2da6da7bac96b8ad051e9b57b41421712f93fb9402c17ad4bae9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619688547, "uuid": "6f64405c-803a-48f6-9549-6d3cfa490865", "value": "92C4F12197D88F16E2BE67795872800047F1B947D733F78E6D9D406E0EA27C086A2B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619688547, "uuid": "a53040b3-aa4c-4d1c-80c3-1489f6712ece", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619688547, "uuid": "96dde2af-152c-40d9-ace1-0fa65b240fed", "value": "12288:GwGE9bnmfaakeIXmpbxtKCYaZuF0x0FDucuZNdYAli:bmfYungYoF0sIbd9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619688547, "uuid": "cb11bb11-0255-4f87-a999-deb55668fed5", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619688547, "uuid": "ed1bab46-bd33-4199-a564-28527ef1f1d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619688547, "uuid": "25752d60-95a3-41cb-9522-777eecc13f0c", "value": "2ff147c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4a2b08-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701383, "uuid": "4da2cdfd-4a1e-47d1-add0-795ec56ceb86", "comment": "Malware payload", "value": "c4a189cb38c6323f2c55962b224b7089", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701383, "uuid": "0a2b30ee-625d-46e4-a454-6a03d2a4e0a4", "comment": "Malware payload", "value": "1fda0b4115a9ea3627ee11e667c165330028f9c3e83dcb55a19ae4df87583bbe", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701383, "uuid": "b66c7c9d-7f17-4faf-a6a0-5257bdb1d727", "comment": "Malware payload", "value": "378403586c0a27f13da666658a1b09aabe997ad4", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701383, "uuid": "5394081f-21e4-4fc6-968a-73f3e6093b0c", "comment": "Malware payload", "value": "9c1886cfea03625b1200e5786058b1b03d7eeda863b768e87a6331b09d3b340637e92444901a6d8528c0d67d978cfca4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701383, "uuid": "b146cdd6-7786-41d4-a0c0-55054e6aa104", "value": "DF33F248D5C8D37298F63475AC7DCB02D6786D6E441BC5A282F30AE7B807E95174AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701383, "uuid": "bcec1f01-8919-47da-8d95-25ed8fe0b1e6", "value": "768:4wnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2O:VFugXVpoD8ZxhrLAuNS07MrxrKsYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701383, "uuid": "5c88130a-b171-49ce-b608-507ecd59cfe1", "value": 51491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701383, "uuid": "d77b41e2-a951-4199-a986-9795e2d5858d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701383, "uuid": "c90f7c5f-66d1-4959-95fa-7a9352b785b2", "value": "catalog-33945430.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192bff7f-a8ef-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619703043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703043, "uuid": "fd8ba28c-3ffa-420b-b079-6b2af643a746", "comment": "Malware payload", "value": "963e6a5104c7b9167a5d71bb93407c9b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703043, "uuid": "30fbf462-a130-494b-b9b2-647c36da8c81", "comment": "Malware payload", "value": "1fdf6056d7fb570db8fb654298f09d4fd2215b80a192549ddff6c1e48c3e7454", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703043, "uuid": "78822c0a-16f1-4914-aced-c6bfb1eb3693", "comment": "Malware payload", "value": "28148ece335f4220bb57d1dd634facbd3631ddfd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619703043, "uuid": "824f3dcc-3430-41d1-b70f-c9cfa4a64c2b", "comment": "Malware payload", "value": "cd787f6b5c08a65ab8f62b052bc351d1bf6275f4d79da3fb4adbeea564531465e4b96bae44c205808ac11af96fbd4fd1", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703043, "uuid": "64438d5a-0753-425b-8b0f-a71a8da71416", "value": "4F3302259D6D7A19473E00F08985CB5EE61764AD386DC9822CCCF4B6EC057A9013FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703043, "uuid": "28309c79-00d7-4d8d-a596-404ab57a3d6d", "value": "1536:JP6z4+ADViS8CWoD94pUnQ64x11RiCg+H:tPZBiS8jopkUQ64xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619703043, "uuid": "4dca5138-d857-4a83-ae70-8c4ad1754a1c", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619703043, "uuid": "60f3595f-7349-410d-98f8-699929ae9b60", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619703043, "uuid": "d1b5cdab-9f98-463b-b9de-e7c2360e8c67", "value": "diagram-1678084566.