{ "Event": { "analysis": "1", "date": "2024-06-11", "extends_uuid": "", "info": "[Threat Intel] Noodle RAT: Reviewing the Backdoor Used by Chinese-Speaking Groups", "protected": false, "publish_timestamp": "1780042002", "published": true, "threat_level_id": "2", "timestamp": "1772902081", "uuid": "dc2f7910-970e-4fcf-959c-3af92d852962", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Cybercrime\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#717bc3", "local": false, "name": "misp-galaxy:producer=\"Trend Micro\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Nood RAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ANGRYREBEL\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"APT27\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Calypso\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#5887a6", "local": false, "name": "misp-galaxy:target-information=\"Japan\"", "relationship_type": "" }, { "colour": "#915448", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#33360c", "local": false, "name": "misp-galaxy:target-information=\"Thailand\"", "relationship_type": "" }, { "colour": "#2613b0", "local": false, "name": "misp-galaxy:target-information=\"Taiwan\"", "relationship_type": "" }, { "colour": "#3a00dd", "local": false, "name": "rectifyq:action-taken=\"diamond-model\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1770868770", "to_ids": false, "type": "link", "uuid": "bcbe8885-165f-4f6a-9bdd-fa130caaa761", "value": "https://www.trendmicro.com/en_us/research/24/f/noodle-rat-reviewing-the-new-backdoor-used-by-chinese-speaking-g.html" }, { "category": "Payload delivery", "comment": "package of server-side of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "timestamp": "1770869102", "to_ids": true, "type": "sha256", "uuid": "ed930c31-b467-4569-bacd-b30a92846bfa", "value": "cf543c6d4fb03ebc0a00a8ebe89511af713817878351a2bccfc62a1cc4ac0b3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Builder of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "timestamp": "1770869124", "to_ids": true, "type": "sha256", "uuid": "2ce7a5a8-7b74-4583-9f77-071742ed594a", "value": "cde4ca499282045eecd4fc15ac80a232294556a59b3c8c8a7a593e8333cfd3c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Control Panel of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "timestamp": "1770869146", "to_ids": true, "type": "sha256", "uuid": "45927097-8fd9-40ab-bd36-1ecd3acd9f0c", "value": "479e3ef28d3c70b110ff993086e4518f4a5a6fb8285b530350ad2bcd6d0bb192", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Builder of Noodle RAT for Linux v1.0.2", "deleted": false, "disable_correlation": false, "timestamp": "1770869168", "to_ids": true, "type": "sha256", "uuid": "cfa814b5-a50c-4c9a-ad12-4a4c95892a68", "value": "53338d643052bb2082f1370c21a21ff41ee1e6f43b3bd937519d7c9a491aeb13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869189", "to_ids": true, "type": "sha256", "uuid": "18b8765e-ba33-4506-b34c-6767303c5eba", "value": "c49371cd8dd33f725a780ea179e6281f5cb7f42e84a00836c8fe3350b7b9b2d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869211", "to_ids": true, "type": "sha256", "uuid": "32520e32-d380-48d7-bdb9-7c408002c7c8", "value": "a8db92a8f34caa5084a3fdb8a683a1854bff84612dfd25a965bc12a454a38556", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869233", "to_ids": true, "type": "sha256", "uuid": "e1ae2e0d-272e-417f-a8a8-924f66fd0f94", "value": "678edc2ea9473b02a13e9fc7557f6c7172f0f00f4237e2da91a6766c53db1d3d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869256", "to_ids": true, "type": "sha256", "uuid": "c470c4dc-f110-4517-b6cd-9c889a0b63cd", "value": "275d63587f3ac511d7cca5ff85af2914e74d8b68edd5a7a8a1609426d5b7f6a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869278", "to_ids": true, "type": "sha256", "uuid": "4e43bbc3-4699-4a03-8c28-710a6f439cf4", "value": "5cda94180b245de8421f226eb516d0aa1d3fd8167ebed4fa06070dd38344cec0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869299", "to_ids": true, "type": "sha256", "uuid": "47b5c651-9878-46e5-bab4-a5944406a239", "value": "61f34459815eb403ec841246a4277d825dcd25700baad867b61ec3166d034825", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869322", "to_ids": true, "type": "sha256", "uuid": "921d287a-3df6-4023-a319-ca128ab3bdda", "value": "67e60fca3d28dcae09b74ffd62f5efe462700b6d2b3334d519e4caac55820df0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869344", "to_ids": true, "type": "sha256", "uuid": "e040cf3c-3688-43d4-a6f5-b4724a82a3ed", "value": "3bff2c5bfc24fc99d925126ec6beb95d395a85bc736a395aaf4719c301cbbfd4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869366", "to_ids": true, "type": "sha256", "uuid": "4e513aa4-d333-476d-b31c-ac0ea7d46722", "value": "88b4904a582522d9a91fb4ad616adbd432c556b17427cfb177c8205f484792ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869389", "to_ids": true, "type": "sha256", "uuid": "bef8a375-f8e5-4735-9d07-579c86db7cb4", "value": "bf5ea570bf4d18e60dd758a2461fbdf73a500dbd179e458aca81d65b5d9155e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869410", "to_ids": true, "type": "sha256", "uuid": "8adbe454-3238-4968-a5f9-f181143e9d6c", "value": "7440a7b56d3670d4204a57974fa76ae76ca78168bb181640f565976d192cc159", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869432", "to_ids": true, "type": "sha256", "uuid": "bf3e5c19-c1a7-4876-8785-f6209417653f", "value": "1e9add97a289de7f5679aceace7a3a39437a33254ac9c217d9a530e9369f60be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869454", "to_ids": true, "type": "sha256", "uuid": "0f5bd900-600c-4db8-8043-cd80868fecac", "value": "cac63e105d73d59c7f83779005ada0a4d3f7fb072cfc2c9590b64fe3896d2e3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869476", "to_ids": true, "type": "sha256", "uuid": "4c8eeb59-3720-4c2f-bc55-091c41e42f71", "value": "5b4c421edb3571dbc7d581596a9ac952e453394b30132dec8e390ec561cd4abb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869498", "to_ids": true, "type": "sha256", "uuid": "b51c4349-96b4-4363-8f39-bad5f53eb169", "value": "3893f8a44a2d1fef45354984f3c6906ae8627c6f0c489f6f14e8da03197312ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869520", "to_ids": true, "type": "sha256", "uuid": "7687f8c8-c1d7-4189-9906-d4ca75867229", "value": "0153c9e22428f08597fe87cb8bd6664f6481e05bbf4e3d4174f44d2524446bdb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869542", "to_ids": true, "type": "sha256", "uuid": "a6ef32bc-b864-4662-8ae4-a334458dc119", "value": "c4fb9757ed6db6ab2bd4253cb8a1542a590443654260f2b947c288d5717487d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869563", "to_ids": true, "type": "sha256", "uuid": "1188498f-0792-40f5-b956-4fddf11cbe37", "value": "70b19172b743973a45f5d707d4eec4f8508d41aa684516f1fb8c75bec59d02bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869585", "to_ids": true, "type": "sha256", "uuid": "1099d4cb-47fe-4b38-a9ce-963b190515f0", "value": "96231be4cc6cf256eebd828af4338588272ea478c609a7f16a03bdf1a61dd431", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869607", "to_ids": true, "type": "sha256", "uuid": "a1f7a773-4bae-4821-8fd0-92e3e757463a", "value": "bf553e82119e2483d36eff51cf152861938c584749ebc005d4d612876277b787", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869629", "to_ids": true, "type": "sha256", "uuid": "cd1d744d-82ee-4bf3-afb9-2913db2b7f34", "value": "7b07b722091d9658fe106448b6e1c6b7484d7b7d163ddeb19132174973b62759", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869651", "to_ids": true, "type": "sha256", "uuid": "760a71e3-48f3-4ca5-84d2-a1f66b58ef91", "value": "b21f4039707eb4fc40ad1a7ed10be753ab3922c4a60bde819dcd74d44fef991d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869673", "to_ids": true, "type": "sha256", "uuid": "47f9aba4-799e-4db0-9edd-5d2202023eb5", "value": "4c4d51b377faebf61f95663765e622eb652866ab9cc7e9964a5d02f4dc0b53d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869694", "to_ids": true, "type": "sha256", "uuid": "8b7ad244-4130-4302-bef4-f39ff06e503f", "value": "b24e160843d96c6d75452d6f4e379b73a417fc821b26ca85d740ca0a499615ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869716", "to_ids": true, "type": "sha256", "uuid": "347b997c-1756-4e32-b63b-cc097813564d", "value": "e5fb5a3b8663fbb2686caf88fdb3362115dc0f0bf9cc5d32d1e42c00aa6660b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869738", "to_ids": true, "type": "sha256", "uuid": "252bfe7f-0e6c-49f5-8f88-85bbb21e3011", "value": "d17d964cacb063a6fe685d6e5e7dbc02c597de51b46c994f0aadb56c3bf96f13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869760", "to_ids": true, "type": "sha256", "uuid": "87133cc5-2b3d-48c4-a35e-129a37cd5e77", "value": "ba45dfa8e6b86140e526959c8568824ddd743d418231440d48740e76a33610ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869782", "to_ids": true, "type": "sha256", "uuid": "3a8bcae4-494f-4659-b93b-5004d041f3e4", "value": "1c2bbab6c496b66b108dc810649c19319655a2246f7fc6cf2a0911f5d73f2f3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869803", "to_ids": true, "type": "sha256", "uuid": "406acc3f-ef1f-4ee0-ae43-83e8d113ca56", "value": "14f9a20356fc0e1806524057e8366d994831e3568cf438694a5c4d5463c25010", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869825", "to_ids": true, "type": "sha256", "uuid": "38978a71-2b77-407c-bc7b-3ce6cba60307", "value": "7e7bfe7e83867defa9280c8bce98cabcd0e6410cac7cc9a1baa88131b4a263b1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869847", "to_ids": true, "type": "sha256", "uuid": "2613d33c-11ea-471f-8f83-e9ae66e44196", "value": "45b3d192ed79541a9711c16c7d73bd4d0a74598ecb7b56416f8754fb5d6feb56", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869869", "to_ids": true, "type": "sha256", "uuid": "6e67e63d-c18b-47dd-9a01-f032d48cf137", "value": "53cebf50348e4507e92d23cfe3bbc87d6bf50e06962462d036542c37a50a23c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869891", "to_ids": true, "type": "sha256", "uuid": "8752723c-20e8-45c5-860c-685997eb891b", "value": "a27d133f6a1bd72285f021403082dc8e47180fe56e88b274f474459088857603", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869912", "to_ids": true, "type": "sha256", "uuid": "3b981ff5-6393-4674-902a-f3efd862f434", "value": "4198efb00840f440d96987518bd80dbc90cde3023bc8c2b0aae456af07875405", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770869934", "to_ids": true, "type": "sha256", "uuid": "0c9f51eb-a49e-49da-9a09-116e1d522f11", "value": "abdbbc10467421b93fe1df6da0de70a4d454adcced1bfc6c1cebf1207fba93db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869956", "to_ids": true, "type": "sha256", "uuid": "5b99639a-6f68-49bd-8b4e-5168e9c62330", "value": "bcac1d42c39932fb20f571655cd1bbe507c3fddda63d4f0ea8986a3dd5265f41", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770869978", "to_ids": true, "type": "sha256", "uuid": "640ae4e9-ab93-4577-a2f7-6173da8ffe98", "value": "68389b48c6f15b6da7f2d78c0864d6b9b9135f6ace3564d29b26f5dc9b5d6313", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770870000", "to_ids": true, "type": "sha256", "uuid": "80c0db45-523f-4dac-ac43-e4e3ef3d01e0", "value": "bf1b88385aebb37182421e967749f057fbefb4e4386bb47b5098abac7c70c476", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770870022", "to_ids": true, "type": "sha256", "uuid": "102f7cbf-0ff0-4ce2-b87b-432a644ad209", "value": "1a9ff06ac18f57a6382fdae54bf8735a6ad7d9c9f1f9aa0dfff0e3e828f1820b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770870044", "to_ids": true, "type": "sha256", "uuid": "e7fdfcf4-68fe-4ba7-86a3-ca63b9ae0077", "value": "15f3536ac33588444cf6a632f17c74ee0ee8777d0d2166206222b4d5f66de715", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770870065", "to_ids": true, "type": "sha256", "uuid": "48f647ff-400b-4691-aabc-693f369a68cb", "value": "ca2200ef6ce1abc37e5778b40e9b14031b81014560dae9c6a16fd7ba948c7656", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "timestamp": "1770870087", "to_ids": true, "type": "sha256", "uuid": "456e6a76-eb7b-48e9-9bdd-47ac