{ "Event": { "analysis": "1", "date": "2026-07-23", "extends_uuid": "", "info": "[Threat Intel] JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake", "protected": false, "publish_timestamp": "1785653966", "published": true, "threat_level_id": "2", "timestamp": "1785586407", "uuid": "89e2e9c9-be7d-4d88-b956-b0f18e13076b", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#a9150c", "local": false, "name": "misp-galaxy:producer=\"Group-IB\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#256f6a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL - T1574.001\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#82eae0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "" }, { "colour": "#c295b4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted/Encoded File - T1027.013\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#98048e", "local": false, "name": "misp-galaxy:target-information=\"Honduras\"", "relationship_type": "" }, { "colour": "#e459c3", "local": false, "name": "misp-galaxy:target-information=\"Hong Kong\"", "relationship_type": "" }, { "colour": "#915448", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Venezuela\"", "relationship_type": "" }, { "colour": "#1b8479", "local": false, "name": "misp-galaxy:target-information=\"Vietnam\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Education\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Health\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AdaptixC2\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"PlugX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"reGeorg\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"xmrig\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"alibaba\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"aliyun\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"cloudflare\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"digitalocean\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"github\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"microsoft\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"mysql\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT27\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Earth Lusca\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"MUSTANG PANDA\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UAT-5918\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Netcat\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862054", "to_ids": false, "type": "link", "uuid": "6d7d04cd-74e6-4e0a-b2f6-9d9f4a70a9cd", "value": "https://www.group-ib.com/blog/jadeprox-china-nexus-triback-loader/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784862054", "to_ids": false, "type": "text", "uuid": "01ef131e-fc8d-4f4d-b623-2d8ba227f871", "value": "In mid-April 2026, an exposed directory on an Alibaba Cloud server revealed a comprehensive China-nexus operation targeting government, healthcare, and education sectors across Southeast Asia and Latin America. The investigation uncovered simultaneous intrusions against Vietnamese hospitals, the Malaysian Ministry of Foreign Affairs, Hong Kong educational institutions, and targets in Honduras and Venezuela. At the center is TriBack Loader, a custom malware family using DLL sideloading with signed binaries and Win32 callback APIs to deliver AdaptixC2 and Beagle backdoors. The exposed server contained post-exploitation toolkits, bash history, and victim paths, revealing ongoing operations. Infrastructure analysis showed consistent use of NameSilo registrations, Alibaba hosting, and Cloudflare fronting. Phishing campaigns included fake portals impersonating Venezuelan tax systems and Claude-Pro software. The operation demonstrates shared tooling common across Chinese APT groups, with TTPs overlapping multiple..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784862054", "to_ids": false, "type": "text", "uuid": "a889d7d8-9eb8-4cb6-a3a4-83b168aff1d8", "value": "Name: JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake\nAuthor: AlienVault\nAdversary: JadeProx\nTags: [\"cve-2021-31755\", \"china-nexus\", \"triback loader\", \"cve-2021-32305\", \"adaptixc2\", \"phishing\", \"southeast asia targeting\", \"xmrig\", \"jadeprox\", \"beagle\", \"dll sideloading\", \"cve-2018-11511\", \"cve-2021-24139\", \"plugx\", \"beagle backdoor\"]\nTgtd countries: []\nMlwr families: [\"TriBack Loader\", \"AdaptixC2\", \"Beagle\", \"PlugX - S0013\", \"Thoper\", \"TVT\", \"DestroyRAT\", \"Sogu\", \"Kaba\", \"Korplug\", \"XMRig\"]\nAttack_ids: [\"T1036.005\", \"T1204.002\", \"T1573.001\", \"T1566.001\", \"T1574.001\", \"T1140\", \"T1190\", \"T1583.001\", \"T1218\", \"T1595.002\", \"T1547.001\", \"T1070.004\", \"T1071.001\", \"T1059.005\", \"T1090.001\"]\nIndustries: [\"Healthcare\", \"Government\", \"Education\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784862054", "to_ids": false, "type": "threat-actor", "uuid": "d70ff6ec-6915-44ca-abdb-a6a775b4631e", "value": "JadeProx" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862054", "to_ids": false, "type": "vulnerability", "uuid": "1e027f58-3b42-43c3-a20c-447ec8ae1a7b", "value": "CVE-2018-11511" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862054", "to_ids": false, "type": "vulnerability", "uuid": "e5e19cfa-09a9-4c21-bfbc-149e89bea369", "value": "CVE-2021-24139" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862054", "to_ids": false, "type": "vulnerability", "uuid": "98dc642b-d3d8-469c-874c-d132ee065159", "value": "CVE-2021-31755" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862054", "to_ids": false, "type": "vulnerability", "uuid": "19ae7c99-e889-4962-913a-abe445375e7d", "value": "CVE-2021-32305" }, { "category": "Network activity", "comment": "C2 identified in the open directory", "deleted": false, "disable_correlation": false, "timestamp": "1785581247", "to_ids": true, "type": "domain", "uuid": "b9f4b972-f404-40b7-9dc8-b1be5b58be5f", "value": "sylverixstrategy.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "phishing domain", "deleted": false, "disable_correlation": false, "timestamp": "1785581268", "to_ids": true, "type": "domain", "uuid": "352815c2-2a7e-466f-8502-953c508084f8", "value": "claude-pro.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 in the Honduras case", "deleted": false, "disable_correlation": false, "timestamp": "1785581289", "to_ids": true, "type": "domain", "uuid": "e30c9776-69fb-441b-8a44-e4b7c8b1182d", "value": "gouvvbo.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "CTG Server", "deleted": false, "disable_correlation": false, "timestamp": "1785581310", "to_ids": true, "type": "domain", "uuid": "d1ce05c3-d423-4a05-a762-d82acdcbf495", "value": "update-crowdstrike.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "CTG Server", "deleted": false, "disable_correlation": false, "timestamp": "1785581331", "to_ids": true, "type": "domain", "uuid": "cb6b5b7e-2c36-43df-9b0e-688674ebb59a", "value": "update-sentinelone.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "different C2", "deleted": false, "disable_correlation": false, "timestamp": "1785581352", "to_ids": true, "type": "domain", "uuid": "d72f2c77-42aa-49a8-bba4-b15bc4f14ea7", "value": "update-trellix.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785581374", "to_ids": true, "type": "hostname", "uuid": "32feb208-8f81-4b0e-b4ce-3510e6eb76c8", "value": "license.claude-pro.