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26158d9-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705985, "uuid": "bfcaa547-ad7f-4882-b7fd-0603cf483f31", "comment": "Malware payload", "value": "4dd57cc223254d18f549ed5b0a350c6c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705985, "uuid": "58735a11-8690-4bb5-8abb-b8e44c88aefc", "comment": "Malware payload", "value": "1feaa04f14698a5a384370694b199cfed2bbba83dac8eddb3679aacd683f148d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705985, "uuid": "f2d30a55-b1d4-4c89-9b33-7203d90c8ba8", "comment": "Malware payload", "value": "109d26f646de7c610271474b7d913b4d512811a7", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705985, "uuid": "03c118eb-d0cc-4aae-b04f-9726d0e5a722", "comment": "Malware payload", "value": "6a571d130c5160621dc48f9a4ee853207aa4b646f21f01e2689c010a81f144110e657279d1805a044c9544952a286cc3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705985, "uuid": "96704854-473d-42e8-b44c-4674ba64fae1", "value": "ED330229586DBB29632E20F48685DB5EE213289D346DC6821CECF4B5FC05799023F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705985, "uuid": "76d16afc-1d21-4b18-a273-b63d46170d3a", "value": "768:q9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCS0t:TP6z4+ADViS8CWoD94pUnQ64x11RiCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705985, "uuid": "c998bb5d-6256-4216-8aae-2a37d88c089b", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705985, "uuid": "6b655d1b-493a-4a6c-84bc-40b102f92cd6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705985, "uuid": "b29435d6-0f9d-4ec2-a402-f0c178209525", "value": "statistic-1930452079.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47489253-a8ea-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619700973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700973, "uuid": "90e80e41-0b21-4c99-8bf8-a27eff9ef7df", "comment": "Malware payload", "value": "3e68dd17241d500003137bb153a02c2f", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700973, "uuid": "c6fcf7da-06a6-4bd7-a471-92309ac1b06f", "comment": "Malware payload", "value": "1fee0a495cf940ab4149b6d7562146b1d96c1f1255204a1b4f0347d58100ceb1", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700973, "uuid": "1f06b967-db17-42f6-afa6-2d9f1c30019c", "comment": "Malware payload", "value": "478e0843e8f1e8a4d42a416d100650d1621fcfeb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619700973, "uuid": "08373b35-bfbb-40bf-b3b2-1408d7616ad8", "comment": "Malware payload", "value": "e9ad40cd06367f3179e47ddbe9a9866d54b3770b2b55d474cfd9f9846c085e015ad6abc5fa3170a359b49f762cf4f5e4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700973, "uuid": "8449bf41-0a60-4faa-8265-df2bc1e64cd7", "value": "1633F288C6C8E375A8F23831AC74CB01D578AA7B4416C5A382F74AE77807D91174ADCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700973, "uuid": "844e5bb4-d43d-4892-8cd4-5f49d58cf11b", "value": "768:iwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2e:PFugXVpoD8ZxhrLAuNS07MrxrKsYrmPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619700973, "uuid": "e6222851-306e-4ffb-b85b-c1b7d041c9a9", "value": 51495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619700973, "uuid": "df4cab1b-04be-4845-a214-6c877f3ce2ef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619700973, "uuid": "8e31d180-5218-4b56-84c8-56e3f1fd7b81", "value": "catalog-1983319373.