005544c3", "value": "bbcfc826f614433ff1b7c8031349cf5b411d868b07259eca9c19cd5af772b85e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770870109", "to_ids": true, "type": "sha256", "uuid": "368d3f7f-37e0-4d4f-8056-5e8a30d38980", "value": "6933a01980378c2160740e5cecaba29530555e3d65bd89ef80db49419a419f8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770870131", "to_ids": true, "type": "sha256", "uuid": "33414dcf-0d00-46c6-8490-854584e02c42", "value": "5dac572374cb40561ea5dbc0dfc963d863f08862a0bd33fdac6ac8d0aa180ada", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "timestamp": "1770870152", "to_ids": true, "type": "sha256", "uuid": "1a08bf19-9db8-422f-9cbc-73b0c945bb07", "value": "24a827336a1f942925fd57e763109e3a83b1a5762c077c1e80bd057bb1b15bad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "diamond-model", "deleted": false, "disable_correlation": false, "timestamp": "1770869182", "to_ids": false, "type": "comment", "uuid": "d3f6273f-5593-444b-9c66-b00acc260692", "value": "https://raw.githubusercontent.com/rectifyq/Collections/refs/heads/main/Diamond-Models/2024/240611-Noodle-RAT/20.png" }, { "category": "Other", "comment": "diamond-model", "deleted": false, "disable_correlation": false, "timestamp": "1770869182", "to_ids": false, "type": "comment", "uuid": "c582f899-0ec5-4822-a6a0-526d09a4ecef", "value": "https://raw.githubusercontent.com/rectifyq/Collections/refs/heads/main/Diamond-Models/2024/240611-Noodle-RAT/21.png" }, { "category": "Other", "comment": "diamond-model", "deleted": false, "disable_correlation": false, "timestamp": "1770869182", "to_ids": false, "type": "comment", "uuid": "c008ffa0-b7ae-44d5-aa87-c3e18e917680", "value": "https://raw.githubusercontent.com/rectifyq/Collections/refs/heads/main/Diamond-Models/2024/240611-Noodle-RAT/22.png" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869103", "uuid": "c851de23-be0d-4d46-b7c4-86925e413851", "Attribute": [ { "category": "Payload delivery", "comment": "package of server-side of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869102", "to_ids": true, "type": "md5", "uuid": "e477cffe-f4c0-4a17-a9ad-84d66973ebb6", "value": "4f5297c564c8f0064e7db65864198025", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "package of server-side of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869102", "to_ids": true, "type": "sha1", "uuid": "8a105c2e-ae90-4991-9434-6ecfe66241dc", "value": "8d9530b52744e681b1ca0de5580d065083cf9e44", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "package of server-side of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869103", "to_ids": true, "type": "sha256", "uuid": "220bb09f-4059-4d7d-927f-a88541c4ffb5", "value": "cf543c6d4fb03ebc0a00a8ebe89511af713817878351a2bccfc62a1cc4ac0b3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869102", "to_ids": true, "type": "ssdeep", "uuid": "726fc492-e1f7-4064-a725-928f2d9e38ce", "value": "98304:Pn3c1KZsKWNd7323ftP61VUheowWHc++iLIl8CS18:PnBtWNdIty1V+eowof+iMS18" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869102", "to_ids": false, "type": "size-in-bytes", "uuid": "e0b6d822-3e59-4e74-aa59-f67fe4b02fdc", "value": "5487224" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869102", "to_ids": true, "type": "vhash", "uuid": "487490c5-9cb4-4d21-ac47-af37b88111f6", "value": "e30ea8d705a6f9d302197ecb8491c272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869102", "to_ids": true, "type": "filename", "uuid": "865edb80-6acc-4626-bf2c-9b9c4e9e352a", "value": "nood.7z" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 29/10/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869102", "to_ids": false, "type": "text", "uuid": "7322de3a-72c8-4e62-9e69-fb667964b587", "value": "package of server-side of Noodle RAT for Linux v1.0.1\r\nType Description: 7ZIP\nMicrosoft: None\nVT Total Detection:43/63\nFirst Submission:2023-11-04T12:55:51.000000+00:00\nLast Submission:2023-11-04T12:55:51.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869125", "uuid": "b302b38c-a213-434f-8897-8a7c69d3d471", "Attribute": [ { "category": "Payload delivery", "comment": "Builder of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869124", "to_ids": true, "type": "md5", "uuid": "2cc66716-eebe-45cc-b02a-946d26895554", "value": "025a32835eb8647147ed1bbf64c37fa5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Builder of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869124", "to_ids": true, "type": "sha1", "uuid": "171757d7-2fef-48a8-be2b-7aa2d3629944", "value": "b3a027f3bdb8ce87ea5eacc65e803d89b5f3dc35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Builder of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869125", "to_ids": true, "type": "sha256", "uuid": "d655437b-8bda-48ce-aacb-9a84c63b371f", "value": "cde4ca499282045eecd4fc15ac80a232294556a59b3c8c8a7a593e8333cfd3c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869124", "to_ids": true, "type": "ssdeep", "uuid": "d9916be9-de4d-4636-95ae-127e7dc45db6", "value": "49152:2L2snho42br76d4+SoXEp6FyhCEu4c8IvBaHOgTOa1t2icVnXm1G:2Xho4Ur76d2oK6FyhCEu4c8ISpt2icN2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869124", "to_ids": false, "type": "size-in-bytes", "uuid": "8114276f-13e6-4cc9-a248-77b00a2e25a8", "value": "1870848" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869124", "to_ids": true, "type": "vhash", "uuid": "07f17d3b-ea45-4328-9dbc-00c0a725036f", "value": "016056655d555550b02010061009b6z210e5za0500e4z19z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869124", "to_ids": true, "type": "filename", "uuid": "9c2b96f8-153b-4c3e-a032-2ebed3381531", "value": "NoodMaker.exe" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 25/07/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869124", "to_ids": false, "type": "text", "uuid": "f698ccf5-8c53-4138-b87d-f0f946a6255e", "value": "Builder of Noodle RAT for Linux v1.0.1\r\nType Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:46/72\nFirst Submission:2023-11-03T05:59:08.000000+00:00\nLast Submission:2024-07-24T14:09:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869146", "uuid": "74764527-2b05-46a8-9549-dfcff968c8b4", "Attribute": [ { "category": "Payload delivery", "comment": "Control Panel of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869146", "to_ids": true, "type": "md5", "uuid": "6a274f7b-f82e-435a-9205-d27497483824", "value": "6728b74d5b30d2db8436f0c9f64684f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Control Panel of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869146", "to_ids": true, "type": "sha1", "uuid": "9a7e19f9-7e67-4456-92be-979aba8764db", "value": "6920cf39875fb1be1a01471c3041ece615ee4e4e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Control Panel of Noodle RAT for Linux v1.0.1", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869146", "to_ids": true, "type": "sha256", "uuid": "17ab1727-8f7e-43b6-acbf-fe5639757eff", "value": "479e3ef28d3c70b110ff993086e4518f4a5a6fb8285b530350ad2bcd6d0bb192", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869146", "to_ids": true, "type": "ssdeep", "uuid": "b60646b3-4f7c-4621-bac2-339d65aea96e", "value": "98304:CAm9JxmAATbh8TdW9bS3j0Q3o7Qr1VS/UMPXSE6f2Q/80f:CuywqXY7Qr1VS/ZPX2/d" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869146", "to_ids": false, "type": "size-in-bytes", "uuid": "69c65f18-a788-467b-b166-b208c37ac962", "value": "3220992" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869146", "to_ids": true, "type": "vhash", "uuid": "0b3957b7-4d73-4dcf-95a6-da037259505d", "value": "036056655d755550b0201006100a96z210d5zb0600dd3z1167z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869146", "to_ids": true, "type": "filename", "uuid": "be6afdc4-001a-47c6-9508-4c826bd5a38e", "value": "NoodLinux.exe" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 24/07/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869146", "to_ids": false, "type": "text", "uuid": "c1cdf5e1-6e7c-4e4b-b3ab-c90584b94e43", "value": "Control Panel of Noodle RAT for Linux v1.0.1\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/Alevaul!rfn\nVT Total Detection:47/72\nFirst Submission:2021-10-15T08:30:13.000000+00:00\nLast Submission:2024-07-24T12:45:40.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869168", "uuid": "c3ce2e9d-89b2-48f5-a1ea-3905d71318c3", "Attribute": [ { "category": "Payload delivery", "comment": "Builder of Noodle RAT for Linux v1.0.2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869168", "to_ids": true, "type": "md5", "uuid": "5f22deba-0ce1-473a-ac7d-be6db0c71517", "value": "cb131b05dc3e42fad5caeadccbee378b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Builder of Noodle RAT for Linux v1.0.2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869168", "to_ids": true, "type": "sha1", "uuid": "e7ca53e8-3536-4dac-9e5f-8213815b5d04", "value": "8965d8da52af8379704b09226252e185ae1b0f6f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Builder of Noodle RAT for Linux v1.0.2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869168", "to_ids": true, "type": "sha256", "uuid": "1a167196-1b33-4040-955d-d7cf0fdc1104", "value": "53338d643052bb2082f1370c21a21ff41ee1e6f43b3bd937519d7c9a491aeb13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869167", "to_ids": true, "type": "ssdeep", "uuid": "5eabb38a-8d99-4421-893b-d4ce5aab73b4", "value": "49152:TL2snho42br76d4+SoXEp6FyhCEu4c8IvBaHOgTOa1t2icVsUrG:TXho4Ur76d2oK6FyhCEu4c8ISpt2icaU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869167", "to_ids": false, "type": "size-in-bytes", "uuid": "b0d3cce8-aa85-4d5a-806b-6bbc5d400e12", "value": "1873408" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869167", "to_ids": true, "type": "vhash", "uuid": "f4b04ace-f3e2-4835-bcf6-56a529110e89", "value": "016056655d556550b02010061009b6z210e5za0500e4z19z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869167", "to_ids": true, "type": "filename", "uuid": "dfd51dc1-b22c-4091-973d-06a9ac5234ce", "value": "NoodMaker.exe" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869167", "to_ids": false, "type": "text", "uuid": "77affcb3-de5d-4f70-8437-56db071e2293", "value": "Builder of Noodle RAT for Linux v1.0.2\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Linux/Rekoobe.A!MTB\nVT Total Detection:47/73\nFirst Submission:2019-06-12T05:01:57.000000+00:00\nLast Submission:2024-08-09T06:53:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869190", "uuid": "b36b11b9-dedf-46f7-ae39-7d53bbaf1db7", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869189", "to_ids": true, "type": "md5", "uuid": "772cf5b4-a10b-41f3-af9a-234f5ab44b08", "value": "ecac141c99e8cef83389203b862b24fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869190", "to_ids": true, "type": "sha1", "uuid": "4c8c7e97-6f9d-407a-ad72-be2f1de72e51", "value": "2f4ee1c39f78ecde5a84233233d02b355022aa50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869190", "to_ids": true, "type": "sha256", "uuid": "6a0c37e7-23b1-4ab7-8677-bd8667308654", "value": "c49371cd8dd33f725a780ea179e6281f5cb7f42e84a00836c8fe3350b7b9b2d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869189", "to_ids": true, "type": "ssdeep", "uuid": "386ff454-6887-4d9f-9e81-c9b45f02a33a", "value": "1536:Qnj4ypXVrbS1IgD+8TotI1fwIpb+nyS4AKiH:Ej4yEBcv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869189", "to_ids": false, "type": "size-in-bytes", "uuid": "d0f49916-e16f-48fc-bd38-1af582c76351", "value": "64412" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869189", "to_ids": true, "type": "vhash", "uuid": "ea64a925-0d94-4172-8de2-c70e33975312", "value": "e22fe57345c3e8fa0bf1b9a311ec9dc5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869189", "to_ids": true, "type": "filename", "uuid": "b54a78f3-d0fa-4be9-a088-080f89349c46", "value": "CCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869189", "to_ids": false, "type": "text", "uuid": "8dd95ca0-39ca-4a7a-ad15-cdb1b866b515", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/65\nFirst Submission:2018-12-10T05:44:32.000000+00:00\nLast Submission:2023-11-11T07:10:45.