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "socks5-server No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578953", "to_ids": true, "type": "md5", "uuid": "1b9969f3-0438-4639-ba15-15843db0c68a", "value": "0482d6053f96e6bde0a92af25497f3c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578953", "to_ids": true, "type": "md5", "uuid": "3e00de9d-dd5c-40e4-a94f-7f5c77eb8bfc", "value": "0e6d22c2a81d29b1f9d8395d44e19e53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "suo5-linux-amd64 No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578955", "to_ids": true, "type": "md5", "uuid": "a406a2ff-9aaf-4819-a583-de5ac88cefc9", "value": "38e317af0fc0efcc88265f243a264542", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ServiceHub.DataWarehouseHost.exe.dat No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578956", "to_ids": true, "type": "md5", "uuid": "897ee651-23c9-4fe2-a3dd-a9a542e84839", "value": "5222a31cf24f9f57ae3d1831f264a983", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "linux_amd64 No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578957", "to_ids": true, "type": "md5", "uuid": "4274c44b-eec0-439d-bfc1-8dfe59e3c294", "value": "5b75b00a4b4c32b6e213514e80500a65", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "bjh.zip No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578958", "to_ids": true, "type": "md5", "uuid": "20d57fa6-3a48-4593-82d6-e1ee5549cb99", "value": "7840f30b395fac347f85b38633c2d08d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "linux_amd64 No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578959", "to_ids": true, "type": "md5", "uuid": "21f7d7c2-13f4-4507-b718-19a432710e7a", "value": "8002ab4d0cf7e1888ee72de0b9f4282c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578960", "to_ids": true, "type": "md5", "uuid": "624956b2-d65b-4b95-81c5-54c1e30bff0d", "value": "853f760f76de3201b0af0e41f1f65fba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ServiceHub.DataWarehouseHost.exe.log No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578961", "to_ids": true, "type": "md5", "uuid": "e90952e4-a583-45fc-9ce2-3785d22a1f65", "value": "9e01bf0e28c86435cfb1afaef44238e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "fuckaliyun.sh No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578962", "to_ids": true, "type": "md5", "uuid": "ac39a576-e75e-4780-9a61-61cec51e2538", "value": "aedd185b76ccda8d65dbd26204cc0e9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude.vbs No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578963", "to_ids": true, "type": "md5", "uuid": "946c1d64-abc8-4a64-8d11-2b04194803fb", "value": "c512adfa8743c3b3c776d4452f00c6c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "hostfxr.dll No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578965", "to_ids": true, "type": "md5", "uuid": "bc976695-f0b6-4c19-a0e1-9f3b0cae0f05", "value": "df1f03a2534480a4838f62339bcb90d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578966", "to_ids": true, "type": "md5", "uuid": "38550f88-90a3-42b6-897f-92b65e08ceb4", "value": "e067ffea77875ae0dc13d4ce045931d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "nuclei No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578966", "to_ids": true, "type": "md5", "uuid": "b5e4b4e9-5484-4d9d-a7ff-4c0a61f65a57", "value": "ee5a2cdd4ce6ccb2e9279c9e13e8bd15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "neoreg.py No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578967", "to_ids": true, "type": "md5", "uuid": "4124ff96-771f-4118-818d-0967aab7fb33", "value": "f360afe51b499a036c7be8c0ecc4dc89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578968", "to_ids": true, "type": "sha1", "uuid": "33f3496a-5b55-4f72-a0b4-7a91df9f1c06", "value": "3915dfb85d698abe2d5b4285bef1fb0f63520ea3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578969", "to_ids": true, "type": "sha1", "uuid": "f0ce10fa-fc6c-4913-bef4-5c1e47e75742", "value": "4a7545fa95cf3ede0ef796f04bed7d0c9afe5276", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578969", "to_ids": true, "type": "sha1", "uuid": "b5a197a4-e0d7-4b27-a022-74e0af7918d2", "value": "97918307c96d4357c81caf7ca6f942c32f43857e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578970", "to_ids": true, "type": "sha256", "uuid": "cb7b4b74-2818-435b-a731-e2d1b3493e2f", "value": "8f2e8a2f9d3edc12d39ca07f4717277e863d4bfeb8ec31fe4f391ddd0f64df84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578971", "to_ids": true, "type": "sha256", "uuid": "10e9a44c-97e1-44fb-93a9-27b8236f0819", "value": "d38e05a6fea310e778a8b1e623ee9b00f430ee76622f7a66cd0ca538fcaa1613", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578972", "to_ids": true, "type": "sha256", "uuid": "275358c4-23d1-4f04-8ac7-6b2ffc9e02b6", "value": "d4d249c621b5c27fd96505d041674ea472d5dec0a7730b44324c8af6a7fb7f0a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "update-trellix[.]com", "deleted": false, "disable_correlation": false, "timestamp": "1785581395", "to_ids": true, "type": "ip-dst", "uuid": "f1152972-7135-469d-aa5a-a802d59e0dd8", "value": "192.252.186.62", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785581417", "to_ids": true, "type": "domain", "uuid": "97032cc3-1f0e-4731-883c-e94121c2f396", "value": "vertextrust-advisors.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785581438", "to_ids": true, "type": "hostname", "uuid": "730ddb43-90ee-43da-81a6-2b106c13504b", "value": "photo.pokok.edu.hk", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785581459", "to_ids": true, "type": "hostname", "uuid": "803f2d93-5237-469e-98d2-6d0e68ee31f7", "value": "pta.sfaeps.edu.hk", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...Open Directory The operator exposed their server 43.106.71[.]28:8000 by leaving a Python HTTP server running on p...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785581480", "to_ids": true, "type": "ip-dst", "uuid": "daf36948-014c-43b7-b451-c32a80639a92", "value": "43.106.71.28", "Tag": [ { "colour": "#836891", "local": false, "name": "asn:asn=\"45102\"", "relationship_type": "" }, { "colour": "#692b04", "local": false, "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...license[.]claude-pro[.].com that gets resolved to 8.217.190[.]58, which has the same AS 45102 (Alibaba US Technolo...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785581501", "to_ids": true, "type": "ip-dst", "uuid": "b948d7e6-1611-4a45-973a-93aa0d7d3595", "value": "8.217.190.58", "Tag": [ { "colour": "#836891", "local": false, "name": "asn:asn=\"45102\"", "relationship_type": "" }, { "colour": "#692b04", "local": false, "name": "asn:as-owner=\"ALIBABA-CN-NET Alibaba US Technology Co., Ltd.\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...rar IP 2026-03-13 sylverixstrategy[.]com NameSilo 104.21.60[.]96 \u2013 Cloudflare 2026-03-18 gouvvbo[.]top NameSilo 16...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785581523", "to_ids": true, "type": "ip-dst", "uuid": "f325b843-a6aa-4d9f-a0c6-df7178b1958b", "value": "104.21.60.96", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...96 \u2013 Cloudflare 2026-03-18 gouvvbo[.]top NameSilo 161.35.236[.]255 \u2013 DigitalOcean 2026-03-28 license[.]claude-pro[.]...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785581544", "to_ids": true, "type": "ip-dst", "uuid": "e4e24fdf-6a4c-469d-b207-0644be8433cc", "value": "161.35.236.255", "Tag": [ { "colour": "#c2074e", "local": false, "name": "asn:asn=\"14061\"", "relationship_type": "" }, { "colour": "#d7952a", "local": false, "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...US 2026-04-16 vertextrust-advisors[.]com NameSilo 178.128.108[.]89 \u2013 DigitalOcean 2026-02-02 update-trellix[.]com u...