{ "Event": { "analysis": "1", "date": "2026-07-23", "extends_uuid": "", "info": "[Threat Intel] Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged", "protected": false, "publish_timestamp": "1785653966", "published": true, "threat_level_id": "2", "timestamp": "1785577602", "uuid": "d653af31-be4f-4200-9680-6d8116933cf7", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#cf6788", "local": false, "name": "misp-galaxy:producer=\"Hunt.io\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#b672a4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task/Job - T1053\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#fe1ef0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Password Spraying - T1110.003\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#8ee4ab", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Deployment Tools - T1072\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#4bc785", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": "" }, { "colour": "#6d779a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#c295b4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"", "relationship_type": "" }, { "colour": "#33360c", "local": false, "name": "misp-galaxy:target-information=\"Thailand\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#18005c", "local": false, "name": "rectifyq:topic=\"ai\"", "relationship_type": "" }, { "colour": "#d92121", "local": false, "name": "rectifyq:target=\"targeted\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Hades\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ShadowPad\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Vshell\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"metasploit\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "link", "uuid": "f02bebde-412e-4db4-a8d9-3bb10c135d37", "value": "https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "text", "uuid": "8b63098b-29af-4037-9b60-0e584dc481eb", "value": "Between July 9-13, 2026, three exposed directories on a Hong Kong server revealed an ongoing cyber espionage operation targeting Thailand's Ministry of Finance. The attack leveraged Hermes, an autonomous AI agent operating in unattended YOLO mode, alongside a custom Go-based implant called Hades. Recovered files included exploit code for multiple vulnerabilities, webshells, stolen credentials, and purpose-built scripts targeting MOF Hadoop infrastructure, mail systems, and GlassFish consoles. The AI agent autonomously enumerated ministry networks using LinPEAS, traversed files, and assessed privilege escalation paths. Infrastructure analysis linked multiple Hong Kong and Malaysian servers through TLS certificates and hardcoded C2 addresses. Chinese-language indicators and historical ShadowPad/VShell presence suggest probable Chinese-speaking attribution, though initial access methods remain undetermined." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "text", "uuid": "fe6bbbff-7fa2-42f7-8cba-bea7610d7a22", "value": "Name: Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged\nAuthor: AlienVault\nAdversary: \nTags: [\"cve-2026-43500\", \"hiveserver2 exploitation\", \"apache hadoop targeting\", \"cve-2026-43284\", \"vshell\", \"cve-2017-7269\", \"suo5\", \"shadowpad\", \"cve-2021-3156\", \"autonomous attack operations\", \"thailand ministry finance\", \"cve-2021-4034\", \"cve-2026-31431\", \"hermes ai agent\", \"cve-2026-43503\", \"government espionage\", \"hades\", \"hades implant\", \"yolo mode\"]\nTgtd countries: [\"Thailand\"]\nMlwr families: [\"Hades\", \"VShell\", \"ShadowPad - S0596\", \"POISONPLUG.SHADOW\", \"suo5\"]\nAttack_ids: [\"T1113\", \"T1539\", \"T1036.005\", \"T1082\", \"T1053\", \"T1190\", \"T1505.003\", \"T1110.003\", \"T1059\", \"T1083\", \"T1072\", \"T1547.001\", \"T1055.012\", \"T1068\", \"T1071.001\", \"T1090.001\"]\nIndustries: [\"Government\", \"Finance\"]" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "vulnerability", "uuid": "5e7594b5-e3aa-4b73-8b47-04d815ca9e54", "value": "CVE-2017-7269" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "vulnerability", "uuid": "bb9f0faf-4842-49e7-a5cc-9312d29ba09f", "value": "CVE-2021-3156" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "vulnerability", "uuid": "e2a848d3-2e06-486e-ac98-59f172f5e409", "value": "CVE-2021-4034" }, { "category": "Network