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869212", "uuid": "c80364cb-feaf-45f6-9c5f-87770fbe47c9", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869211", "to_ids": true, "type": "md5", "uuid": "142ef21e-8182-45e6-b92f-a4b8ef2e9384", "value": "67c8235ac0861c8622ac2ddb1f5c4a18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869211", "to_ids": true, "type": "sha1", "uuid": "569f423a-1d0a-49ac-8f4e-c37e8c55cf67", "value": "6aa0b6bfe059354782febd4fa665dbacd726b488", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869212", "to_ids": true, "type": "sha256", "uuid": "1f81f0e5-f512-46e9-b240-a90b26632650", "value": "a8db92a8f34caa5084a3fdb8a683a1854bff84612dfd25a965bc12a454a38556", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869211", "to_ids": true, "type": "ssdeep", "uuid": "6dafff31-9a93-4b0b-8db8-7199533eacfd", "value": "1536:Qnj4ypXVrbS1IgD+8TotI1fwIpb+nyS4AKi7N:Ej4yEBc5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869211", "to_ids": false, "type": "size-in-bytes", "uuid": "5a27dcb6-e8ab-4eaa-be75-cc5faf280b12", "value": "64412" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869211", "to_ids": true, "type": "vhash", "uuid": "b7422d1a-6947-4262-9f85-545e643676b7", "value": "e22fe57345c3e8fa0bf1b9a311ec9dc5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869211", "to_ids": true, "type": "filename", "uuid": "8d4fa1ef-1cc4-44db-ad79-37d659e5d27d", "value": "a8db92a8f34caa5084a3fdb8a.exe" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869211", "to_ids": false, "type": "text", "uuid": "8ddef602-65ea-41e8-9389-960c70d3ab08", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/65\nFirst Submission:2018-12-12T19:57:24.000000+00:00\nLast Submission:2025-03-11T09:09:01.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869233", "uuid": "6689d3a2-bf88-45cf-bc83-deef21190d60", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869233", "to_ids": true, "type": "md5", "uuid": "eb0ee65e-4d68-416c-9ce2-e5f38ebc06c1", "value": "c1eebf2d4f441226770276110d1e5cf2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869233", "to_ids": true, "type": "sha1", "uuid": "951b15e6-b605-443e-9400-817f48a334dc", "value": "9249b61b2d23546097ad2d5042d3f2f21ccbd11a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869233", "to_ids": true, "type": "sha256", "uuid": "b2cbc06a-ed52-4c46-b24f-7a7b256fd0a2", "value": "678edc2ea9473b02a13e9fc7557f6c7172f0f00f4237e2da91a6766c53db1d3d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869233", "to_ids": true, "type": "ssdeep", "uuid": "554dfd3d-a2af-403e-80e6-613a99c631bb", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869233", "to_ids": false, "type": "size-in-bytes", "uuid": "e40f06f4-65a1-47a2-8c78-41f0c3cb473c", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869233", "to_ids": true, "type": "vhash", "uuid": "19444295-1cbe-41bd-8fef-a65998260875", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869233", "to_ids": false, "type": "text", "uuid": "e79d527e-6a08-41ff-8da4-8534d6419ebe", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/63\nFirst Submission:2019-06-12T05:04:44.000000+00:00\nLast Submission:2024-07-24T12:47:03.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869256", "uuid": "adabba84-78f6-460e-96d6-2a1d8c25c952", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869256", "to_ids": true, "type": "md5", "uuid": "4b326ede-3aaa-434b-a802-1bafa7645e57", "value": "0a35e06f53c17ab1c8e18e7e0c0821d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869256", "to_ids": true, "type": "sha1", "uuid": "35cd90d3-5dac-4f0e-aa5b-58a36c518ec1", "value": "14fd16e6465b74c5ac4dc895f4c15bccb447af31", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869256", "to_ids": true, "type": "sha256", "uuid": "8a7b1aad-699b-4e14-a304-2470aac7cd0b", "value": "275d63587f3ac511d7cca5ff85af2914e74d8b68edd5a7a8a1609426d5b7f6a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869256", "to_ids": true, "type": "ssdeep", "uuid": "75f11e1a-2706-4ccf-95fe-bdc318428e61", "value": "1536:cgNZiXzc9qrw4NuVRNnUOnhhWcgZOLg2e41E5vqHekyN/1H5xuM8ZcU:clcUrwtFUOnhhWcgELg2vE5vq+xN/1Zq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869256", "to_ids": false, "type": "size-in-bytes", "uuid": "258220a5-25e7-4b1b-9011-3b04ee2e7a2c", "value": "86144" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869256", "to_ids": true, "type": "vhash", "uuid": "b3ac1ba7-77b5-42b8-8062-6efa796d24b7", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869256", "to_ids": true, "type": "filename", "uuid": "a186b1c4-345c-4f2f-bdda-538b73e783dd", "value": "CCCCCCCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 23/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869256", "to_ids": false, "type": "text", "uuid": "dfbfb0c1-3048-4635-87b5-86de045e3305", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:41/64\nFirst Submission:2021-09-21T14:23:52.000000+00:00\nLast Submission:2024-07-24T12:44:20.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869278", "uuid": "2bb3952f-4e6b-40ae-ad5d-2da534ddc18b", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869278", "to_ids": true, "type": "md5", "uuid": "becedf85-6ce0-4767-a1a1-8da866af7a68", "value": "b42018c5fba4758ac46eb2c39344a020", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869278", "to_ids": true, "type": "sha1", "uuid": "9a4b74e1-d8ad-4d67-823f-1160a115d266", "value": "f366f2730d481059a5153590ef3cab5d7658a3ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869278", "to_ids": true, "type": "sha256", "uuid": "3d35ecd7-280b-4899-9936-8eb553594538", "value": "5cda94180b245de8421f226eb516d0aa1d3fd8167ebed4fa06070dd38344cec0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869277", "to_ids": true, "type": "ssdeep", "uuid": "3c4450f7-f0ea-4e4a-ad74-a998661620b9", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869277", "to_ids": false, "type": "size-in-bytes", "uuid": "3d4a4675-e681-4d17-af99-b5f1dbeffdb7", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869277", "to_ids": true, "type": "vhash", "uuid": "336ff0c7-7c04-4c4c-8e41-22bd18131203", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869277", "to_ids": true, "type": "filename", "uuid": "d48d986c-41a2-46a8-a815-d2aab5eecc7a", "value": "x64.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869277", "to_ids": false, "type": "text", "uuid": "27796194-e1dc-412f-a31b-286c074adf3f", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/64\nFirst Submission:2021-11-09T23:31:50.000000+00:00\nLast Submission:2024-07-24T12:26:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869300", "uuid": "3ab0f25d-39d6-4d5a-b224-12d4e5e11ee4", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869300", "to_ids": true, "type": "md5", "uuid": "f1145fd7-490d-4fdd-87c7-cbda3da78a42", "value": "f9eece34b6574236f067fa1a1782cdc0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869300", "to_ids": true, "type": "sha1", "uuid": "5a48dfd2-47d2-4c59-853b-0cca5eb99c68", "value": "54670aaf6212eeec04e2cb1bf9cff984393f29ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869300", "to_ids": true, "type": "sha256", "uuid": "4e69a97c-911c-49bb-947a-8f3b6d123cbc", "value": "61f34459815eb403ec841246a4277d825dcd25700baad867b61ec3166d034825", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869299", "to_ids": true, "type": "ssdeep", "uuid": "61c385e6-5b1c-421a-b467-f15e8a435040", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869299", "to_ids": false, "type": "size-in-bytes", "uuid": "f072ca6f-405c-4d3f-a832-e40fd2f0067d", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869299", "to_ids": true, "type": "vhash", "uuid": "c2d6dfc8-98ef-449d-8e87-e1b496a0c06c", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869299", "to_ids": false, "type": "text", "uuid": "26ea04fd-53a6-4bd5-aa69-ebea4e4a84a5", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/64\nFirst Submission:2021-12-10T17:52:45.000000+00:00\nLast Submission:2024-07-24T12:37:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869323", "uuid": "f785e534-6f48-46b6-a122-0eab9727a3bb", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869323", "to_ids": true, "type": "md5", "uuid": "e7dd6908-8d5e-4812-9f3c-87d1be865104", "value": "7d631e5b0c78805dd5d440cce788d25b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869323", "to_ids": true, "type": "sha1", "uuid": "42285fd2-afa1-4c46-91dc-e92fdd158407", "value": "1be33241473015788c11571ad3ab13ac82805da2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869323", "to_ids": true, "type": "sha256", "uuid": "f1fd6eac-ea07-49c3-9878-f96e0841449c", "value": "67e60fca3d28dcae09b74ffd62f5efe462700b6d2b3334d519e4caac55820df0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869322", "to_ids": true, "type": "ssdeep", "uuid": "a3f710e6-6fa8-45d9-9752-016b2d2e2781", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869322", "to_ids": false, "type": "size-in-bytes", "uuid": "0aa39ef2-5a73-4230-8204-43d142dacb87", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869322", "to_ids": true, "type": "vhash", "uuid": "0aec7fac-51af-4f7a-a225-795276caca84", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869322", "to_ids": true, "type": "filename", "uuid": "a14185eb-f81a-4dc2-9120-e47fabbaebf2", "value": "67e60fca3d28dcae09b74ffd62f5efe462700b6d2b3334d519e4caac55820df0.elf" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 23/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869322", "to_ids": false, "type": "text", "uuid": "86c39711-30c7-43ad-b52c-2372e3a494de", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:45/64\nFirst Submission:2021-12-13T16:58:39.000000+00:00\nLast Submission:2024-07-24T12:39:20.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869345", "uuid": "e93b3897-1b1f-4a32-9463-c65991311445", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869345", "to_ids": true, "type": "md5", "uuid": "e76e19ef-5f2e-4c68-88f2-4fed2e956c58", "value": "35743db3dc333245ef5b69100721ced9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869345", "to_ids": true, "type": "sha1", "uuid": "5453adab-a97b-48d9-bd7a-cc04b1c600b1", "value": "fa681933eccc1b3cae4cce6ab6f16db08c2f2a87", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869345", "to_ids": true, "type": "sha256", "uuid": "1e956666-6839-481c-89b1-15b7fac27d10", "value": "3bff2c5bfc24fc99d925126ec6beb95d395a85bc736a395aaf4719c301cbbfd4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869344", "to_ids": true, "type": "ssdeep", "uuid": "44dc869b-9022-40e9-bab6-5669bc202926", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869344", "to_ids": false, "type": "size-in-bytes", "uuid": "27a9ade8-cc47-4881-8a4e-9551e7836ba7", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869344", "to_ids": true, "type": "vhash", "uuid": "cadb2871-47f1-488d-9d1a-998212c5a098", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869344", "to_ids": true, "type": "filename", "uuid": "70c23713-20da-49b0-83bf-ee05fe1ad8f7", "value": "CCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 23/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869344", "to_ids": false, "type": "text", "uuid": "3b816e4b-0199-4d1c-9f06-9f269f6f252c", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/64\nFirst Submission:2022-01-13T15:56:28.000000+00:00\nLast Submission:2024-07-24T12:07:36.