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d6e207-a8dc-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1619695255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619695255, "uuid": "01f9f2b3-5956-4a47-ae0d-b6f245e69e4b", "comment": "Malware payload (Loki)", "value": "6e302aa252ef21adb6ffc0476502ea42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619695255, "uuid": "357d39a9-4a16-4fa9-ae86-30652a0efad0", "comment": "Malware payload (Loki)", "value": "1fff9bc7af93cedafe6e4ae26e1e8bd1be11a11a193f05d3ec993a3c0332e864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619695255, "uuid": "04c72a52-51b4-449a-abc9-2630357d1a23", "comment": "Malware payload (Loki)", "value": "40e3b287e1b739ecb6ea93e2b93fbc38d3d05837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619695255, "uuid": "ee4d0c00-e8ab-459d-b9f5-ff79e385a302", "comment": "Malware payload (Loki)", "value": "c098abff2e134b14d44f65094c943935d97927d50d6f883cc8af7b111f61629f5063e5b61552877f74b4f30511543988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619695255, "uuid": "70d56b23-b3a0-438c-bfe5-24a56001cc5f", "value": "88355B9CB10064EDCA078E3297EACC3182212D74663B950E57973B7B7B7FE536A34486", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619695255, "uuid": "aa89293e-c488-4cec-934e-6309e6602fa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619695255, "uuid": "878fca50-3016-4237-bb5b-b39e1e730753", "value": "12288:8jboM8tC9toLLoS60/K7yh0Dp7tfUIvR3eIsyUkuuV+eeqz8+m7vz/WZBPburevh:8PX8goLALUgfsybzIeeqz8zN1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619695255, "uuid": "9820b86d-2de9-4c8b-9b03-59790c392a9e", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619695255, "uuid": "0f748716-76d6-44cc-9836-9faca9bea79b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619695255, "uuid": "b5e79d13-d7f0-4726-bf6b-0affed6bff6c", "value": "TNT ?????????.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d80b453-a8c2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1619683831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619683831, "uuid": "56b29446-9552-4527-bd53-e4f40749e5f6", "comment": "Malware payload (Dridex)", "value": "ea102f71c25f198bc8737fca6d3bccc9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619683831, "uuid": "d231743c-a4b5-4173-8504-3dac41e12481", "comment": "Malware payload (Dridex)", "value": "20077209bc6c3acb683c4f7251f68498a12ab4e16c03b1552035e421ba082ae9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619683831, "uuid": "cf20c81f-7269-4e4d-b052-36041f41e401", "comment": "Malware payload (Dridex)", "value": "e19ec41628ea690b40af693889bf67a6a15cfdc1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619683831, "uuid": "aa067e83-2aaa-44e9-ac69-a30632002ba3", "comment": "Malware payload (Dridex)", "value": "e1de91bbae628aaeefed45f51ac1909d1a69125be7e6915cbfb1ecdbcc730da66c6779390fd15fda97292ce94b3838bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619683831, "uuid": "6b2f3d28-cc08-4437-aabc-03fcb100e4c7", "value": "67F3E0D2EA8BD390F5DFBC7E385B363063B999498603C45F85A99DCE9173148B7DA800", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619683831, "uuid": "dc8fccc0-8726-40ec-a492-fd2b5f6ef448", "value": "7b12f79fcc0e8385730e3498b17dbc72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619683831, "uuid": "b364aad3-31bc-48a7-8dd6-d9928b28c77c", "value": "3072:9oSuywe6x1ACSZEuNtV+TkqDXkyzbMeJRL3CNa/U9fStrveyk8TZgEd2aGkFY:mnS62Fl+pkeJl3CvRStrFl+EYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619683831, "uuid": "10fa975d-4062-4f43-ace2-38153780b16c", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619683831, "uuid": "1b93a265-5852-474b-aae5-3c1a6a616f77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619683831, "uuid": "d5f22a68-ca6a-49ab-ac9f-ab69e3e8421e", "value": "ea102f71_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3391869b-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (QuakBot)", "timestamp": 