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785581566", "to_ids": true, "type": "ip-dst", "uuid": "bba4ac04-2eb6-4bb4-ae67-26d978df6509", "value": "178.128.108.89", "Tag": [ { "colour": "#c2074e", "local": false, "name": "asn:asn=\"14061\"", "relationship_type": "" }, { "colour": "#d7952a", "local": false, "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Network IOC", "deleted": false, "disable_correlation": false, "timestamp": "1785581587", "to_ids": true, "type": "domain", "uuid": "c5a2b39d-7c92-42fc-8cde-2e19d457a378", "value": "dlrz-web.oss-cn-beijing.aliyuncs.com", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581609", "uuid": "efe9c871-024d-432d-9016-ff3e82f67114", "Attribute": [ { "category": "Payload delivery", "comment": "fscan / mail.log", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "object_relation": "md5", "timestamp": "1785581609", "to_ids": true, "type": "md5", "uuid": "97bc778a-7c18-441a-8d03-8ea0bbf3d611", "value": "b8053bcd04ce9d7d19c7f36830a9f26b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "fscan / mail.log", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "object_relation": "sha1", "timestamp": "1785578930", "to_ids": true, "type": "sha1", "uuid": "2a4ab25d-ccca-44b3-bd4b-98222588b42f", "value": "3ba9a74f8faeff3de03e4c834f266582e2eb46a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "fscan / mail.log", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "object_relation": "sha256", "timestamp": "1785578930", "to_ids": true, "type": "sha256", "uuid": "5c7e2726-74e0-4a6b-ad3b-a33de66aa1c4", "value": "e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 29/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "object_relation": "text", "timestamp": "1785577954", "to_ids": false, "type": "text", "uuid": "752c1748-53bf-48f6-a786-2198e5cf1474", "value": "fscan / mail.log\r\nType Description: ELF\nMicrosoft: HackTool:Linux/Fscan.A!MTB\nClamAV: None\nVT Total Detection: 36/74\nFirst Seen In The Wild: 2024-06-08T17:01:49+00:00\nFirst Submission: 2024-05-15T04:50:09+00:00\nLast Submission: 2026-07-18T02:58:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "object_relation": "ssdeep", "timestamp": "1785577954", "to_ids": true, "type": "ssdeep", "uuid": "bc043a0d-6d1e-4d4f-9d18-db70fe9a6baf", "value": "196608:dqv3cY5ebJz2aVxkrbUX5iqJ2nWeOCsi5IdVnBI:kv3cQeVzb8bUoasKI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577954", "to_ids": false, "type": "size-in-bytes", "uuid": "6c65d213-b9db-41f6-9994-8c28e283867a", "value": "7100304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "object_relation": "vhash", "timestamp": "1785577954", "to_ids": true, "type": "vhash", "uuid": "3cef18b6-6fae-404e-b6fc-cda588f4205b", "value": "db91bbecde9c9c8c3cf7a86acc0cad06" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-15T04:50:09+00:00", "last_seen": "2026-07-18T02:58:46+00:00", "object_relation": "filename", "timestamp": "1785577954", "to_ids": true, "type": "filename", "uuid": "179f0777-1728-4b99-9c1e-da9a33ef0ae2", "value": "fscan" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581631", "uuid": "9edf5917-a948-46b2-b9bd-44705a1e0b89", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "object_relation": "md5", "timestamp": "1785581631", "to_ids": true, "type": "md5", "uuid": "61d131b4-dbc6-4b71-bc6c-78eb320da7d1", "value": "c64eda499e2a21ad158841b9dbc7adc9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "object_relation": "sha1", "timestamp": "1785578931", "to_ids": true, "type": "sha1", "uuid": "74adf696-1202-41e8-85d7-5f7845734814", "value": "3de213252d98348a7d833c4956a099bfcd36b9e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "object_relation": "sha256", "timestamp": "1785578931", "to_ids": true, "type": "sha256", "uuid": "79327787-e0e6-49d2-a304-3e0788f1ff93", "value": "35feef0e6806c14f4ccdb4fceff8a5757956c50fb5ec9644dedae665304f9f96", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "object_relation": "text", "timestamp": "1785577975", "to_ids": false, "type": "text", "uuid": "f9778c1d-cab0-4700-858c-5418d04613c7", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 7/75\nFirst Submission: 2026-04-09T18:24:22+00:00\nLast Submission: 2026-04-11T03:35:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "object_relation": "ssdeep", "timestamp": "1785577975", "to_ids": true, "type": "ssdeep", "uuid": "a724bdda-23ed-4c4f-9c83-5a18884a610f", "value": "12582912:36IkhdPiU+izHAJzyiAhmgUjp2yrieqJ2BejPU:369/+YCzAspFriEaPU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577975", "to_ids": false, "type": "size-in-bytes", "uuid": "be19dd5f-0045-44db-a954-25b59344b191", "value": "529345384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "object_relation": "vhash", "timestamp": "1785577975", "to_ids": true, "type": "vhash", "uuid": "328c33cb-6e0f-4d5c-80cf-55d5d84a8171", "value": "1d2f21722b0395121d2b6df296aba3d6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T18:24:22+00:00", "last_seen": "2026-04-11T03:35:55+00:00", "object_relation": "filename", "timestamp": "1785577975", "to_ids": true, "type": "filename", "uuid": "2c9f01af-92cc-40af-81c8-34fd21f6d63a", "value": "Claude-Pro-windows-x64.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581652", "uuid": "cf042cac-ef32-4854-9feb-5af9a05d6dcb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "md5", "timestamp": "1785581652", "to_ids": true, "type": "md5", "uuid": "31a8dd35-3db5-4465-bc6e-a70101d2ed08", "value": "88ac1c5fc9ee89491c70ea16131e264a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "sha1", "timestamp": "1785578932", "to_ids": true, "type": "sha1", "uuid": "c2cbe717-6d0d-4560-b267-3060171914e3", "value": "910465739b3170584150e9260bfba6a65e633f35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "sha256", "timestamp": "1785578932", "to_ids": true, "type": "sha256", "uuid": "d575062b-b3cb-4657-8653-3efdc5bb4fde", "value": "d5590802bf0926ac30d8e31c0911439c35aead82bf17771cfd1f9a785a7bf143", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "text", "timestamp": "1785577997", "to_ids": false, "type": "text", "uuid": "f0d8ec8e-b844-40ce-875d-e5dcbc699ad0", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/ShellcodeRunner.AB!MTB\nClamAV: None\nVT Total Detection: 43/75\nFirst Submission: 2026-04-09T17:08:46+00:00\nLast Submission: 2026-06-11T02:43:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "creation-time", "timestamp": "1785577997", "to_ids": false, "type": "datetime", "uuid": "3451c8a7-bda4-499f-8001-60a86ce2d01f", "value": "2026-01-18T10:14:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "ssdeep", "timestamp": "1785577997", "to_ids": true, "type": "ssdeep", "uuid": "878613e9-e5a1-451a-acef-c2c4b6b68b96", "value": "1536:slkswt5LGk3FpPTKEwhfZvEmd8nwzN68t2PCbzsYDJgzneesW5cdwJeMnx1+:shwt5xpPGEocmd8OZt2PCN1UnmwJeMnm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577997", "to_ids": false, "type": "size-in-bytes", "uuid": "79c65d40-7cff-4920-bdee-1491ecf380d2", "value": "84992" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "vhash", "timestamp": "1785577997", "to_ids": true, "type": "vhash", "uuid": "7974fe66-d315-46a2-86ee-e17f21cf7922", "value": "184056655d1d056az4f?