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869367", "uuid": "4ff99c53-146b-4e68-a616-f2e3caa75d8d", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869367", "to_ids": true, "type": "md5", "uuid": "ffb48d33-cb14-46fb-be1c-75b79968eb28", "value": "7038782f110e67d001b2cf466e13e391", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869367", "to_ids": true, "type": "sha1", "uuid": "9d2de291-1bc9-4ca9-b4f5-1bf3abd327d5", "value": "73c05da7efcc15de593bb4542bf8de6a9aab74a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869367", "to_ids": true, "type": "sha256", "uuid": "96ab1a69-67bb-45ce-a479-a1938d282b8d", "value": "88b4904a582522d9a91fb4ad616adbd432c556b17427cfb177c8205f484792ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869366", "to_ids": true, "type": "ssdeep", "uuid": "e722849f-219c-474c-b502-22b46de07c03", "value": "3072:mXhFlUinhhWbCh+ohq+xN/1Zx2gytXhFlUinhhWbCh+ohq+xN/1Zx2gy:mXtUinhhl7bHpytXtUinhhl7bHpy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869366", "to_ids": false, "type": "size-in-bytes", "uuid": "34199070-d999-4052-a9b1-03b025937e73", "value": "166528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869366", "to_ids": true, "type": "vhash", "uuid": "d1774619-238a-4678-abfc-ca57a7cc8097", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869366", "to_ids": true, "type": "filename", "uuid": "dc0ef680-7f4b-4da6-8e2f-88c80a799a29", "value": "CCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869366", "to_ids": false, "type": "text", "uuid": "06d4d5be-4364-4e09-a9a8-b00459ec3b64", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:41/65\nFirst Submission:2022-07-05T12:33:03.000000+00:00\nLast Submission:2024-07-24T12:41:36.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869389", "uuid": "530825e1-e5e9-427a-a59d-079796285364", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869389", "to_ids": true, "type": "md5", "uuid": "b571d6a1-b4a2-4926-8603-a18615f66e7d", "value": "8457f71c6a5fe83bb513d1dfba99271a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869389", "to_ids": true, "type": "sha1", "uuid": "549ce474-a946-4a7a-8da5-9b63a2f23988", "value": "7316b5cc2aac0390890f6819d90b7cd36359ca62", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869389", "to_ids": true, "type": "sha256", "uuid": "d782f766-bcb4-411f-8665-86628f293e5a", "value": "bf5ea570bf4d18e60dd758a2461fbdf73a500dbd179e458aca81d65b5d9155e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869388", "to_ids": true, "type": "ssdeep", "uuid": "c328913a-663a-4bcb-93e8-39d2e797f48e", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869388", "to_ids": false, "type": "size-in-bytes", "uuid": "c6bb1bd6-3711-406f-b5a7-8f92c1795501", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869388", "to_ids": true, "type": "vhash", "uuid": "fad90cb6-2a53-4ca1-88e2-5050286af550", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869388", "to_ids": true, "type": "filename", "uuid": "50c556ef-8b7b-4474-8418-812ac8bc85dd", "value": "bf5ea570bf4d18e60dd758a2461fbdf73a500dbd179e458aca81d65b5d9155e1.elf" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 23/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869388", "to_ids": false, "type": "text", "uuid": "262212d9-1de2-4ee0-846d-1beeccba0e19", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/64\nFirst Submission:2022-07-26T07:38:59.000000+00:00\nLast Submission:2024-07-24T14:03:23.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869411", "uuid": "5db968db-838a-4437-94d0-c7ccc3fbd02b", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869411", "to_ids": true, "type": "md5", "uuid": "8b3a5070-48cf-496a-a7a3-73b40f1ae722", "value": "905c2158fadfe31850766f010e149a0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869411", "to_ids": true, "type": "sha1", "uuid": "7df65e86-0b48-4adb-b207-51d3c789c178", "value": "4d4bc836641840ad8b0873b07d31ce38732c4a28", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869411", "to_ids": true, "type": "sha256", "uuid": "c6cf84cf-2860-4d57-8a94-92305990a592", "value": "7440a7b56d3670d4204a57974fa76ae76ca78168bb181640f565976d192cc159", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869410", "to_ids": true, "type": "ssdeep", "uuid": "175313dc-8ccc-425d-bdd2-5a477556ed12", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869410", "to_ids": false, "type": "size-in-bytes", "uuid": "f92d9ea8-ecc9-4eba-acd3-cd52e69fae2a", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869410", "to_ids": true, "type": "vhash", "uuid": "5c847d36-9e3b-4aa4-9f92-52f2c1913b31", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869410", "to_ids": true, "type": "filename", "uuid": "ec692e2c-d690-400b-b9e5-5bf968ccc335", "value": "7440a7b56d3670d4204a57974fa76ae76ca78168bb181640f565976d192cc159.elf" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 23/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869410", "to_ids": false, "type": "text", "uuid": "3bb2937d-8569-46fa-9370-e5b89ff9b021", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/64\nFirst Submission:2022-09-11T15:12:47.000000+00:00\nLast Submission:2024-07-24T12:51:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869433", "uuid": "f21ba1f0-b0f9-46cc-b063-450a4c2dbde6", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869432", "to_ids": true, "type": "md5", "uuid": "2e5167ea-0b54-4a50-8ef6-0c807b8ddea3", "value": "256a871f1f968650291eef92428ee9de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869432", "to_ids": true, "type": "sha1", "uuid": "ab6482e4-23a1-43f7-a17c-9e3c39bdf9ed", "value": "4b149222830a3df927a42b72d7f07e9198947f01", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869433", "to_ids": true, "type": "sha256", "uuid": "42b422a7-2c29-40f1-b14f-2bbad3803755", "value": "1e9add97a289de7f5679aceace7a3a39437a33254ac9c217d9a530e9369f60be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869432", "to_ids": true, "type": "ssdeep", "uuid": "f0478277-1be0-40a9-9188-3472e03041a9", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869432", "to_ids": false, "type": "size-in-bytes", "uuid": "96008ae7-e3c9-4141-a13e-4a2bf6de9859", "value": "86176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869432", "to_ids": true, "type": "vhash", "uuid": "b4264d7b-9bee-4325-9eda-5a44b3b9149e", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869432", "to_ids": true, "type": "filename", "uuid": "95e7f6ff-369b-4b2c-9da0-a55726788c91", "value": "sshd" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 02/10/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869432", "to_ids": false, "type": "text", "uuid": "29b7a823-44bf-46c8-b31b-139861e26ed3", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:42/65\nFirst Submission:2022-10-26T19:02:20.000000+00:00\nLast Submission:2025-01-02T08:22:36.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869455", "uuid": "d4d16c05-45d5-4e5b-a19a-1f99e4041929", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869454", "to_ids": true, "type": "md5", "uuid": "868d5798-8a6a-4700-91f2-fc780d151442", "value": "f61a68097d5cf8cf74a9c97c33e5e626", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869454", "to_ids": true, "type": "sha1", "uuid": "231b5d8c-04c7-4b1d-a1e8-ce2ba20384ee", "value": "d30ef99a3da490b15b7fc098cec813f6acfb3ebe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869455", "to_ids": true, "type": "sha256", "uuid": "aad69f93-f88f-4ef5-bafe-72eb346052d5", "value": "cac63e105d73d59c7f83779005ada0a4d3f7fb072cfc2c9590b64fe3896d2e3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869454", "to_ids": true, "type": "ssdeep", "uuid": "6713aa2d-b753-4094-bfba-9101c542bb4a", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869454", "to_ids": false, "type": "size-in-bytes", "uuid": "a4a17081-205c-427c-99cd-8ef23d91e7a7", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869454", "to_ids": true, "type": "vhash", "uuid": "b6a7497b-e821-4172-a284-06f0bc41422a", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869454", "to_ids": true, "type": "filename", "uuid": "c82d5edc-67ad-43d8-a6d7-2039bf2d622c", "value": "f61a68097d5cf8cf74a9c97c33e5e626.virus" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 20/11/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869454", "to_ids": false, "type": "text", "uuid": "501b95c5-573a-4cda-9f95-d239a31dc906", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:40/65\nFirst Submission:2022-11-20T17:30:03.000000+00:00\nLast Submission:2024-07-24T14:08:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869476", "uuid": "5e1a8910-dd96-4e50-a00b-3c6ee58e1ab2", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869476", "to_ids": true, "type": "md5", "uuid": "6eb73239-b4d1-4a32-8223-f0abece3ba22", "value": "e8007e15550a69ad8fd60d06c6d36385", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869476", "to_ids": true, "type": "sha1", "uuid": "1796b81a-3cf1-4267-8799-fde133a16b62", "value": "bf191c7545dc2d69bbcde1fe857add49f599ea20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869476", "to_ids": true, "type": "sha256", "uuid": "4969f0d3-065e-42c6-86b9-0db47bfdd04c", "value": "5b4c421edb3571dbc7d581596a9ac952e453394b30132dec8e390ec561cd4abb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869476", "to_ids": true, "type": "ssdeep", "uuid": "15e7951b-f402-44e4-8e52-b807f0277ecd", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869476", "to_ids": false, "type": "size-in-bytes", "uuid": "2dd4c7ea-9cfb-4e16-9c13-c70fb2b6b231", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869476", "to_ids": true, "type": "vhash", "uuid": "6c48fa1b-4047-414b-aa69-edb82093c601", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869476", "to_ids": true, "type": "filename", "uuid": "cfefd09e-2691-474d-a07b-91111aeaaeb8", "value": "nood.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869476", "to_ids": false, "type": "text", "uuid": "35ba7678-90e9-4309-8286-2f1489876949", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:40/65\nFirst Submission:2023-01-13T09:25:46.000000+00:00\nLast Submission:2024-10-27T16:44:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869499", "uuid": "0d950aea-90c0-4267-9795-99bb771b4404", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869498", "to_ids": true, "type": "md5", "uuid": "60786604-90d9-4b15-90e6-16076d0f41dd", "value": "5c2ccc619d798792761ef68a395aae70", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869498", "to_ids": true, "type": "sha1", "uuid": "c6532a37-397f-4125-ae4e-2e160affcba4", "value": "c4c612dcb2741246214946e2acda3cafcfe68f1c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869499", "to_ids": true, "type": "sha256", "uuid": "2e1afa60-7445-4c62-8b05-3cc94590241f", "value": "3893f8a44a2d1fef45354984f3c6906ae8627c6f0c489f6f14e8da03197312ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869498", "to_ids": true, "type": "ssdeep", "uuid": "2debea9b-d69e-4304-a486-4c81d31f14c4", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869498", "to_ids": false, "type": "size-in-bytes", "uuid": "005af6fe-a30c-4525-91f5-96d79ccdbe63", "value": "86176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869498", "to_ids": true, "type": "vhash", "uuid": "916449b2-2765-4cc7-ac07-5d5557f2666f", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869498", "to_ids": true, "type": "filename", "uuid": "0f0b971f-637d-4f40-bc70-a5f0f9c8b387", "value": "CCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869498", "to_ids": false, "type": "text", "uuid": "2043a1b6-87c3-486d-a557-43944927b649", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/65\nFirst Submission:2023-03-28T11:57:15.000000+00:00\nLast Submission:2024-07-24T12:47:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869520", "uuid": "3af86395-310f-4844-a174-0f71bae40589", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869520", "to_ids": true, "type": "md5", "uuid": "8e9dffb4-2da6-469b-8bf9-ddf04c216920", "value": "b2082e3f5e6197d414a2462c5fb13baa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869520", "to_ids": true, "type": "sha1", "uuid": "27b44880-3a9a-40e3-83ec-3e5b9688aeda", "value": "ea82fceb2dc65bf0cc62762dd2df8853dbdac686", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869520", "to_ids": true, "type": "sha256", "uuid": "05658fd6-3d0a-4e04-a72e-fafd87f66f16", "value": "0153c9e22428f08597fe87cb8bd6664f6481e05bbf4e3d4174f44d2524446bdb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869520", "to_ids": true, "type": "ssdeep", "uuid": "d121e3e4-59ab-404e-9fed-08d188865b62", "value": "1536:eRJoocGMbwZVFuE6gD+gv5HDJzlS4AKi:eRJrc+1VVQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869520", "to_ids": false, "type": "size-in-bytes", "uuid": "6336c304-a215-4157-925e-744bc7b70a5d", "value": "64456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869520", "to_ids": true, "type": "vhash", "uuid": "de11b566-4544-42c6-ad73-f78edfb613dd", "value": "a8c09433e4d100fdc3cd7acab7480922" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869520", "to_ids": false, "type": "text", "uuid": "90ce64d3-2f13-4af4-892b-d96b1e29730a", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/65\nFirst Submission:2023-05-06T05:18:23.000000+00:00\nLast Submission:2024-07-24T12:42:55.