1619659708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659708, "uuid": "c08cfc95-2c1a-4598-965b-248fd1573f42", "comment": "Malware payload (QuakBot)", "value": "fa74454e33690e122877ef8970fda480", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659708, "uuid": "ad55baae-23cc-4612-88be-d65fbae92883", "comment": "Malware payload (QuakBot)", "value": "201575c4fb31c590b4883d039846f7dea609a41f5226a2c4429786160019801d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659708, "uuid": "c7eb0ee3-73ab-4f5f-9279-b2a4320f1af3", "comment": "Malware payload (QuakBot)", "value": "aff2f046300b3f93c42cc92c5fde1031274d7d75", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659708, "uuid": "64b49594-4e47-4af3-b928-2d391611d1cc", "comment": "Malware payload (QuakBot)", "value": "fe43681921c20c6cad3ef8c1064a6de334345fa3c9fbf5a58bd906356fdfbab2f0946aff4e8203a4e7b0c1b205d6312b", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659708, "uuid": "5a6724a0-224e-4ca0-bda9-84a5ce515f00", "value": "D074B07DBB17DC23E26C1BB062D35B581A53DAD63250210A0AB19E58ACE73E47C37ED4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659708, "uuid": "1cee9373-d832-4976-8b88-a547ca0125da", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659708, "uuid": "cdbdbafa-087a-42f5-a9ab-68369c1300d3", "value": "6144:MTfmt7eZAPOyKmLrLqGvHr0nNK11G9DMQyaViFwRuV:Mbi7/xZrkNK11G9AQyOi6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659708, "uuid": "14fcea58-e5fb-4de2-98fe-345ed4bb90ac", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659708, "uuid": "9f1eead5-1070-417f-b9f2-67dbc6a424fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659708, "uuid": "194b41e4-ce17-43eb-a35d-a07b83222e16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccefb5c0-a8eb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619701627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701627, "uuid": "dc984b5a-61de-4635-84eb-48bb5c5591b5", "comment": "Malware payload", "value": "c48a425d97dfafb6c053044fb97e7224", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701627, "uuid": "948027ab-a8b7-431f-8ad6-78dc50975356", "comment": "Malware payload", "value": "20203e64a68648602f609c9f25dd5c02901161afef670f3e57734e1b287a50ed", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701627, "uuid": "5c23b651-72d4-4c37-9dc4-933fd5789780", "comment": "Malware payload", "value": "6d4c9fcdbc0d311c8923fe1772eae6679f5f47ac", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619701627, "uuid": "4bd33156-16bd-4fd3-b7db-ddaf3323d3d3", "comment": "Malware payload", "value": "263712df0f3b4dfdc261f8376db8113d34c05a66efb82d439615e17f21b36fbf0e19e6d4e5acb943fbb8d2ab938005f4", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701627, "uuid": "68c43783-15e6-4a7b-9fcd-f286efa7ad5f", "value": "7D3301C8D2C9D37199F13871AC75CB02D478B97B481AC4A281F74AE739079D62B49ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701627, "uuid": "0e0d3529-2e69-4a2e-b933-24ab6c46a699", "value": "768:HwnXjcAu3wogbMdgckpkWAog2S8xXx9SOrLAuNgTJSR6Lbr03FpN9MrCgrXasV2S:eFugXVpoD8ZxhrLAuNS07MrxrKsY980m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619701627, "uuid": "c80e4a0e-0d18-4b9e-a011-966993d5fe67", "value": 51494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619701627, "uuid": "be653e98-c120-4a6b-81fa-fcf299bd05eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619701627, "uuid": "ceae6007-ed57-4d12-a39d-673b051d46db", "value": "catalog-534062749.