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:08:46+00:00", "last_seen": "2026-06-11T02:43:49+00:00", "object_relation": "filename", "timestamp": "1785577997", "to_ids": true, "type": "filename", "uuid": "d12fef01-63f7-4040-a1bb-975d9ca6146e", "value": "avk.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581673", "uuid": "f9cb21e4-c23b-4dc5-a993-242d3a50b92c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "md5", "timestamp": "1785581673", "to_ids": true, "type": "md5", "uuid": "340354ce-56c5-41fd-8fcd-4eb2a26437ac", "value": "35cdbf8a16da1245d574a0365cb87287", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "sha1", "timestamp": "1785578933", "to_ids": true, "type": "sha1", "uuid": "8d00e5f4-20ba-4b5f-b1c3-c3f48ff81fd7", "value": "bdd36c695ad395ccbf6babb46ef734949207b362", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "sha256", "timestamp": "1785578933", "to_ids": true, "type": "sha256", "uuid": "1c114215-8ecc-4535-a1e1-5dd2899c6242", "value": "bcbe5933f950883069bc03f1ea597268fcc63111f5e6df3d43466409ce9fb005", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 29/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "text", "timestamp": "1785578060", "to_ids": false, "type": "text", "uuid": "0666c34a-df92-49bd-a024-e038bf9ee105", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2026-03-25T17:06:37+00:00\nLast Submission: 2026-03-25T17:06:37+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "creation-time", "timestamp": "1785578060", "to_ids": false, "type": "datetime", "uuid": "85489be0-f8a9-4824-bb60-6275a5ab2a7d", "value": "2025-12-14T07:31:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "ssdeep", "timestamp": "1785578060", "to_ids": true, "type": "ssdeep", "uuid": "ab1b69d5-a4c8-401f-838b-6d2c86c1df0b", "value": "384:VSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaSTaST0:F" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578060", "to_ids": false, "type": "size-in-bytes", "uuid": "9c38b2fe-a4fe-4a36-bbd4-c8506cfa4d35", "value": "123000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "vhash", "timestamp": "1785578060", "to_ids": true, "type": "vhash", "uuid": "f0626e70-441f-498f-8d05-540de56504e9", "value": "d361cfffd24a8b82d96637a97f1af84b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:37+00:00", "last_seen": "2026-03-25T17:06:37+00:00", "object_relation": "filename", "timestamp": "1785578060", "to_ids": true, "type": "filename", "uuid": "754022c8-d634-458e-89fe-e725f783ad43", "value": "Estado de Cuenta.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2019-05-23T18:52:04+00:00", "last_seen": "2024-08-23T16:35:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581694", "uuid": "a36447b0-f05d-4367-a9d9-fd6cb264e89d", "Attribute": [ { "category": "Payload delivery", "comment": "dtd", "deleted": false, "disable_correlation": false, "first_seen": "2019-05-23T18:52:04+00:00", "last_seen": "2024-08-23T16:35:52+00:00", "object_relation": "md5", "timestamp": "1785581694", "to_ids": true, "type": "md5", "uuid": "db95776b-b511-44b1-a8e8-26ec3ed2e931", "value": "39d4012e49f58092ec5cefed13dbbcfd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "dtd", "deleted": false, "disable_correlation": false, "first_seen": "2019-05-23T18:52:04+00:00", "last_seen": "2024-08-23T16:35:52+00:00", "object_relation": "sha1", "timestamp": "1785578934", "to_ids": true, "type": "sha1", "uuid": "0346fe99-cdc3-4120-9bf1-002693f94800", "value": "b2d9067d4beabff4fdcc634fdd0944f44d66ef86", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "dtd", "deleted": false, "disable_correlation": false, "first_seen": "2019-05-23T18:52:04+00:00", "last_seen": "2024-08-23T16:35:52+00:00", "object_relation": "sha256", "timestamp": "1785578934", "to_ids": true, "type": "sha256", "uuid": "c9f2fb7c-6be7-4b65-a3ff-fca89205187e", "value": "dab9fa146257bb0f32ebf7b2b3d8a7b3f16464dc350229f491be4a080fe1a0e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2019-05-23T18:52:04+00:00", "last_seen": "2024-08-23T16:35:52+00:00", "object_relation": "text", "timestamp": "1785578103", "to_ids": false, "type": "text", "uuid": "08300436-9ed7-4a35-90fb-d14311d9fa2d", "value": "dtd\r\nType Description: HTML\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/75\nFirst Submission: 2019-05-23T18:52:04+00:00\nLast Submission: 2024-08-23T16:35:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2019-05-23T18:52:04+00:00", "last_seen": "2024-08-23T16:35:52+00:00", "object_relation": "ssdeep", "timestamp": "1785578103", "to_ids": true, "type": "ssdeep", "uuid": "c2d4c12b-9b5c-423a-8c72-b0990d6cac16", "value": "3:SuyFFJgLk5FNEAd2iGaxzH4Abya/J9LBcDKluRW4z0NDIExCv:gntddndbyKmDEeO1Cv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2019-05-23T18:52:04+00:00", "last_seen": "2024-08-23T16:35:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578103", "to_ids": false, "type": "size-in-bytes", "uuid": "74e80ef8-e3ac-40f1-8cdb-7c0d8f1244ee", "value": "169" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2019-05-23T18:52:04+00:00", "last_seen": "2024-08-23T16:35:52+00:00", "object_relation": "filename", "timestamp": "1785578103", "to_ids": true, "type": "filename", "uuid": "e31402e5-e599-4301-97af-76edad204937", "value": "malicious_dtd" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581716", "uuid": "8b11bc5e-af5f-4580-adf4-55b2c829e90b", "Attribute": [ { "category": "Payload delivery", "comment": "MpClient.dll", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "md5", "timestamp": "1785581716", "to_ids": true, "type": "md5", "uuid": "3e133a97-e0cc-455d-a7c1-ef8cc3b3ffc1", "value": "3b3dd8f3a5e1ff85c63f2453ad270415", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MpClient.dll", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "sha1", "timestamp": "1785578935", "to_ids": true, "type": "sha1", "uuid": "048eb256-bb29-49c5-9d9c-2c0120cf9d17", "value": "caa77f63a1a86499b8d70a656c2a86fa2b77feff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MpClient.dll", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "sha256", "timestamp": "1785578935", "to_ids": true, "type": "sha256", "uuid": "27c984e3-b60e-4178-95c1-1cb334f21d00", "value": "a3c5c7253c0b3ed92e86dc5661d8530a0e8acdf8768e80362e5fe897ccb6cd84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 30/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "text", "timestamp": "1785578125", "to_ids": false, "type": "text", "uuid": "1298d849-227b-471e-b621-410af57642ce", "value": "MpClient.dll\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLHijack.AEYB!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Submission: 2026-02-23T10:57:14+00:00\nLast Submission: 2026-02-23T10:57:14+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "creation-time", "timestamp": "1785578125", "to_ids": false, "type": "datetime", "uuid": "d20f8a92-587a-421e-b1fe-92f3a5e78628", "value": "2026-02-02T12:11:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "ssdeep", "timestamp": "1785578125", "to_ids": true, "type": "ssdeep", "uuid": "c6763918-c3eb-459e-97cf-1e69025a0965", "value": "3072:pKl1VfXcccBW7hEvpf4K8sdtV0hOGubuue/4kYZSa:YlX/wMhEhdxBaV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578125", "to_ids": false, "type": "size-in-bytes", "uuid": "21721f7a-1a5a-481e-9159-a14f1e6bab30", "value": "112128" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "vhash", "timestamp": "1785578125", "to_ids": true, "type": "vhash", "uuid": "69604464-893f-4624-8f12-ac7b8a9c5866", "value": "115066655d155d055az51&z10e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-23T10:57:14+00:00", "last_seen": "2026-02-23T10:57:14+00:00", "object_relation": "filename", "timestamp": "1785578125", "to_ids": true, "type": "filename", "uuid": "be2dadcf-de84-4d89-8b3d-b336ad5cb6d7", "value": "MpClient.