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869542", "uuid": "553ad7a4-c3b4-413e-b383-d9a6d06585d9", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869542", "to_ids": true, "type": "md5", "uuid": "edc46981-5e85-43ae-8897-f3c1cb663624", "value": "af93633c61e209de7f9029deac21ff5a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869542", "to_ids": true, "type": "sha1", "uuid": "5a65e6e9-0765-4a2a-9708-dbd41816d9ad", "value": "902f8dd913cf912021e5a33c48a9b3c7d530b0a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869542", "to_ids": true, "type": "sha256", "uuid": "62eafa40-0b20-4ca9-8e38-b9a6afdc52de", "value": "c4fb9757ed6db6ab2bd4253cb8a1542a590443654260f2b947c288d5717487d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869541", "to_ids": true, "type": "ssdeep", "uuid": "2266bccf-4080-45a1-b9e4-7b8034ecdf32", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869541", "to_ids": false, "type": "size-in-bytes", "uuid": "5e9b361a-c3b1-4037-8d3a-2c29a66afdff", "value": "86176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869541", "to_ids": true, "type": "vhash", "uuid": "d4228773-a7e9-4efc-aae1-27cd827c0bb2", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869541", "to_ids": true, "type": "filename", "uuid": "f206b426-8656-4b38-92c8-84bc71f161e3", "value": "af93633c61e209de7f9029deac21ff5a.virus" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869541", "to_ids": false, "type": "text", "uuid": "87b0a717-9ef1-4732-8435-cd747e301a7a", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:45/65\nFirst Submission:2023-05-30T04:45:20.000000+00:00\nLast Submission:2024-07-24T14:05:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869564", "uuid": "1dc09910-b0d2-4404-ad25-f54eb16ac5f8", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869563", "to_ids": true, "type": "md5", "uuid": "9f16ae2e-9437-436c-9bbe-6f3d8e67be3a", "value": "3477735428e24922b3301eefc1063039", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869564", "to_ids": true, "type": "sha1", "uuid": "a5ffee43-6412-4e36-bcd6-b56f21646719", "value": "c0ed451166cce58edc94cab17c8223393e252adc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869564", "to_ids": true, "type": "sha256", "uuid": "81eca614-7a12-4ff4-a5c4-33cde8421693", "value": "70b19172b743973a45f5d707d4eec4f8508d41aa684516f1fb8c75bec59d02bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869563", "to_ids": true, "type": "ssdeep", "uuid": "1a8badc6-dad2-4ff8-8566-9bfd2f7c5364", "value": "24576:gKcawCu2r9p3DOyDgyE0NexhZPSXw6424Jo7SES5c9sC:g3awECyMyE0NeTZ6XB421hS5c9sC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869563", "to_ids": false, "type": "size-in-bytes", "uuid": "0e3a9b91-d849-4a2b-8a93-d1b7eec0b297", "value": "1624184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869563", "to_ids": true, "type": "vhash", "uuid": "3b3c45ed-0234-419e-94d2-6f24dd58791c", "value": "88cff97a7548aecc09eb6a7f6b9fa49a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869563", "to_ids": true, "type": "filename", "uuid": "d502035d-be56-4260-a598-2506d1342fbe", "value": "CCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869563", "to_ids": false, "type": "text", "uuid": "4b9cad6f-b7a2-4968-94ea-a008e53f644d", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:39/64\nFirst Submission:2023-06-09T07:48:58.000000+00:00\nLast Submission:2024-08-07T10:44:55.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869586", "uuid": "770c47bb-8c71-4f53-9800-e54fc261be4e", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869585", "to_ids": true, "type": "md5", "uuid": "7a22226b-a00c-4d09-a5c8-ad8003f7c990", "value": "fc85419f3b2afc89154700dd8cf37576", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869585", "to_ids": true, "type": "sha1", "uuid": "e43abf0a-00f0-4aa6-a026-9306eed448ec", "value": "b266e95d8d05db94573cf1d9144a4396f5248eb1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869586", "to_ids": true, "type": "sha256", "uuid": "f958959c-0ba4-4708-8999-3a8e2b3136b1", "value": "96231be4cc6cf256eebd828af4338588272ea478c609a7f16a03bdf1a61dd431", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869585", "to_ids": true, "type": "ssdeep", "uuid": "9195b12d-4234-4110-93fe-772030e0af3e", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869585", "to_ids": false, "type": "size-in-bytes", "uuid": "4817a9f6-2c47-4e38-89af-0d539798bc93", "value": "86176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869585", "to_ids": true, "type": "vhash", "uuid": "be0a15dc-6c2f-45e0-a55a-e4ff1dfe36a0", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869585", "to_ids": true, "type": "filename", "uuid": "7b2b3d11-c0e0-45f0-9238-304b403b0b1d", "value": "CCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869585", "to_ids": false, "type": "text", "uuid": "91b845e7-cb4b-492a-8692-6d4da752089a", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/64\nFirst Submission:2023-06-14T04:52:19.000000+00:00\nLast Submission:2024-07-24T13:04:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869608", "uuid": "27fad0f9-32f7-40a5-bf79-340b2052d40d", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869608", "to_ids": true, "type": "md5", "uuid": "2c527fe4-ab23-46eb-8813-2de8a873fd08", "value": "d312073a10e8d1fede43cfd18c6f3517", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869608", "to_ids": true, "type": "sha1", "uuid": "d1734ddb-92f3-4be2-9ad1-912d5658a46a", "value": "6ea1b572c8d5bca49ef085dcba453148641c362e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869608", "to_ids": true, "type": "sha256", "uuid": "3af243bd-6004-476a-bd23-d7fd529ede02", "value": "bf553e82119e2483d36eff51cf152861938c584749ebc005d4d612876277b787", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869607", "to_ids": true, "type": "ssdeep", "uuid": "cf70433a-f4dc-441f-88fc-c6b7ba69ef14", "value": "1536:eRJoocGMbwZVFuE6gD+gv5HDJzlS4AKi:eRJrc+1VVQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869607", "to_ids": false, "type": "size-in-bytes", "uuid": "1fe8ec46-984e-4655-a7e8-21123c21e857", "value": "64456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869607", "to_ids": true, "type": "vhash", "uuid": "4d4d6f78-a1b2-404a-91c9-2be760f4570a", "value": "a8c09433e4d100fdc3cd7acab7480922" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869607", "to_ids": true, "type": "filename", "uuid": "b7429f27-64c4-4761-90d5-3695414059b4", "value": "d312073a10e8d1fede43cfd18c6f3517.virus" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869607", "to_ids": false, "type": "text", "uuid": "821c954c-493a-41ea-9d67-7a4a388d3593", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:39/64\nFirst Submission:2023-06-14T04:50:09.000000+00:00\nLast Submission:2024-07-24T14:04:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869630", "uuid": "f7ff2453-78bb-4df7-bd9c-564fc8401a59", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869629", "to_ids": true, "type": "md5", "uuid": "e720d16a-d8ff-4618-86a4-003af28a6c88", "value": "5b380c95f25b76ccd55eb791c6558abe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869630", "to_ids": true, "type": "sha1", "uuid": "d94957f3-b88c-4934-a404-fd76abcd59a8", "value": "cfe8b990d32fa91ad556dedb73a616fc14bff9ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869630", "to_ids": true, "type": "sha256", "uuid": "0a92dc5e-822b-47e5-8fba-ecf15d0d172b", "value": "7b07b722091d9658fe106448b6e1c6b7484d7b7d163ddeb19132174973b62759", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869629", "to_ids": true, "type": "ssdeep", "uuid": "14cc0198-f49f-41dd-a774-5437c0eff1e6", "value": "6144:mXtUinhhl7bHpyjXtUinhhl7bHpyjXtUinhhl7bHpyjXtUinhhl7bHpy:mXtUinhhhbJgXtUinhhhbJgXtUinhhhc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869629", "to_ids": false, "type": "size-in-bytes", "uuid": "1f0a8edf-0aea-48be-a76e-9c80e267f1f6", "value": "333056" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869629", "to_ids": true, "type": "vhash", "uuid": "22e8ddbc-3bf9-4167-859c-59366134a280", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869629", "to_ids": false, "type": "text", "uuid": "ea1c1e2c-bb3b-4a1c-951c-91af650ee64b", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:38/64\nFirst Submission:2023-07-05T04:17:45.000000+00:00\nLast Submission:2024-07-24T12:32:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869652", "uuid": "7a5da06c-827b-4bba-91d4-fffe704b62b0", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869651", "to_ids": true, "type": "md5", "uuid": "296851bc-aa1e-4881-be54-46527c6e5f05", "value": "c440bd814be37fac669567131c4ba996", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869651", "to_ids": true, "type": "sha1", "uuid": "b1e43345-5caa-4623-b033-3638cc1fe282", "value": "0c8842054e9aba008f964f395de64464115b8ba1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869652", "to_ids": true, "type": "sha256", "uuid": "fe1cd01d-5ca9-4915-be38-a467e33660ec", "value": "b21f4039707eb4fc40ad1a7ed10be753ab3922c4a60bde819dcd74d44fef991d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869651", "to_ids": true, "type": "ssdeep", "uuid": "7d37d126-0864-418d-a3ce-34a2f992f020", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869651", "to_ids": false, "type": "size-in-bytes", "uuid": "7d2f5bc5-9e7d-4693-be1e-9e3e30b2258f", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869651", "to_ids": true, "type": "vhash", "uuid": "8e69c4de-318f-4eb7-b840-9ba3e043750f", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869651", "to_ids": true, "type": "filename", "uuid": "05efcc7e-174f-496a-9ff2-6c3f11d7327e", "value": "MFWzS4YNXpQd" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 13/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869651", "to_ids": false, "type": "text", "uuid": "a3a06025-20aa-487f-9520-88ed85ced03d", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/64\nFirst Submission:2023-09-07T12:35:32.000000+00:00\nLast Submission:2024-07-24T13:06:09.