activity", "comment": "Open directory captured on 9, 10, and 13 July", "deleted": false, "disable_correlation": false, "timestamp": "1785120094", "to_ids": true, "type": "ip-dst", "uuid": "f9e65547-8480-46ec-bfec-5876d97d322e", "value": "43.246.208.207", "Tag": [ { "colour": "#a612ce", "local": false, "name": "asn:asn=\"132883\"", "relationship_type": "" }, { "colour": "#3a7b7a", "local": false, "name": "asn:as-owner=\"TOPWAY-AS-AP TOPWAY GLOBAL LIMITED\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "vulnerability", "uuid": "71658a81-adc6-4eac-b16c-6df8b0a8844b", "value": "CVE-2026-31431" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "vulnerability", "uuid": "4461db94-63bc-405a-b4ad-65a2a2d8c890", "value": "CVE-2026-43284" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "vulnerability", "uuid": "23fbc763-acc0-4be7-88b1-2a6c064ecd86", "value": "CVE-2026-43500" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862008", "to_ids": false, "type": "vulnerability", "uuid": "147b638c-3755-46e2-aeca-b78f8af902d5", "value": "CVE-2026-43503" }, { "category": "Payload delivery", "comment": "VShell Linux stage 1 payload from 43.246.208[.]207:21083 No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118297", "to_ids": true, "type": "sha256", "uuid": "e08e3330-ef30-4f52-ade7-89efecd55e25", "value": "0f8c905aa25c86f85454acb7e77bf5c50220c2a82e5b69a33741e55c8a85f2fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118298", "to_ids": true, "type": "sha256", "uuid": "41b1544e-73a8-473a-a490-4dbf6e3b53ad", "value": "2a4cb412efa93fed7c3b3b3e49d6247b11a95ce9fddf71d9fe9db8e5f0068e0d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118299", "to_ids": true, "type": "sha256", "uuid": "f6124442-85c0-4b49-b175-cfa70724e769", "value": "5633bc0033fde3aad929d6cbd47c554e264180360b017aae04687c2d6d83f753", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118300", "to_ids": true, "type": "sha256", "uuid": "f22a3154-e858-4fc8-9f2e-ce1edb745938", "value": "576c70e12be8b2e8e7c35a5feb082e90621989adce8e64400126918d37f13e49", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118301", "to_ids": true, "type": "sha256", "uuid": "11010cbe-b887-4458-90e4-512d796cc714", "value": "58338a93fee4e008ea28e459c4d1598313d1524763ab13894ab63bf2bec4302a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118302", "to_ids": true, "type": "sha256", "uuid": "9147a9c6-221a-43f2-8445-9f0401add70b", "value": "9ff4b6d3b7dbb023bad65d2538ade745d46b763e5a12116c9c83aa2f6f5d96aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "VShell Windows stage 1 payload from 43.246.208[.]207:21083 No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118303", "to_ids": true, "type": "sha256", "uuid": "1a0a3d21-c373-4195-a0b4-7b2a89fef477", "value": "a9447ae174f4aa54f760b7d7cc985c1a970f31e151d3ff66fac247f99ba1b509", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "VShell Windows stage 2 payload from 43.246.208[.]207:21083 No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118304", "to_ids": true, "type": "sha256", "uuid": "e5479608-07b8-4150-a603-e2aff8a614c9", "value": "b65b7ede835ebba36294d52d7780065523340ee09bb8b209ef2dc495e53dfd53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118305", "to_ids": true, "type": "sha256", "uuid": "a293e04d-7cdf-4b63-a7f4-b826adf465d8", "value": "dbbb8a11a239da11cbaf99f847a2d032f34d3b522e13b0fd4ef7b2649da7123b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "VShell Linux stage 2 payload from 43.246.208[.]207:21083 No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118305", "to_ids": true, "type": "sha256", "uuid": "cd7d11d7-1f05-4354-959f-f2e1598ba584", "value": "ec7e9ab43a0cc65d29f0b84a93ba88c43d01fed3dec5c968525dc73c03cbfda2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118306", "to_ids": true, "type": "sha256", "uuid": "52de90f5-dbd5-402a-97f2-c5f03ab6f2f8", "value": "ff662b60f6a142f99292fbdd65dd1ccd79dc9628686ddf5935c92f7fb1b62a81", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Identified as SSH client in Hermes config file in 9 & 13 July directories", "deleted": false, "disable_correlation": false, "timestamp": "1785120115", "to_ids": true, "type": "ip-dst", "uuid": "887fa6bc-0444-484e-9f09-adbbf724b085", "value": "103.97.0.57", "Tag": [ { "colour": "#8cec8a", "local": false, "name": "asn:asn=\"133073\"", "relationship_type": "" }, { "colour": "#927025", "local": false, "name": "asn:as-owner=\"SZKF-AS-AP TELEGLOBAL COMMUNICATION SERVICES LIMITED\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "'www' TLS certificate overlap", "deleted": false, "disable_correlation": false, "timestamp": "1785120137", "to_ids": true, "type": "ip-dst", "uuid": "7df22c5b-b2f1-4551-9bd9-b9a93abf45b3", "value": "202.181.27.115", "Tag": [ { "colour": "#116212", "local": false, "name": "asn:asn=\"134196\"", "relationship_type": "" }, { "colour": "#731568", "local": false, "name": "asn:as-owner=\"ANYUN-INTERNET-TECHNOLOGY-HK-CO-LIMITED ANYUN INTERNET TECHNOLOGY HK CO.,LIMITED\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785120158", "to_ids": true, "type": "domain", "uuid": "c0fd1cc3-db08-4f39-8b3f-7d199eeda9db", "value": "mail4.pl", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "resolves to the C2 server, though its presence on the IP predates the observed activity", "deleted": false, "disable_correlation": false, "timestamp": "1785120179", "to_ids": true, "type": "hostname", "uuid": "d1a98e51-c053-48b2-ba1e-385388f7d44e", "value": "redhatupdating432.dnsrd.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...n HuntSQL returned two additional, related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Con...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785120200", "to_ids": true, "type": "ip-dst", "uuid": "7c0aa356-873f-4ca9-85df-4b062351e294", "value": "118.107.222.232", "Tag": [ { "colour": "#78321d", "local": false, "name": "asn:asn=\"55720\"", "relationship_type": "" }, { "colour": "#295f2f", "local": false, "name": "asn:as-owner=\"GIGABIT-MY Gigabit Hosting Sdn Bhd\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120221", "uuid": "4f610318-1ea9-4216-a77f-fa00ee5c7476", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "object_relation": "md5", "timestamp": "1785120221", "to_ids": true, "type": "md5", "uuid": "c27999fc-e40d-4754-9707-04453881743a", "value": "9c9976adbb1f4cda0e3ba85d3ed9c211", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "object_relation": "sha1", "timestamp": "1785118296", "to_ids": true, "type": "sha1", "uuid": "ff288cc0-1be2-41b4-bf46-b91ff4241866", "value": "cfa6312db63b91f8c4022078a487c1c86b7e0901", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "object_relation": "sha256", "timestamp": "1785118296", "to_ids": true, "type": "sha256", "uuid": "4fec5d3c-ee76-4a33-a719-ca237fba1fbc", "value": "d252ee7b348b7e43e432d8fb154465838f5cd5fb564905323460e6f0a0c7d1e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "object_relation": "text", "timestamp": "1785116987", "to_ids": false, "type": "text", "uuid": "f4a4f725-2fa0-4049-bce6-0c70d7f87707", "value": "Type Description: ELF\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 9/74\nFirst Submission: 2026-07-18T00:52:52+00:00\nLast Submission: 2026-07-18T00:52:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "object_relation": "ssdeep", "timestamp": "1785116987", "to_ids": true, "type": "ssdeep", "uuid": "95f849d4-e68f-4a60-a5ec-627a9f2039e6", "value": "49152:y6ttZ31ztne3T7RC90Jj4WPA7EPOnE4wbihhn3b6mmVgnKlK1KcrJAm6CJ5Ey:y6Z3t584rfnN5rJ/Ey" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116987", "to_ids": false, "type": "size-in-bytes", "uuid": "c5ade061-5a95-48d8-91d0-c18a0c9903b2", "value": "6443170" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "object_relation": "vhash", "timestamp": "1785116987", "to_ids": true, "type": "vhash", "uuid": "def7835b-ac52-423d-bb4c-d165ab20e4d9", "value": "77ac44bddf4050b946718bc38ad0cf3e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-18T00:52:52+00:00", "last_seen": "2026-07-18T00:52:52+00:00", "object_relation": "filename", "timestamp": "1785116987", "to_ids": true, "type": "filename", "uuid": "e3270e66-41bc-4a4e-a4d2-08d74ffb58cf", "value": "multipathd_04d0" } ] } ] } }