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-13T13:57:26+00:00", "last_seen": "2026-06-11T02:53:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581737", "uuid": "39cf8910-871f-459e-8031-8b0c6e6011f3", "Attribute": [ { "category": "Payload delivery", "comment": "NOVUpdate.exe.dat", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T13:57:26+00:00", "last_seen": "2026-06-11T02:53:22+00:00", "object_relation": "md5", "timestamp": "1785581737", "to_ids": true, "type": "md5", "uuid": "332a1c74-790d-47aa-bafa-aad5d7384496", "value": "3fe9c84025f4401f8cd661675642c526", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "NOVUpdate.exe.dat", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T13:57:26+00:00", "last_seen": "2026-06-11T02:53:22+00:00", "object_relation": "sha1", "timestamp": "1785578936", "to_ids": true, "type": "sha1", "uuid": "5469cc3d-046a-469a-8617-ada7f2ecf573", "value": "8c1966e50b4bff1c85916e2648534d6c4d0b26c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "NOVUpdate.exe.dat", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T13:57:26+00:00", "last_seen": "2026-06-11T02:53:22+00:00", "object_relation": "sha256", "timestamp": "1785578937", "to_ids": true, "type": "sha256", "uuid": "defdc16f-924c-44e2-a818-92f3fa38220a", "value": "8ac88aeecd19d842729f000c6ab732261cb11dd15cdcbb2dd137dc768b2f12bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T13:57:26+00:00", "last_seen": "2026-06-11T02:53:22+00:00", "object_relation": "text", "timestamp": "1785578147", "to_ids": false, "type": "text", "uuid": "5e74d21f-d184-4530-bc61-02cfced14f7f", "value": "NOVUpdate.exe.dat\r\nType Description: unknown\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/75\nFirst Submission: 2026-05-13T13:57:26+00:00\nLast Submission: 2026-06-11T02:53:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T13:57:26+00:00", "last_seen": "2026-06-11T02:53:22+00:00", "object_relation": "ssdeep", "timestamp": "1785578147", "to_ids": true, "type": "ssdeep", "uuid": "fa388b44-6e62-4c91-a0ac-8203a3842a8d", "value": "1536:maYlKPYTtOyawa/ca9gi4ZOCVt0//gCBSFPESov4VuBo/:maY1tzawCv4h4//do1fuBy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T13:57:26+00:00", "last_seen": "2026-06-11T02:53:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578147", "to_ids": false, "type": "size-in-bytes", "uuid": "57ae16cd-d186-4441-a29c-38874263af5e", "value": "91211" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T13:57:26+00:00", "last_seen": "2026-06-11T02:53:22+00:00", "object_relation": "filename", "timestamp": "1785578147", "to_ids": true, "type": "filename", "uuid": "2b70c72d-acdb-44db-bb72-42754c1a701b", "value": "NOVUpdate.exe.dat" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581759", "uuid": "25521333-4d0a-43d6-ac42-2e7110996a66", "Attribute": [ { "category": "Payload delivery", "comment": "DeviceSync.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "object_relation": "md5", "timestamp": "1785581759", "to_ids": true, "type": "md5", "uuid": "b3ffd779-194d-4c7d-a564-6dde0c940f58", "value": "4faf4fd91d28e014b4f2362d6a7bb8ac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "DeviceSync.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "object_relation": "sha1", "timestamp": "1785578938", "to_ids": true, "type": "sha1", "uuid": "5aa91c45-e640-4795-8f94-c7538cef8012", "value": "e738db2647237281ed65461b0aaba0c110e97a8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "DeviceSync.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "object_relation": "sha256", "timestamp": "1785578938", "to_ids": true, "type": "sha256", "uuid": "180f0f63-bb17-441b-afaf-2b929068b286", "value": "e6d66d192a779f195426db94d2568c03a9bd0d2e8f1972aa32a0317940ae19c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 29/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "object_relation": "text", "timestamp": "1785578169", "to_ids": false, "type": "text", "uuid": "eebd3ff3-5415-4c80-ade5-28445e7cfa92", "value": "DeviceSync.zip\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 40/74\nFirst Submission: 2026-02-23T10:56:51+00:00\nLast Submission: 2026-02-25T08:32:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "object_relation": "ssdeep", "timestamp": "1785578169", "to_ids": true, "type": "ssdeep", "uuid": "71da8d0e-56d2-4f1e-a7d0-18a0d16a2d4e", "value": "3072:iBayppGqexox1RPuVq7Tjn2wUmWM5e3atLc/AbZSMOctBfChoOePwLQ6hilvWtTf:iBaMpsY1R2VaTzJUmWMcEc/iEMOQBfC5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578169", "to_ids": false, "type": "size-in-bytes", "uuid": "a342773b-1d13-41b7-86bf-54b983d8687b", "value": "192255" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "object_relation": "vhash", "timestamp": "1785578169", "to_ids": true, "type": "vhash", "uuid": "f83d79e2-9692-4ad3-abf6-2440e72cdd25", "value": "a513cc7f408572c83b6f82c33d54ab96" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-23T10:56:51+00:00", "last_seen": "2026-02-25T08:32:14+00:00", "object_relation": "filename", "timestamp": "1785578169", "to_ids": true, "type": "filename", "uuid": "ac7c94a5-b169-4fc9-9c76-245bc94f4709", "value": "DeviceSync.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581780", "uuid": "1f2f47d3-638f-4588-bcca-d012547da568", "Attribute": [ { "category": "Payload delivery", "comment": "GolddTV.msi", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "md5", "timestamp": "1785581780", "to_ids": true, "type": "md5", "uuid": "c76b54d2-d5c1-471a-9e3b-75a8a86d0464", "value": "796f82a4833be330b1e35af63e55b597", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "GolddTV.msi", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "sha1", "timestamp": "1785578939", "to_ids": true, "type": "sha1", "uuid": "9893ecf4-dc52-4245-a93a-51de9c885977", "value": "9f2ddf69c23ce1f01db492f518800f12f9a11b52", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "GolddTV.msi", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "sha256", "timestamp": "1785578939", "to_ids": true, "type": "sha256", "uuid": "463e8409-bfc1-4d5b-8e8f-a4b0451d17e4", "value": "586f27257d3eaee7d4bec9e9207c317a9caeded95eca3969739d7e8181d24620", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 29/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "text", "timestamp": "1785578253", "to_ids": false, "type": "text", "uuid": "7ad677c8-e081-4ae3-a838-c16fe3997fd9", "value": "GolddTV.msi\r\nType Descriptio%WINDIR%\\Installer\nMicrosoft: None\nClamAV: None\nVT Total Detection: 33/74\nFirst Submission: 2026-04-09T22:38:46+00:00\nLast Submission: 2026-04-09T22:38:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "creation-time", "timestamp": "1785578253", "to_ids": false, "type": "datetime", "uuid": "3ecd0681-185a-47ba-bf4d-998653b02f02", "value": "2009-12-11T11:47:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "ssdeep", "timestamp": "1785578253", "to_ids": true, "type": "ssdeep", "uuid": "2780e25f-8a46-4303-90e5-d56addc1f46f", "value": "12288:d5rYMSLWEY8Yep/sTfZ6LWG/2UPMTZobNAL8pnfcjCxVyE7gW:d5rYXWEOtRil/7PMT6bNAApnfcjsyFW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578253", "to_ids": false, "type": "size-in-bytes", "uuid": "c1f97052-1c00-460e-9e8b-3c6361f48594", "value": "734208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "vhash", "timestamp": "1785578253", "to_ids": true, "type": "vhash", "uuid": "7fd3278f-c284-4373-a216-84f17cf6cc6f", "value": "72e7c15c4fb08255dac8c0b422694faf" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T22:38:46+00:00", "last_seen": "2026-04-09T22:38:46+00:00", "object_relation": "filename", "timestamp": "1785578253", "to_ids": true, "type": "filename", "uuid": "ff48bd99-d9ec-4274-bed6-ad2bebfd55a1", "value": "GolddTV.