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869673", "uuid": "cfe26305-16b0-4882-a58e-bba1a5b98d89", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869673", "to_ids": true, "type": "md5", "uuid": "229fcb50-aa18-412c-b6a9-cff51da7f061", "value": "7d3ea628fce3146fccb722acc95544c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869673", "to_ids": true, "type": "sha1", "uuid": "9152246f-0db7-4595-89b7-a0e3b6797870", "value": "faeba91ce8a10d237c7f3fdc4c9f86fc09c2ac0c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869673", "to_ids": true, "type": "sha256", "uuid": "d419db48-044e-44ab-8bee-f3073b443ffe", "value": "4c4d51b377faebf61f95663765e622eb652866ab9cc7e9964a5d02f4dc0b53d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869673", "to_ids": true, "type": "ssdeep", "uuid": "23222da2-c402-4301-83dc-b211858c7cbd", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869673", "to_ids": false, "type": "size-in-bytes", "uuid": "29ca5d3d-a378-4a67-9d61-eb04405cbee7", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869673", "to_ids": true, "type": "vhash", "uuid": "5241d6c2-c5d2-4ca4-a221-5921ca066fa4", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869673", "to_ids": true, "type": "filename", "uuid": "0f56761e-aa60-4873-9b33-0e1f1b652a2c", "value": "pthread" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869673", "to_ids": false, "type": "text", "uuid": "502d0e68-0e06-447c-920c-80349a9d0028", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:41/64\nFirst Submission:2023-09-08T09:17:35.000000+00:00\nLast Submission:2024-08-13T15:15:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869695", "uuid": "e2002f87-18df-4359-bc04-4ef6f484ef40", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869695", "to_ids": true, "type": "md5", "uuid": "9cc0fef6-8809-4840-82f3-6f93db882a15", "value": "fc931bb1973782c4be015ef6e169edea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869695", "to_ids": true, "type": "sha1", "uuid": "1769d57b-1698-46e5-b5df-725cc960a9b3", "value": "ea65bcf3561e17551774b4b8cb9a1c4469a2b778", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869695", "to_ids": true, "type": "sha256", "uuid": "f760f5dc-a65d-4c5f-bae5-b8241c11ef2c", "value": "b24e160843d96c6d75452d6f4e379b73a417fc821b26ca85d740ca0a499615ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869694", "to_ids": true, "type": "ssdeep", "uuid": "2aa63f79-7f04-46c2-93d3-75584b767086", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869694", "to_ids": false, "type": "size-in-bytes", "uuid": "6fae2c3b-651e-4122-bf09-3f16a725ea50", "value": "86176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869694", "to_ids": true, "type": "vhash", "uuid": "4c2cbd2e-4e52-4c5e-b17b-6c8a75c04d96", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869694", "to_ids": true, "type": "filename", "uuid": "6fb0c661-e06c-435a-b0d2-99b72eab58b8", "value": "wpscn.net-x64.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869694", "to_ids": false, "type": "text", "uuid": "d0101d0c-60f3-4701-b124-c7975dcc444d", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:46/65\nFirst Submission:2023-09-13T09:38:02.000000+00:00\nLast Submission:2024-07-24T13:07:09.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869717", "uuid": "b133f245-ab22-4cde-aa9c-c15574fcfa7e", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869716", "to_ids": true, "type": "md5", "uuid": "32ba0cdb-cab7-4f0e-a383-4716d329af24", "value": "a15ebd19cac42b0297858018da62b1be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869717", "to_ids": true, "type": "sha1", "uuid": "2165dde4-2b6f-4eb7-97a4-b826968ded4a", "value": "2897abd5ca0913756263a94462b0391ce092c2be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869717", "to_ids": true, "type": "sha256", "uuid": "0f66c2fe-01e5-4eb4-9f20-b7198ccaf553", "value": "e5fb5a3b8663fbb2686caf88fdb3362115dc0f0bf9cc5d32d1e42c00aa6660b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869716", "to_ids": true, "type": "ssdeep", "uuid": "8c7cf1ea-d7e7-486b-b16f-c6b3078451b1", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869716", "to_ids": false, "type": "size-in-bytes", "uuid": "bb4f716c-88a1-46d1-ad12-4981b405c36d", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869716", "to_ids": true, "type": "vhash", "uuid": "18cf1ace-50b7-489f-9a6a-aef387f809a4", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869716", "to_ids": true, "type": "filename", "uuid": "dbdd7768-a1f4-41ca-bad5-8d2184d7fa57", "value": "nginx" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 28/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869716", "to_ids": false, "type": "text", "uuid": "7ca06f20-a013-4d30-aa47-5fe6d769c527", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:46/65\nFirst Submission:2023-10-27T10:54:33.000000+00:00\nLast Submission:2024-08-13T15:14:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869738", "uuid": "37dfc7a3-23a1-41c0-b505-30aa5d608244", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869738", "to_ids": true, "type": "md5", "uuid": "5d8bd1d1-4b7a-4e2e-b83c-bd021fe3278b", "value": "4f3afdcfff8f7994b7d3d3fbaa6858b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869738", "to_ids": true, "type": "sha1", "uuid": "2087b321-b1b4-49c6-b78b-1161fdba51b1", "value": "fcf631e940f33641748f51cfaad1e5cc073e31f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869738", "to_ids": true, "type": "sha256", "uuid": "e0e73377-72a8-4735-8b98-ce404505bfba", "value": "d17d964cacb063a6fe685d6e5e7dbc02c597de51b46c994f0aadb56c3bf96f13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869738", "to_ids": true, "type": "ssdeep", "uuid": "67388e78-6fae-461f-a232-8b7e1aaf8962", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869738", "to_ids": false, "type": "size-in-bytes", "uuid": "36f7a7c4-1bb4-4f40-99f9-47ea278b7c70", "value": "86176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869738", "to_ids": true, "type": "vhash", "uuid": "e24fec71-b44d-4ce3-a142-91e549957549", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869738", "to_ids": true, "type": "filename", "uuid": "8223fe8d-337c-42ed-a7bc-64d67c827534", "value": "x.uu" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 28/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869738", "to_ids": false, "type": "text", "uuid": "09a3520f-e32c-4684-af68-44f962084d3d", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:45/65\nFirst Submission:2023-10-28T02:37:15.000000+00:00\nLast Submission:2024-07-24T14:11:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869760", "uuid": "c4527c2c-cc29-4db0-b971-f79ed9255374", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869760", "to_ids": true, "type": "md5", "uuid": "cabbbbe0-4cec-4eb8-a001-723b1f217a42", "value": "4961fcc2e3cc23c340aa0af9c4046131", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869760", "to_ids": true, "type": "sha1", "uuid": "2429e5a5-afde-4dd6-beca-2b8bc30e258a", "value": "ea05decae3c710ac9b1fe01bf6d5d0735de1c479", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869760", "to_ids": true, "type": "sha256", "uuid": "b1be82f1-8bac-4984-9e4f-6ef3761e28e6", "value": "ba45dfa8e6b86140e526959c8568824ddd743d418231440d48740e76a33610ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869759", "to_ids": true, "type": "ssdeep", "uuid": "3c2b235c-ef96-4737-9ad2-98a05ad4d5fe", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869759", "to_ids": false, "type": "size-in-bytes", "uuid": "08775f59-cc29-47e6-a650-27930c29379b", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869759", "to_ids": true, "type": "vhash", "uuid": "89d367bb-4f4f-47d0-adb7-71ef1a4e649a", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869760", "to_ids": false, "type": "text", "uuid": "24b03ccb-16f9-4546-bd56-4ec356426032", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:40/64\nFirst Submission:2023-11-03T06:00:50.000000+00:00\nLast Submission:2024-07-24T13:08:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869782", "uuid": "31d2914e-af56-4341-930e-259f3eb8edd6", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869782", "to_ids": true, "type": "md5", "uuid": "a84b6f55-89e8-43f3-adf9-9f37fcf5904c", "value": "6b1b7e89c6e566de97cadcf3323ae77f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869782", "to_ids": true, "type": "sha1", "uuid": "3be0583a-cb58-4a2d-a379-21dbfd3815ba", "value": "4408b0f0149342e64c4a977d3c1f5ae56e7d1944", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869782", "to_ids": true, "type": "sha256", "uuid": "f3f3453d-ad54-412a-b04d-e9841607dcc3", "value": "1c2bbab6c496b66b108dc810649c19319655a2246f7fc6cf2a0911f5d73f2f3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869781", "to_ids": true, "type": "ssdeep", "uuid": "54fe5b2f-395e-4aac-b03e-df263888d96d", "value": "768:cqST+olkfeO10Ky5bG1JgDLyUZpXPKYnfv087S4AYahoix:cqG+KRL75mgD+UiC3D7S4AKi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869781", "to_ids": false, "type": "size-in-bytes", "uuid": "640d2e52-e9ac-4bdc-99bc-289580bcfec1", "value": "64444" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869781", "to_ids": true, "type": "vhash", "uuid": "c1c451fd-815f-4f2f-a46b-3b4e1d6beed8", "value": "e22fe57345c3e8fa0bf1b9a311ec9dc5" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869781", "to_ids": false, "type": "text", "uuid": "1b6366ba-85f1-4ed5-9f13-6ae4a962391b", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:42/65\nFirst Submission:2023-11-03T06:00:52.000000+00:00\nLast Submission:2024-07-24T12:04:48.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869804", "uuid": "0e7361f8-5f50-4c63-9fec-4d6dc10c6851", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869804", "to_ids": true, "type": "md5", "uuid": "9ba89a9d-73e6-4915-800d-38b35c48558b", "value": "1da6fd699c882bf8869f7d3cc1631589", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869804", "to_ids": true, "type": "sha1", "uuid": "ee0bf920-18a4-4bbd-bd37-20a44111af51", "value": "53277642a2ac0f7bb12d5464f4d7474ff4985674", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869804", "to_ids": true, "type": "sha256", "uuid": "40c38e73-0f9f-49bb-96c3-5efbc6baa47b", "value": "14f9a20356fc0e1806524057e8366d994831e3568cf438694a5c4d5463c25010", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869803", "to_ids": true, "type": "ssdeep", "uuid": "515a4726-4221-42b9-a430-8492bfce96db", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869803", "to_ids": false, "type": "size-in-bytes", "uuid": "c3630c9b-1761-4161-a9ab-ef495991442a", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869803", "to_ids": true, "type": "vhash", "uuid": "0b60a102-b7ad-42b1-aa99-342370b9ae8a", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869803", "to_ids": true, "type": "filename", "uuid": "07adebc9-aa75-4888-9c0e-2d8db3917b11", "value": "64.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869803", "to_ids": false, "type": "text", "uuid": "01451cbf-6724-479a-9b31-099e0580ad54", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:41/64\nFirst Submission:2023-11-04T12:56:22.000000+00:00\nLast Submission:2023-11-04T12:56:22.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869826", "uuid": "1f1ca78e-9400-42e3-b0bd-52c01e0a83bc", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869825", "to_ids": true, "type": "md5", "uuid": "3fcab54d-d7f8-49ce-a6e4-d7d82a2e343a", "value": "10d18727af7e27d151a535f414ada48e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869825", "to_ids": true, "type": "sha1", "uuid": "f9758294-8ff6-4324-b75e-b860114996ec", "value": "51fda2b39009a71376a4a50e935186be0b5a6792", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869826", "to_ids": true, "type": "sha256", "uuid": "8a6100e8-dc91-472a-a005-4e3351bb5a7b", "value": "7e7bfe7e83867defa9280c8bce98cabcd0e6410cac7cc9a1baa88131b4a263b1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869825", "to_ids": true, "type": "ssdeep", "uuid": "ba36e4b2-7612-44ec-93b6-587932cbad23", "value": "768:cqST+olkfeO10Ky5bG1JgDLyUZpXPKYnfv087S4AYahoin:cqG+KRL75mgD+UiC3D7S4AKi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869825", "to_ids": false, "type": "size-in-bytes", "uuid": "4b8de1af-763f-4b97-a000-7b5a07246eac", "value": "64444" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869825", "to_ids": true, "type": "vhash", "uuid": "11b64a80-dc42-4c57-a298-631d2e0ccc61", "value": "e22fe57345c3e8fa0bf1b9a311ec9dc5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869825", "to_ids": true, "type": "filename", "uuid": "18ed1746-ff73-4c49-92cb-0266a82ad3ed", "value": "86.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869825", "to_ids": false, "type": "text", "uuid": "95ee2ec2-e890-42db-b952-f795c5f6deae", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/64\nFirst Submission:2023-11-04T12:52:57.000000+00:00\nLast Submission:2024-07-24T12:33:36.