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99002803-a8ed-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619702399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702399, "uuid": "256fea9a-09ea-4f7c-9b68-b898645f2b88", "comment": "Malware payload", "value": "e427cbd184cbead6cd7534e2c0ef8bcd", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702399, "uuid": "d5575fb9-faef-4cc2-80f4-adbb92ba138f", "comment": "Malware payload", "value": "20392ad66a9461c31040d7554088dd88ee5bf9bf9ba1ba9b116b2744ab1aa0c2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702399, "uuid": "db2d7183-6ada-4e50-9568-f5f811d20a3d", "comment": "Malware payload", "value": "7bbeba6d863e828498eb3f8bca88c75d6ea45ced", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619702399, "uuid": "4260c580-995e-4ced-b195-af6facaf92d5", "comment": "Malware payload", "value": "df0269051557acf4083a8c856faca739c49a969270b0552d1e9a4147b851e4acce939ffc1ec31ff96069d7308d93ab8d", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702399, "uuid": "0ae93d84-6b54-44a6-affb-fc377e3c4eac", "value": "6333012A886EB639172E50F08549D72EE61768DD385DC9822CDCF467EC066B8113FB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702399, "uuid": "f2394f0a-9a92-4842-87d8-135f8784a9ca", "value": "1536:HP6z4+ADViS8CWoD94pUnQ64x11RiC6ew:vPZBiS8jopkUQ64xVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619702399, "uuid": "24b599ae-85d1-4e63-bf2d-53f6b30316b5", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619702399, "uuid": "1326b5e5-b7f1-4bb2-9122-7df1a9cb5fdf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619702399, "uuid": "4dcd3359-3843-464e-b04d-c2100e39e09d", "value": "diagram-1133119604.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804c4be5-a8f6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619706223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706223, "uuid": "79a5ff3c-b9de-40c3-b366-b8ccda28c551", "comment": "Malware payload", "value": "45b5f3479dfa78cf4ce34facd19d4525", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706223, "uuid": "65d50617-727f-4524-9a35-15b9912d8371", "comment": "Malware payload", "value": "203d102b08ab1ee8211fc64fe83cde93c0aec2de4dbfd1a5ad6b41490a67ad8f", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706223, "uuid": "6bc0c95e-6c61-48e8-9a44-593d8d9610d3", "comment": "Malware payload", "value": "4777a996e408be83f300fa36c6b36da9f694eea9", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619706223, "uuid": "01f42bc6-a66a-4b30-a908-14ace920abc0", "comment": "Malware payload", "value": "0239a2a87ecbc4007d3fb71ef6fa7dda54e2974a158aa1ccd3f82c3e9836844c3aeb56c5cfc37dc65d1936468c08ea70", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706223, "uuid": "e553ffb1-7278-43ee-8126-6b9a96a5f3e8", "value": "4833023A597E7A25133D20F085489F5EE65374A9386DC9821C9CB462FC0A7E9123F77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706223, "uuid": "9b07bca9-f2e9-47a4-9608-0fc1a0abd586", "value": "768:i9cUo6zTWrEcNVPCltp+DViam48CWw2QmJi994p5CMUnQ64RHbbc4B1AIrNiCInn:rP6z4+ADViS8CWoD94pUnQ64x11RiCKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619706223, "uuid": "6f176f84-6466-41d9-bfd0-0963f5fbdff8", "value": 51488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619706223, "uuid": "0ffca065-0a03-40e9-bc6f-f7dd814dd1ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619706223, "uuid": "0c71e28c-0872-4da0-81c9-c132a7892101", "value": "statistic-2136707207.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4918e8d8-a8f2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619704412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704412, "uuid": "cfc7964a-a074-4a6c-a131-f312af5e1015", "comment": "Malware payload", "value": "733dd56cef07e80d6debd6d0dc142d99", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704412, "uuid": "f3b8466d-62b5-408c-b2a7-2baff7b658dc", "comment": "Malware payload", "value": "204898e1e45f87919e2cf7bb7f0908e6dfb19590336e639e80ab2914e3596b7c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704412, "uuid": "29c463ae-dded-4916-91ae-2f197579d9d9", "comment": "Malware