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581801", "uuid": "00666d66-2b5d-4994-8f1b-c8c23b93a503", "Attribute": [ { "category": "Payload delivery", "comment": "iox", "deleted": false, "disable_correlation": false, "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "object_relation": "md5", "timestamp": "1785581801", "to_ids": true, "type": "md5", "uuid": "ff517613-7ccf-4608-b658-dd3ba8af9955", "value": "7c84e75817349adcdea9925b86f67670", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "iox", "deleted": false, "disable_correlation": false, "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "object_relation": "sha1", "timestamp": "1785578940", "to_ids": true, "type": "sha1", "uuid": "3f143013-d2a0-4f01-bea8-978a3d447032", "value": "08d96d08c62150d7aec73ad647b5007ff1e3a6c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "iox", "deleted": false, "disable_correlation": false, "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "object_relation": "sha256", "timestamp": "1785578940", "to_ids": true, "type": "sha256", "uuid": "3351cc74-7557-4d43-b9e1-1faf4476621c", "value": "13c1cfb12017aa138e2f8d788dcd867806cc8fd6ae05c3ab7d886c18bcd4c48a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 30/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "object_relation": "text", "timestamp": "1785578274", "to_ids": false, "type": "text", "uuid": "87cce6a7-ae89-41e6-b4d6-72ce6e6146a0", "value": "iox\r\nType Description: ELF\nMicrosoft: HackTool:Linux/Ioxproxy!MTB\nClamAV: Unix.Tool.Iox-10059147-0\nVT Total Detection: 33/74\nFirst Seen In The Wild: 2021-10-20T19:27:41+00:00\nFirst Submission: 2020-12-14T03:35:28+00:00\nLast Submission: 2026-06-26T03:09:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "object_relation": "ssdeep", "timestamp": "1785578274", "to_ids": true, "type": "ssdeep", "uuid": "3412f1e0-3ccb-4276-95f9-68b08506981b", "value": "49152:rEfoMtXFLQuWqL7B6RBiy61ggOZc8nuO8nIT:L4F1fZ6R0H" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578274", "to_ids": false, "type": "size-in-bytes", "uuid": "0d28c8af-0f44-4d03-b5d4-b8b36f55d12a", "value": "2516384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "object_relation": "vhash", "timestamp": "1785578274", "to_ids": true, "type": "vhash", "uuid": "52fbd4a4-4da6-4f3f-bb00-13bde4935df8", "value": "83b7e04a4a6d626d7dd712758613d1d5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2020-12-14T03:35:28+00:00", "last_seen": "2026-06-26T03:09:09+00:00", "object_relation": "filename", "timestamp": "1785578274", "to_ids": true, "type": "filename", "uuid": "3c649839-8081-45da-8c18-39c0ec22610d", "value": "memfd:feng (deleted)" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-17T07:49:30+00:00", "last_seen": "2026-06-11T02:13:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581822", "uuid": "4b0b5f7b-56b0-47c1-928c-82f04695c222", "Attribute": [ { "category": "Payload delivery", "comment": "script.dat", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:30+00:00", "last_seen": "2026-06-11T02:13:52+00:00", "object_relation": "md5", "timestamp": "1785581822", "to_ids": true, "type": "md5", "uuid": "7ba6f75a-d414-40ac-8a40-75a7aee818ec", "value": "a4cdecc57a215243d279cdb065863308", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "script.dat", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:30+00:00", "last_seen": "2026-06-11T02:13:52+00:00", "object_relation": "sha1", "timestamp": "1785578942", "to_ids": true, "type": "sha1", "uuid": "3402eae8-71f0-4a72-9f3e-71af9fa9fa64", "value": "76cf4bda16d11635ea79dd620f0f0d1439cbd095", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "script.dat", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:30+00:00", "last_seen": "2026-06-11T02:13:52+00:00", "object_relation": "sha256", "timestamp": "1785578942", "to_ids": true, "type": "sha256", "uuid": "01e2e2fb-ec3c-40df-8791-17873bc3c4a8", "value": "cc9839f9053cf5d57608da5c8706ea710b4878b57fe86b47b83b5fb941c1df12", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:49:30+00:00", "last_seen": "2026-06-11T02:13:52+00:00", "object_relation": "text", "timestamp": "1785578358", "to_ids": false, "type": "text", "uuid": "14d890fe-3932-4a4a-b801-83b808db0b72", "value": "script.dat\r\nType Description: Powershell\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/75\nFirst Submission: 2026-04-17T07:49:30+00:00\nLast Submission: 2026-06-11T02:13:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:30+00:00", "last_seen": "2026-06-11T02:13:52+00:00", "object_relation": "ssdeep", "timestamp": "1785578358", "to_ids": true, "type": "ssdeep", "uuid": "32ca531d-bbfe-4aa1-8417-38781988d458", "value": "3:/9rjeeeeeeeO1nArjeeeeeeerfj8EcMxLHEJDAMnIKn:NeeeeeeeOlceeeeeeeXpZE2MIKn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:49:30+00:00", "last_seen": "2026-06-11T02:13:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578358", "to_ids": false, "type": "size-in-bytes", "uuid": "160c23ec-cacc-4253-accc-be9bc04e1763", "value": "246" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:49:30+00:00", "last_seen": "2026-06-11T02:13:52+00:00", "object_relation": "filename", "timestamp": "1785578358", "to_ids": true, "type": "filename", "uuid": "60b79873-2837-4b96-a6bf-2d596f1b46b6", "value": "script.dat" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581843", "uuid": "ac043e8e-6afb-4b74-9d3f-16a1fd8cb04c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "object_relation": "md5", "timestamp": "1785581843", "to_ids": true, "type": "md5", "uuid": "2d484228-efd7-4f6f-b568-a1972a95bb22", "value": "bb5c88de9e04e6306260b9f3a4498933", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "object_relation": "sha1", "timestamp": "1785578943", "to_ids": true, "type": "sha1", "uuid": "031adef8-3d8b-410b-830e-4b0ab74e80d4", "value": "650fe45334fb7410a655db8684127f1d3913ac6f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "object_relation": "sha256", "timestamp": "1785578943", "to_ids": true, "type": "sha256", "uuid": "8778e360-dff6-4c87-87e4-76d12d98d903", "value": "46dea8c1af85134a7b15fc7168386eadd15474b1a6159567b24e83d8a30fc6ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "object_relation": "text", "timestamp": "1785578401", "to_ids": false, "type": "text", "uuid": "6e37d2c8-7245-46da-b7fa-dd54528bb435", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 44/75\nFirst Submission: 2026-03-25T17:06:15+00:00\nLast Submission: 2026-03-25T17:06:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "object_relation": "ssdeep", "timestamp": "1785578402", "to_ids": true, "type": "ssdeep", "uuid": "8715156d-4756-4097-a84d-4c0063c79c31", "value": "6144:zdwwwFTHXgDoGWdPzB7BD9bWM6qBsWlFvWQ3xdg0vJ5xb+zdMkdRQWH+OgqtDuqx:zQQu1SM5pxWQ3x5lb+XtfIqi/Re59o6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578402", "to_ids": false, "type": "size-in-bytes", "uuid": "551ce23c-4944-4125-a378-21bf5752b7f0", "value": "501505" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "object_relation": "vhash", "timestamp": "1785578402", "to_ids": true, "type": "vhash", "uuid": "50208a4f-7fef-4b46-9fff-889266a129db", "value": "9023dd223c64b31398e1d14847aa2b02" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:15+00:00", "last_seen": "2026-03-25T17:06:15+00:00", "object_relation": "filename", "timestamp": "1785578402", "to_ids": true, "type": "filename", "uuid": "2ff792bf-1962-4e8e-8f39-b812cb0120dc", "value": "Estado de Cuenta.