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869847", "uuid": "a4a1726c-260f-41bd-a6ea-aa1f92324278", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869847", "to_ids": true, "type": "md5", "uuid": "ae613e8c-cd76-4cb1-befc-2e02fa95fb97", "value": "c069dfb0fb72a5b27281122e6235fff2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869847", "to_ids": true, "type": "sha1", "uuid": "cdb9f39b-bd10-4624-a027-b6e21e500930", "value": "1ba5ec3a040f79fb38b0a1554938d6dbb2418eb7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869847", "to_ids": true, "type": "sha256", "uuid": "3eeb6a3a-62cf-4d95-b442-5c89d43866a2", "value": "45b3d192ed79541a9711c16c7d73bd4d0a74598ecb7b56416f8754fb5d6feb56", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869847", "to_ids": true, "type": "ssdeep", "uuid": "19e4dade-d353-439e-aea4-c65f347cef04", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869847", "to_ids": false, "type": "size-in-bytes", "uuid": "e7d74fab-d828-4651-aab6-aa12ff5d7891", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869847", "to_ids": true, "type": "vhash", "uuid": "15d49f88-96ee-4c3b-a1ba-324d3e276fa3", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869847", "to_ids": true, "type": "filename", "uuid": "9049a7d2-6564-4453-83b4-360fc98b832a", "value": "64.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869847", "to_ids": false, "type": "text", "uuid": "39594872-6c77-4ebd-9ef6-b530c815136d", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/65\nFirst Submission:2023-11-04T12:52:49.000000+00:00\nLast Submission:2024-07-24T12:34:48.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869869", "uuid": "34c4a49c-f23e-4af8-8c7f-aa9e1c86b39a", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869869", "to_ids": true, "type": "md5", "uuid": "0a20d9d7-5ce3-4051-8748-a690d1f66b69", "value": "0a987eb2301a54e485568774572df16d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869869", "to_ids": true, "type": "sha1", "uuid": "27886cda-476b-462e-ab19-3e31f100268e", "value": "809da3ec7734fdd21121d0c25504754e067aaae4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869869", "to_ids": true, "type": "sha256", "uuid": "fb0ca893-1218-454f-ac7e-12a79a192f26", "value": "53cebf50348e4507e92d23cfe3bbc87d6bf50e06962462d036542c37a50a23c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869869", "to_ids": true, "type": "ssdeep", "uuid": "483033bc-019f-4cfc-a8bb-df9b2d97298b", "value": "768:cqST+olkfeO10Ky5bG1JgDLyUZpXPKYnfv087S4AYahoiO:cqG+KRL75mgD+UiC3D7S4AKi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869869", "to_ids": false, "type": "size-in-bytes", "uuid": "cbd78c11-5dd4-44e1-beee-3747e3b1d8de", "value": "64444" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869869", "to_ids": true, "type": "vhash", "uuid": "3b41f4fd-f737-4211-bc87-c592c45eb211", "value": "e22fe57345c3e8fa0bf1b9a311ec9dc5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869869", "to_ids": true, "type": "filename", "uuid": "d66ec7dc-4c57-407d-b299-967bd8b242f0", "value": "04-02-x86.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869869", "to_ids": false, "type": "text", "uuid": "0e667687-5435-4a5b-8870-14f215886087", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/65\nFirst Submission:2023-11-04T12:53:34.000000+00:00\nLast Submission:2024-08-13T15:15:17.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869891", "uuid": "a85ee1e5-d1d8-4191-bf77-360dd28520f3", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869891", "to_ids": true, "type": "md5", "uuid": "9eaedbd2-f39c-4c8e-9d4a-0929c972a0a1", "value": "d070c32b8fffa9919164f66e01db7c1c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869891", "to_ids": true, "type": "sha1", "uuid": "f03135bd-69da-40a5-bd0a-1ff3fc933e12", "value": "4c0a92f24482cbc60781e09db31f1d5abbddb7fa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869891", "to_ids": true, "type": "sha256", "uuid": "203757e5-feb8-4be5-a416-463c7740aeb1", "value": "a27d133f6a1bd72285f021403082dc8e47180fe56e88b274f474459088857603", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869890", "to_ids": true, "type": "ssdeep", "uuid": "7d736fb8-dd7b-4fc0-a3d8-6d99ffbb32b9", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869890", "to_ids": false, "type": "size-in-bytes", "uuid": "e48c9055-470c-4d5e-9a29-25146ffb5a5e", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869890", "to_ids": true, "type": "vhash", "uuid": "5e179fad-d906-45dd-8f53-886767b0bda1", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869890", "to_ids": true, "type": "filename", "uuid": "2a3141f0-ff0a-4cd2-82fa-4433c56242eb", "value": "CCCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869890", "to_ids": false, "type": "text", "uuid": "ae9b7d9a-8b11-4f0b-9e15-d7aefd4da46e", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:40/64\nFirst Submission:2023-11-06T11:27:10.000000+00:00\nLast Submission:2023-11-06T11:27:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869913", "uuid": "f6b28705-6c8e-4e65-aa25-6fb91e6b4e54", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869912", "to_ids": true, "type": "md5", "uuid": "bcfb173e-adc1-44a1-b9d0-6e74573ee082", "value": "a5b525b8e76cf78c0e5087d6e01f3825", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869913", "to_ids": true, "type": "sha1", "uuid": "0117d0c5-3db9-4082-8cc3-1ad7aafe86ec", "value": "b32d188412809a5d89979a1d2f016ea1b6f6094c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869913", "to_ids": true, "type": "sha256", "uuid": "c3a7b8a6-032b-4f14-94a0-00ed32bac317", "value": "4198efb00840f440d96987518bd80dbc90cde3023bc8c2b0aae456af07875405", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869912", "to_ids": true, "type": "ssdeep", "uuid": "f4508020-82a2-4c84-b2dd-f7c88ab450b3", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869912", "to_ids": false, "type": "size-in-bytes", "uuid": "a00e0ecc-6254-47b5-90be-950e9e2c863e", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869912", "to_ids": true, "type": "vhash", "uuid": "6227e3ef-8824-4850-afc9-cdb9e7e7a640", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869912", "to_ids": true, "type": "filename", "uuid": "0d754f77-6d3a-4763-9ecd-98a9a90b8b1c", "value": "CCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869912", "to_ids": false, "type": "text", "uuid": "8a76130e-de90-4e91-a839-5fe99fd8bbd2", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/65\nFirst Submission:2023-11-18T11:22:20.000000+00:00\nLast Submission:2024-07-24T12:48:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869935", "uuid": "e81e4b27-004e-430c-ba98-aa6819eecfe6", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869934", "to_ids": true, "type": "md5", "uuid": "a4f7223b-118f-4a9a-88c2-8c8176b0ebb7", "value": "2bd87810926c1cde5eca7763bf9713ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869935", "to_ids": true, "type": "sha1", "uuid": "d360be95-9563-4f74-b7c1-d3e88883902e", "value": "ce212a63bd3f823667f3907c333c459ba6f63719", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869935", "to_ids": true, "type": "sha256", "uuid": "8501e05d-6fac-4796-8781-7cb61c3f5ee8", "value": "abdbbc10467421b93fe1df6da0de70a4d454adcced1bfc6c1cebf1207fba93db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869934", "to_ids": true, "type": "ssdeep", "uuid": "e38eb132-5780-4e06-a65e-77239ded43a9", "value": "1536:jVjv3n5rDNuVKNnIhnhhW2cgJbhqHekyN/1H5xuM8WWz:jVb6EIhnhhW2cgBhq+xN/1Zx2WG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869934", "to_ids": false, "type": "size-in-bytes", "uuid": "6a2b7352-b50e-4c2c-a822-99bf7df1a244", "value": "86176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869934", "to_ids": true, "type": "vhash", "uuid": "805c1b5b-c8b2-42d1-833d-ee5cb33fdf62", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869934", "to_ids": true, "type": "filename", "uuid": "3a64d341-0109-4496-9ed3-2ce1bb31c70b", "value": "2bd87810926c1cde5eca7763bf9713ad.virus" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869934", "to_ids": false, "type": "text", "uuid": "a002e0fe-cdde-41ec-bf8a-f2414ec2121d", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/65\nFirst Submission:2023-11-27T21:20:08.000000+00:00\nLast Submission:2024-07-24T13:05:05.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869957", "uuid": "726b9614-3408-431e-b472-69523833ee15", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869956", "to_ids": true, "type": "md5", "uuid": "2b9defea-89c4-4b81-94a7-2f44502da894", "value": "68d06dc6e17f56cc2d9baf3a7b877a54", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869956", "to_ids": true, "type": "sha1", "uuid": "8fde0314-b761-41b6-b4be-18bf5dc8e792", "value": "107b35cc025f09d7e7412f681c159190459a2289", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869957", "to_ids": true, "type": "sha256", "uuid": "a02f28e5-80ca-4b0b-b691-058155702ce0", "value": "bcac1d42c39932fb20f571655cd1bbe507c3fddda63d4f0ea8986a3dd5265f41", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869956", "to_ids": true, "type": "ssdeep", "uuid": "56a88694-3a69-416d-8df3-b1115e7ddb0d", "value": "1536:mihlrshQNuVhNnUinhhWbCh+Kh0MqHekyN/1H5xuM8gya:mXhFlUinhhWbCh+ohq+xN/1Zx2gy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869956", "to_ids": false, "type": "size-in-bytes", "uuid": "c1b64bb3-dc14-4f80-a193-657691795427", "value": "83264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869956", "to_ids": true, "type": "vhash", "uuid": "54f18c3b-bd54-4685-b735-b282dadb415f", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869956", "to_ids": true, "type": "filename", "uuid": "03b43836-1d43-4952-b3ef-d1b5e2ec9bb8", "value": "bcac1d42c39932fb20f571655cd1bbe507c3fddda63d4f0ea8986a3dd5265f41.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869956", "to_ids": false, "type": "text", "uuid": "e950a4bf-5c46-44d1-bdd6-199687df0599", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:40/64\nFirst Submission:2023-12-16T13:56:26.000000+00:00\nLast Submission:2023-12-20T19:43:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770869978", "uuid": "9735af2d-3f86-40e6-91b4-d363c7130c92", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770869978", "to_ids": true, "type": "md5", "uuid": "c1d88c18-cf3a-46bf-a3e2-2af0dc2e9675", "value": "3141313bc5b70844ccc6a27b489a5854", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770869978", "to_ids": true, "type": "sha1", "uuid": "f7663470-d128-42c2-899e-1f7394573740", "value": "3e282386e85e1f13b097254928917667b1894b27", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770869978", "to_ids": true, "type": "sha256", "uuid": "ee6e2867-b2fc-4897-99df-74fe2718c9ed", "value": "68389b48c6f15b6da7f2d78c0864d6b9b9135f6ace3564d29b26f5dc9b5d6313", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770869978", "to_ids": true, "type": "ssdeep", "uuid": "493a6e3d-aee7-4af0-a2ae-15ca082355b0", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770869978", "to_ids": false, "type": "size-in-bytes", "uuid": "50207b81-a922-418c-b4a0-5ecac305ddd2", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770869978", "to_ids": true, "type": "vhash", "uuid": "67edc145-cb25-4e22-8084-5a001c007cd3", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770869978", "to_ids": true, "type": "filename", "uuid": "7bbb93d6-d74e-42cd-a0f4-dca93d7b0802", "value": "CCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770869978", "to_ids": false, "type": "text", "uuid": "00b179da-0f25-45c9-bd7d-0287cabced36", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:42/64\nFirst Submission:2023-12-19T09:35:41.000000+00:00\nLast Submission:2023-12-19T11:08:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770870001", "uuid": "409a8210-5e0c-469b-8ae4-e7ff00330246", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770870000", "to_ids": true, "type": "md5", "uuid": "70a45a03-89bd-4e42-847c-3aa2a957b3c9", "value": "b4910e998cf58da452f8151b71c868cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770870000", "to_ids": true, "type": "sha1", "uuid": "ac55b0b8-e429-488f-9d2a-56a2b35f34fd", "value": "1afd03b91e73db0de7685af473530503bc9257ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770870001", "to_ids": true, "type": "sha256", "uuid": "c4bc8187-49ca-466f-bbd5-8b47b87df3b6", "value": "bf1b88385aebb37182421e967749f057fbefb4e4386bb47b5098abac7c70c476", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770870000", "to_ids": true, "type": "ssdeep", "uuid": "a6746caa-e8d5-441d-9cc8-e0f17110c26e", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770870000", "to_ids": false, "type": "size-in-bytes", "uuid": "55226bc4-c0ba-405e-8bff-d5c85982c452", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770870000", "to_ids": true, "type": "vhash", "uuid": "4d850e0a-29f6-47a7-8a36-29a2e14e25cb", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770870000", "to_ids": true, "type": "filename", "uuid": "0c07ad08-29e4-4964-911f-b6cded024f3d", "value": "output.266477946.txt" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 