payload", "value": "366143fd9b100cf8ca8852523fe6c247dc2285cb", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619704412, "uuid": "7c2cd4a9-1dd2-4f46-8076-1f13bda2409c", "comment": "Malware payload", "value": "fabc137508b29c9cb3a6f3a4e170430337c6b46acbc4c34e10200b482399efdfb6d96ddc47f2a3d30950c5f08ffa3fa7", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704412, "uuid": "f4682001-92e4-4618-a377-0d4ef5bd65aa", "value": "3833022F485DB72A577C10F5C589CB1EE507689E382DC9825CCCB826EC096A9153FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704412, "uuid": "f5705833-3ef1-4292-a3bf-3657be077209", "value": "1536:qP6z4+ADViS8CWoD94pUnQ64x11RiC+yJE:kPZBiS8jopkUQ64xcyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619704412, "uuid": "0b71d903-e36d-4b58-860e-ea24b5efcec5", "value": 51478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619704412, "uuid": "a63a418b-dc54-4731-b831-2d0eface5744", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619704412, "uuid": "18539b8c-c22a-4cd6-820b-187f90317adf", "value": "diagram-735137876.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df5f0491-a8f5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1619705953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705953, "uuid": "b38547d2-7991-465b-b3f0-36dc26b054c3", "comment": "Malware payload", "value": "2b4461a57c836a8ba5e022c46185c663", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705953, "uuid": "038ca4bf-1afd-4679-ae99-37ca5d51f0c9", "comment": "Malware payload", "value": "20496f608c4ddb005f9a8492cda90aae40b41f0ed328a4e38fdb336bfd776ca2", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705953, "uuid": "c91bb454-e6ee-4697-80f1-9bde7be4bee5", "comment": "Malware payload", "value": "39add30257ec15c7c8b4d0e4dc89940886b48ebf", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619705953, "uuid": "284eae2a-330e-46aa-a919-489cd525ba90", "comment": "Malware payload", "value": "5f2a3ed20ee4bfa124995114273ec9aab11a52d1f80e6f827b39e291aa48041a6c884fbb091b42b42923402b6ad4cf20", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705953, "uuid": "df344db2-6a74-4091-9a93-af307cb8e8bc", "value": "2433021D986E7A3E137D10F58980975ED55B58ED3C2DC682289CF0AAEC066E9013E7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705953, "uuid": "9ff94e06-1359-461f-8808-34b44229eea5", "value": "1536:qP6z4+ADViS8CWoD94pUnQ64x11RiC3a3/f:kPZBiS8jopkUQ64xBK/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619705953, "uuid": "43de44d5-97c4-40b4-8739-28561cfb3a9c", "value": 51487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619705953, "uuid": "6e8dbb45-c06e-4741-9f5e-8ebc7fff191f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619705953, "uuid": "1488fa31-09c1-46ef-b9c8-7365448b14b3", "value": "statistic-1900451399.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36513482-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659713, "uuid": "c0f10123-0143-4cf5-bf92-26591418c127", "comment": "Malware payload (Quakbot)", "value": "01f7e69c528a736fcd37690629203a42", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659713, "uuid": "7c8c46d3-1e20-4c89-83cc-b5ffba3d8705", "comment": "Malware payload (Quakbot)", "value": "204cf2f4f2ce8a0704b0eabbf0f40e48064442869ef7a6ef811ef3c1e3846dd5", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659713, "uuid": "dd5e94c5-ff42-45b1-9672-15bbd5c07673", "comment": "Malware payload (Quakbot)", "value": "72699c545560471876e1d6b8ccd736beefb0c407", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659713, "uuid": "e308d8a5-5b87-4a62-a1be-5da84707fbd9", "comment": "Malware payload (Quakbot)", "value": "997e557c390865751388e0ecf5ef0f42c86d0394e1bb1146350d84a1bc37249f2e56d7970ab0732988feb4e559fb5080", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659713, "uuid": "45e51350-a3eb-443f-a7b9-bb7569ecccda", "value": "5074BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659713, "uuid": "a493b454-abdb-4cb8-b6b2-094cb9bf5c24", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659713, "uuid": "da244745-d545-47fc-be96-a7509fa970bf", "value": "6144:TnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRug:kFrkNK11G9AEtMxQyOi6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659713, "uuid": "f506668f-fe34-4f4a-b2ba-297c1ffb05b3", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659713, "uuid": "85214d4e-78b1-4105-b4db-c6884cdbb8d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659713, "uuid": "42741807-48b0-486b-9f91-77ac0d171cbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3917e564-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659718, "uuid": "6958ebad-053c-4bef-8f14-7c9ae75fb2d6", "comment": "Malware payload (Quakbot)", "value": "33fa5b5264ff58c92dd993cdc146b462", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659718, "uuid": "1bf4f6a9-84e8-4666-8301-ca1805397941", "comment": "Malware payload (Quakbot)", "value": "2052110c44838f914f100b9a6abb1b924c435ce968edbdde114195c49d0bac8a", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659718, "uuid": "833f7b1b-3df0-4bda-9387-151a0e01c5bd", "comment": "Malware payload (Quakbot)", "value": "f9ab56af3a1b6b0be95e1fa426310a57951dbe3f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659718, "uuid": "ef4be098-39fd-412a-9f8c-bd9c0a62d5bc", "comment": "Malware payload (Quakbot)", "value": "b899b5064b656621b525bc7e32f25bf7f4311d839d3e031e784c81fcb561f6c0c7c09787c10482310e7bd014155aa1a3", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659718, "uuid": "108c5738-c8a8-4af7-99ff-d93be6013602", "value": "1274BF7DBB16DC23E2581BB062D35B581A53DAD63250210A1AF19F58ACE73A4BC37FC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659718, "uuid": "df20905f-d715-473b-91ab-452d8fd4bc8b", "value": "2f58585fc731a3646ea640dd58abbda7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659718, "uuid": "0f39b317-24a0-4c2c-9be0-75fc26eef00d", "value": "6144:FnQU+LqGvHr0nNK11G9DMEeZa8POyKmLUyaViFwRuS:KFrkNK11G9AEtMxQyOi6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1619659718, "uuid": "da5aea19-0015-4850-8159-7ec2e6b417a0", "value": 351208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1619659718, "uuid": "56e621ac-2c41-412d-8c3e-a755100ee7ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659718, "uuid": "26c99e24-aa27-45ce-89d3-2e60d6a18755", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdcd116-a88a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1619659722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659722, "uuid": "0c551f8c-6703-48cf-8236-42fe55fc8a6c", "comment": "Malware payload (Quakbot)", "value": "468a5f21fa278c45caa745e82e78ceb4", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659722, "uuid": "48ac3ef9-b753-4573-9bf2-93a87516b333", "comment": "Malware payload (Quakbot)", "value": "2062d14515a2fcca53e3dd13c28301feaed052d00aec0a0bff8834c940092096", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659722, "uuid": "b9fdef53-b70a-45e1-bdb6-c87d667cb356", "comment": "Malware payload (Quakbot)", "value": "3d631a0ee6d2910a0de25575f73d980de0c2635b", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1619659722, "uuid": "aa2a7af4-4987-42cb-b595-844664ea4292", "comment": "Malware payload (Quakbot)", "value": "7f31b2b8b09ed340c4e9ab13624d92d413e5655d042333d1387ce28a9a1cc6a68e10b8b4c2a6a3a2522b69b0d9026afe", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659722, "uuid": "03b6b0f5-7bcd-4bfd-b683-382217c72f17", "value": "3974B07DBB17DC23E26C1BB062D35B581A53DAD63250210A1AB19E58ACE73E47C37EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1619659722, "uuid": "12d06f23-0278-47a3-84b4-bc05f797a92f", "value": "ea6c26ee328343a3e92009b0fbbc8e7a", "object_relation": "imphash" }, { "type": "ssdeep",