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581864", "uuid": "8adfcd4f-7429-450e-9b61-f769c14b1da6", "Attribute": [ { "category": "Payload delivery", "comment": "pdf.vbs", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "object_relation": "md5", "timestamp": "1785581864", "to_ids": true, "type": "md5", "uuid": "15196576-3381-4279-8c52-873829124aab", "value": "bef0b8599d18acf1c74192ae9f198f85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "pdf.vbs", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "object_relation": "sha1", "timestamp": "1785578945", "to_ids": true, "type": "sha1", "uuid": "6e74770d-1c84-4b3b-8018-abc535e00936", "value": "7275513e1a03b8c75e0eb17b66103ce6c917cc52", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "pdf.vbs", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "object_relation": "sha256", "timestamp": "1785578945", "to_ids": true, "type": "sha256", "uuid": "598b321c-b52c-4502-9cf1-f72e149aae9b", "value": "df1ab9210252ad76e3451eeb287747af510658afeb82b22e20bea1c6ddc55131", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "object_relation": "text", "timestamp": "1785578425", "to_ids": false, "type": "text", "uuid": "89429b2e-ea81-4fcd-9a03-bd300dc3753e", "value": "pdf.vbs\r\nType Description: VBA\nMicrosoft: Trojan:VBS/Runner!MSR\nClamAV: None\nVT Total Detection: 10/75\nFirst Submission: 2026-04-17T07:49:31+00:00\nLast Submission: 2026-06-11T02:13:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "object_relation": "ssdeep", "timestamp": "1785578425", "to_ids": true, "type": "ssdeep", "uuid": "4057625b-44dc-4c6b-b199-eeffb1e2e876", "value": "12:rmwvrYhcuEAkARJgvWdtetDwGt0btuwzt9et4fwGtgwGtl3G:BvMaAk0KAot0GtEtVztYtvGtnGtl3G" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578425", "to_ids": false, "type": "size-in-bytes", "uuid": "78263286-945d-4f39-ac6e-126aafb17cd8", "value": "630" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "object_relation": "vhash", "timestamp": "1785578425", "to_ids": true, "type": "vhash", "uuid": "fdd378e6-cba7-41a8-94ed-f7b14b3c5aba", "value": "85be296ae960340e04d46c68103b228c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:49:31+00:00", "last_seen": "2026-06-11T02:13:47+00:00", "object_relation": "filename", "timestamp": "1785578425", "to_ids": true, "type": "filename", "uuid": "dbc5bfe5-6d39-4726-8ce3-468d6058c72b", "value": "pdf.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581885", "uuid": "6b796d28-e726-4173-becd-9742e48d8f65", "Attribute": [ { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.lnk", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "md5", "timestamp": "1785581885", "to_ids": true, "type": "md5", "uuid": "dab11a79-000f-4bb8-b4f4-5b4967660fa0", "value": "c1f45a0609c5c1bd2c21cad20703f126", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.lnk", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "sha1", "timestamp": "1785578946", "to_ids": true, "type": "sha1", "uuid": "7d1c2142-74ce-4600-8d75-f5b5de41a8f1", "value": "bf4a26fe2232eb0829ef20a69ee884f1240d66b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.lnk", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "sha256", "timestamp": "1785578946", "to_ids": true, "type": "sha256", "uuid": "d8c5a40f-c69e-4c4b-a6c1-9de90e389c98", "value": "8ad109da60e31fc714cf2fb2791b36fdd5817abf62b6022c290538c770cfacac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "text", "timestamp": "1785578447", "to_ids": false, "type": "text", "uuid": "5d1d944d-a130-4717-8260-eefe7b6f96b5", "value": "Claude-Pro-Relay-Technical-Overview.lnk\r\nType Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/WinLNK.HCQ!MTB\nClamAV: None\nVT Total Detection: 30/75\nFirst Submission: 2026-04-17T07:38:43+00:00\nLast Submission: 2026-06-11T03:50:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "creation-time", "timestamp": "1785578447", "to_ids": false, "type": "datetime", "uuid": "f81b748b-736b-4693-810b-ccfe2c82d93f", "value": "2019-12-07T09:09:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "ssdeep", "timestamp": "1785578447", "to_ids": true, "type": "ssdeep", "uuid": "5ffbd225-0050-44d9-be77-45419b38041b", "value": "768:kbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb3:E" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578447", "to_ids": false, "type": "size-in-bytes", "uuid": "c963a675-7e96-4e75-8be3-57046f28c920", "value": "255000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "vhash", "timestamp": "1785578447", "to_ids": true, "type": "vhash", "uuid": "dfe96dec-f6a0-48ab-a264-c181326b35c1", "value": "eaa513dcddba1218ebf4518e7503c7b3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:38:43+00:00", "last_seen": "2026-06-11T03:50:23+00:00", "object_relation": "filename", "timestamp": "1785578447", "to_ids": true, "type": "filename", "uuid": "681dd4bf-95c0-44d8-8138-c716b59c4b07", "value": "Claude-Pro-Relay-Technical-Overview.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581906", "uuid": "910e15c6-393a-44c2-9dae-9b981afe5aae", "Attribute": [ { "category": "Payload delivery", "comment": "hostfxr.dll", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "md5", "timestamp": "1785581906", "to_ids": true, "type": "md5", "uuid": "4a420c1a-40bc-4d56-a42e-cd0f5f69f7b9", "value": "d99392248bdd7e351e63ead6733638ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "hostfxr.dll", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "sha1", "timestamp": "1785578948", "to_ids": true, "type": "sha1", "uuid": "7b66d835-6047-4406-8ef2-a6f3913f11a5", "value": "e7f240a76337620682d25c5aa654255905ba0b59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "hostfxr.dll", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "sha256", "timestamp": "1785578948", "to_ids": true, "type": "sha256", "uuid": "d7a0a22a-68a4-4154-9e39-edee1334dff9", "value": "0a19870ba24aeb9d4b5dde091ef8071d76f8a5e43ac8c6f5b9f283020580a60a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 29/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "text", "timestamp": "1785578490", "to_ids": false, "type": "text", "uuid": "6aa8a8f8-efda-46f5-b583-25720d7933b1", "value": "hostfxr.dll\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2026-03-25T17:06:36+00:00\nLast Submission: 2026-03-25T17:06:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "creation-time", "timestamp": "1785578490", "to_ids": false, "type": "datetime", "uuid": "d85586bf-bf16-45d4-8a29-30f185ecfde2", "value": "2026-03-18T07:40:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "ssdeep", "timestamp": "1785578490", "to_ids": true, "type": "ssdeep", "uuid": "c2bbcf8f-ec6b-4411-844f-ca3f387a15a4", "value": "6144:DMkyq8nmVF98l3XAiTRQBqKRVaUuSp6CdqcuMFXKUi4W2PhsH:DM+8AUl3QiTOB3RjJ6q1XJPhsH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578490", "to_ids": false, "type": "size-in-bytes", "uuid": "4a69d551-04fb-4bcf-b423-60e056e925c4", "value": "707072" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "vhash", "timestamp": "1785578490", "to_ids": true, "type": "vhash", "uuid": "688a3242-c413-4f92-9c0d-1015c42c6dc1", "value": "175096551d15551d151dbz677z409bz2ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T17:06:36+00:00", "last_seen": "2026-03-25T17:06:36+00:00", "object_relation": "filename", "timestamp": "1785578490", "to_ids": true, "type": "filename", "uuid": "482e101a-e92b-4e31-93a5-cf69ac9ff566", "value": "hostfxr.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581927", "uuid": "fc2d366e-d581-4a1f-84ba-a8268fa96166", "Attribute": [ { "category": "Payload delivery", "comment": "Claude.msi", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "md5", "timestamp": "1785581927", "to_ids": true, "type": "md5", "uuid": "35efbdc5-dea5-4a05-941b-7b86ece805c4", "value": "efac43473d7e87ede5176fe01a114abb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude.msi", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "sha1", "timestamp": "1785578949", "to_ids": true, "type": "sha1", "uuid": "6ee1fbbf-075d-4bb2-9bfe-49444412e1ba", "value": "f02a97a42b303c068ac23859599d5610bcbb4550", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude.msi", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "sha256", "timestamp": "1785578949", "to_ids": true, "type": "sha256", "uuid": "16833fb1-2262-4089-8c75-5101e2eb45af", "value": "86a6ffa23e924d1afbfb31b55fe780916cf3c9a4f8c3165542fdd726783fc796", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "text", "timestamp": "1785578574", "to_ids": false, "type": "text", "uuid": "6afa09f7-3d51-4444-84ae-9bac1b473c24", "value": "Claude.msi\r\nType Descriptio%WINDIR%\\Installer\nMicrosoft: None\nClamAV: None\nVT Total Detection: 15/75\nFirst Submission: 2026-04-09T17:00:13+00:00\nLast Submission: 2026-04-11T03:42:01+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "creation-time", "timestamp": "1785578574", "to_ids": false, "type": "datetime", "uuid": "c73795ea-77a5-4414-b255-4277450681b3", "value": "2009-12-11T11:47:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "ssdeep", "timestamp": "1785578574", "to_ids": true, "type": "ssdeep", "uuid": "da002f0d-4ead-4fb5-94de-1ea8fb7dbdd1", "value": "12582912:MptJq/XDBVvusI+0oT/Yi/iTL8CN1zHsEEvEUWOc:MpGVvusw2/Vix1QEEkL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578574", "to_ids": false, "type": "size-in-bytes", "uuid": "b2318faa-8abf-4d76-ab4b-f9b42cf51227", "value": "532928512" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "vhash", "timestamp": "1785578574", "to_ids": true, "type": "vhash", "uuid": "cbbac985-8e72-40c1-bf62-f3c68c21c8f5", "value": "a16aba9e1e0cc5278d5cd32faa75598d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:00:13+00:00", "last_seen": "2026-04-11T03:42:01+00:00", "object_relation": "filename", "timestamp": "1785578574", "to_ids": true, "type": "filename", "uuid": "a3e53f2c-6937-4743-a6ec-b993df882ee1", "value": "Claude.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581948", "uuid": "6aaa302d-8d2e-4aa3-9e56-f1c9c6a1e17b", "Attribute": [ { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "object_relation": "md5", "timestamp": "1785581948", "to_ids": true, "type": "md5", "uuid": "8eeaa849-a4ca-406d-b6a9-107686afec4c", "value": "f2ce6fe8b52dfbacfee482a48f4ae972", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "object_relation": "sha1", "timestamp": "1785578950", "to_ids": true, "type": "sha1", "uuid": "651286f3-ebaa-4767-8e27-042f033b32d1", "value": "049a66d960b8d7bb0c9e32f35b14e978f8b726a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "object_relation": "sha256", "timestamp": "1785578950", "to_ids": true, "type": "sha256", "uuid": "d8573c62-2668-4a0c-b435-d7719fb3bddb", "value": "513a1a0a38e496a52b8d78728ef2e356a20e547d6a5e1cbe95398d714a25afd7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "object_relation": "text", "timestamp": "1785578595", "to_ids": false, "type": "text", "uuid": "870bf95a-7ffc-44f0-a7fa-c9cd7bfad86f", "value": "Claude-Pro-Relay-Technical-Overview.zip\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/75\nFirst Submission: 2026-04-05T10:28:39+00:00\nLast Submission: 2026-04-05T10:28:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "object_relation": "ssdeep", "timestamp": "1785578595", "to_ids": true, "type": "ssdeep", "uuid": "098b433a-249f-40b1-8b93-e498cebf69ea", "value": "6144:NfwMweBCUwOg209s77WaQaWX/IQdMJ0RYGeTGb/1c9sVuDBMKaEHUCXoaZTmCcqp:N4vznS5Qa6Fq0VeTGb9AEw6KpHrXoaZF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578595", "to_ids": false, "type": "size-in-bytes", "uuid": "f797083c-253c-498c-927d-8257b883ed77", "value": "377640" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "object_relation": "vhash", "timestamp": "1785578595", "to_ids": true, "type": "vhash", "uuid": "6a5f3d9b-38cb-4d19-905c-acb0714b288c", "value": "4be69577144bef446ea2cab355ac09f3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-05T10:28:39+00:00", "last_seen": "2026-04-05T10:28:39+00:00", "object_relation": "filename", "timestamp": "1785578595", "to_ids": true, "type": "filename", "uuid": "fc8228b3-13a1-4077-b07a-7d0ddff9a55a", "value": "Claude-Pro-Relay-Technical-Overview.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581969", "uuid": "a60b7ca5-18f0-43d8-b745-fa23478a3b3b", "Attribute": [ { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "object_relation": "md5", "timestamp": "1785581969", "to_ids": true, "type": "md5", "uuid": "8cdbb426-3b38-4ddd-82a6-cd85e81cd5a9", "value": "fef1d3cb35129ad25d95e279565b9001", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "object_relation": "sha1", "timestamp": "1785578951", "to_ids": true, "type": "sha1", "uuid": "0a16a592-9434-47ff-89e7-7fe165c23226", "value": "0440647d5a976e0464576071bbeaeb189685b6c9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Claude-Pro-Relay-Technical-Overview.zip", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "object_relation": "sha256", "timestamp": "1785578952", "to_ids": true, "type": "sha256", "uuid": "3e122ab4-8d10-4857-839d-789e42ef2922", "value": "4457ed2e5ef770f70596735a6bac03f78e426a548335742ac761fba60f987a26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 30/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "object_relation": "text", "timestamp": "1785578638", "to_ids": false, "type": "text", "uuid": "31ccdb55-8320-4cf1-b377-9f2bc4b16d7d", "value": "Claude-Pro-Relay-Technical-Overview.zip\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 46/74\nFirst Submission: 2026-04-17T07:38:28+00:00\nLast Submission: 2026-06-11T02:39:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "object_relation": "ssdeep", "timestamp": "1785578638", "to_ids": true, "type": "ssdeep", "uuid": "127ea055-81fb-4ca2-95fd-cab13738983a", "value": "12288:nT2XbiSkUnbZVepg4fDfEjldRwXF0ru8oX:T2XbiVUnbZEi1lkFUu8oX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1785578638", "to_ids": false, "type": "size-in-bytes", "uuid": "2b7bcb1b-0260-4640-9789-ae6af70dbc24", "value": "399066" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "object_relation": "vhash", "timestamp": "1785578638", "to_ids": true, "type": "vhash", "uuid": "ec03c24b-6ced-4a91-8fd7-fdfbb9996ce2", "value": "49a2af7026a1ecd5fba4480d9b047def" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-17T07:38:28+00:00", "last_seen": "2026-06-11T02:39:42+00:00", "object_relation": "filename", "timestamp": "1785578638", "to_ids": true, "type": "filename", "uuid": "a83dd06f-7dfd-43a4-8cea-6b459cc406b8", "value": "Claude-Pro-Relay-Technical-Overview.zip" } ] } ] } }