14/01/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770870000", "to_ids": false, "type": "text", "uuid": "513030ed-5ac4-413f-bef0-e67a50bf8e7a", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/64\nFirst Submission:2024-01-15T07:27:30.000000+00:00\nLast Submission:2024-07-24T13:11:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770870023", "uuid": "50001862-db7d-41c6-a55f-892b37987e86", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770870022", "to_ids": true, "type": "md5", "uuid": "4e212fa2-a411-4c9b-a975-bb9e2ae85b1b", "value": "0ed2756943a137496e0bed7d6dbc6be4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770870022", "to_ids": true, "type": "sha1", "uuid": "2e32f1bd-5a92-4479-bb36-d7346c2700c4", "value": "244e4e3f88c67ab4ad62bfbb75741e901f758828", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770870023", "to_ids": true, "type": "sha256", "uuid": "b7333b50-5558-485c-ada5-1febf44fdb18", "value": "1a9ff06ac18f57a6382fdae54bf8735a6ad7d9c9f1f9aa0dfff0e3e828f1820b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770870022", "to_ids": true, "type": "ssdeep", "uuid": "df2bfb90-04e2-4c0f-8f99-490ef6b4457d", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770870022", "to_ids": false, "type": "size-in-bytes", "uuid": "67988ed0-63fd-411b-9b8a-f24f4ff67fed", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770870022", "to_ids": true, "type": "vhash", "uuid": "45a06eee-56c9-4b7c-b5d3-a5b7092147cc", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770870022", "to_ids": true, "type": "filename", "uuid": "9d76e48d-2801-44d5-bba7-d825a8570dba", "value": "07-28-x64.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770870022", "to_ids": false, "type": "text", "uuid": "d43a1047-7bd0-4e2e-884a-90c8dc6e1a73", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:46/65\nFirst Submission:2024-01-27T06:44:09.000000+00:00\nLast Submission:2024-07-24T12:01:18.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770870044", "uuid": "0b55619e-7d3a-4dcf-acfd-29f19b67e739", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770870044", "to_ids": true, "type": "md5", "uuid": "d1a5e054-ca84-4081-ac84-a3a58cbf9804", "value": "035f83018cf96f5e1f6817ccd39fc0b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770870044", "to_ids": true, "type": "sha1", "uuid": "4f338c58-302b-44c2-afe4-01708815f2f1", "value": "49481dd3c7316c8e924150798e87eee884193f3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770870044", "to_ids": true, "type": "sha256", "uuid": "bba07fba-e9fe-4efe-a375-5d322082fd4d", "value": "15f3536ac33588444cf6a632f17c74ee0ee8777d0d2166206222b4d5f66de715", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770870044", "to_ids": true, "type": "ssdeep", "uuid": "35de23b1-cb95-47c3-9268-29abb7a81d28", "value": "1572864:ehNqB6tEtEH4c1QEFKIbMCIghLyEXKF7m5NcvFEF:enqB2db1pwIIBghgFUWF2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770870044", "to_ids": false, "type": "size-in-bytes", "uuid": "531e2013-4db1-4069-821e-5fd8ea5315df", "value": "73732086" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770870044", "to_ids": true, "type": "vhash", "uuid": "9dbc2ec5-bde9-45b1-aa5b-849d144f6165", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770870044", "to_ids": true, "type": "filename", "uuid": "f9b8a15d-5ee6-4550-aefb-49bad0cf2e1b", "value": "AliDunYun" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 20/11/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770870044", "to_ids": false, "type": "text", "uuid": "33a62a69-2dd6-4ad8-9bac-121e7e3e01f5", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:31/63\nFirst Submission:2024-01-30T11:14:22.000000+00:00\nLast Submission:2024-01-30T11:14:22.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770870066", "uuid": "37717203-5ef9-49bf-bfa7-b752b2b80137", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770870066", "to_ids": true, "type": "md5", "uuid": "ef8b5de4-0f2f-46c2-8e13-4deb48b78ce4", "value": "163b0498e445979df78bad5b6bc2bbb9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770870066", "to_ids": true, "type": "sha1", "uuid": "7104582a-b4ae-4a9c-94d1-a5bcfb7a8616", "value": "04a0bbae3e3fe7ba167bc2d6317d0a3936286272", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770870066", "to_ids": true, "type": "sha256", "uuid": "4e03a549-e78d-4401-8146-1f790d63a6fe", "value": "ca2200ef6ce1abc37e5778b40e9b14031b81014560dae9c6a16fd7ba948c7656", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770870065", "to_ids": true, "type": "ssdeep", "uuid": "e7bc418b-7f61-4b5b-8d7c-3b5d015fd83f", "value": "1536:eRJoocGMbwZVFuE6gD+gv5HDJzlS4AKi:eRJrc+1VVQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770870065", "to_ids": false, "type": "size-in-bytes", "uuid": "a47ecf07-a668-4ca1-8cff-6e8a0379208e", "value": "64456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770870065", "to_ids": true, "type": "vhash", "uuid": "c478e78c-a19c-4b3d-ab94-50fa736bd2e6", "value": "a8c09433e4d100fdc3cd7acab7480922" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770870065", "to_ids": true, "type": "filename", "uuid": "ee97df9a-2484-4b59-baf9-844ee7135e94", "value": "sample-CA2200EF6CE1ABC37E5778B40E9B14031B81014560DAE9C6A16FD7BA948C7656 (1).bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770870065", "to_ids": false, "type": "text", "uuid": "89d61bc2-58c0-4c22-bfc8-98d0a4ab75ba", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:45/65\nFirst Submission:2024-02-02T02:15:14.000000+00:00\nLast Submission:2024-07-24T14:06:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770870088", "uuid": "5950d1d7-adf0-4e35-99f3-df5714ac4113", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770870087", "to_ids": true, "type": "md5", "uuid": "5ab76cbd-9b3c-4d5d-8d88-8f5ade3021d8", "value": "a73fb1a8c04b7767f0e7587a866440f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770870088", "to_ids": true, "type": "sha1", "uuid": "1304b79f-fbc5-4c3b-85ff-58260e58c76d", "value": "2b9f64e451c8b2a1983d81438b9cdd150062586b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x23F8", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770870088", "to_ids": true, "type": "sha256", "uuid": "9579b117-f14e-4a3d-815d-e8d958bacba9", "value": "bbcfc826f614433ff1b7c8031349cf5b411d868b07259eca9c19cd5af772b85e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770870087", "to_ids": true, "type": "ssdeep", "uuid": "5a07b9a3-adbd-41c2-9a10-876c81976ff6", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770870087", "to_ids": false, "type": "size-in-bytes", "uuid": "7e8303db-c336-47f7-922b-b0b6d26c15f7", "value": "86176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770870087", "to_ids": true, "type": "vhash", "uuid": "486f63bf-aecf-48b7-9aef-5dc5191608fe", "value": "49d282a4c3753b8e83e16120ec331cac" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770870087", "to_ids": true, "type": "filename", "uuid": "cb867f9e-a238-4a8e-9945-3c1bba532126", "value": "CCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770870087", "to_ids": false, "type": "text", "uuid": "09f1c21c-6510-4d6d-8c1f-5a846f168788", "value": "Noodle RAT for Linux type 0x23F8\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:44/64\nFirst Submission:2024-02-23T03:36:15.000000+00:00\nLast Submission:2024-07-24T13:09:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770870109", "uuid": "aea13363-60a6-49ed-8fb4-1d5eff45f45e", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770870109", "to_ids": true, "type": "md5", "uuid": "9966c5f0-131b-4993-ad33-c9d8d35bfbc3", "value": "5d2a08b3376eec11c6cee70daa287f1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770870109", "to_ids": true, "type": "sha1", "uuid": "1280feef-6c42-401b-9dff-ece9dbaea521", "value": "3033d9ea417db05c1177e9c7bfb3db792c823eeb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770870109", "to_ids": true, "type": "sha256", "uuid": "ca854879-4c2b-40b3-9040-698559ff1383", "value": "6933a01980378c2160740e5cecaba29530555e3d65bd89ef80db49419a419f8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770870109", "to_ids": true, "type": "ssdeep", "uuid": "9b3829d1-2d7c-4de4-a089-005735e50b35", "value": "1536:VEZMGSytohNBNuV9NnkqnhhWSsXo8iRtxDwfqHekyN/1H5xuM88tQYo:VnytoWxkqnhhWSsBCtxDAq+xN/1Zx2N7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770870109", "to_ids": false, "type": "size-in-bytes", "uuid": "81a615b6-869b-4eeb-b7c6-864fe27c16e7", "value": "86192" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770870109", "to_ids": true, "type": "vhash", "uuid": "7f89c99e-a0ac-4a10-adbf-7cc220938e9b", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770870109", "to_ids": true, "type": "filename", "uuid": "bef29708-36ce-457f-bc92-655049f75b62", "value": "CCCCCCCCCC" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770870109", "to_ids": false, "type": "text", "uuid": "f83f6ac6-05ed-4ec8-a46a-8e2a51308d54", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:39/65\nFirst Submission:2024-03-22T15:18:36.000000+00:00\nLast Submission:2024-07-24T12:50:08.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770870131", "uuid": "f4a6a29c-120a-42e9-a897-7ef826633911", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770870131", "to_ids": true, "type": "md5", "uuid": "57732c7d-8a4a-41fe-bc0b-a91b029e5fe5", "value": "29459f059235825f2f70eef8811a249f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770870131", "to_ids": true, "type": "sha1", "uuid": "76017832-4e7a-47fb-adb4-ef30df1b8890", "value": "8318c6e8ad58518349a2efd3fbcb372f81478798", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770870131", "to_ids": true, "type": "sha256", "uuid": "0d854094-9e52-41ff-a8ec-a2f4b81e5c1e", "value": "5dac572374cb40561ea5dbc0dfc963d863f08862a0bd33fdac6ac8d0aa180ada", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770870130", "to_ids": true, "type": "ssdeep", "uuid": "8aa84033-87f9-487b-ae24-b4ffc832ca66", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770870130", "to_ids": false, "type": "size-in-bytes", "uuid": "703aeb80-bb9b-4ad8-aa07-c87c56adfada", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770870130", "to_ids": true, "type": "vhash", "uuid": "a6e0f27e-294b-4c7b-9908-72f2afc87ffa", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1770870130", "to_ids": true, "type": "filename", "uuid": "8dfa7322-3c4a-4132-96d9-94d52751da37", "value": "03-23-x64.bin" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 01/04/2025", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770870130", "to_ids": false, "type": "text", "uuid": "5e32f280-b75e-42a1-b9dc-965ccff2e649", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:46/65\nFirst Submission:2024-03-31T16:57:01.000000+00:00\nLast Submission:2024-07-24T12:30:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1770870153", "uuid": "8af992a6-9aef-4b5e-a1a2-9316bd9d4da3", "Attribute": [ { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1770870153", "to_ids": true, "type": "md5", "uuid": "bd39e5ec-6817-4488-889f-fa1d8bda4935", "value": "20f5d15c505603a544aaa72664d53f5e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1770870153", "to_ids": true, "type": "sha1", "uuid": "12fab9f5-f682-4d53-993f-c8d00f016dbf", "value": "7cfda35ec1576c6d169a67a00155a95c693830d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Noodle RAT for Linux type 0x03A2", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1770870153", "to_ids": true, "type": "sha256", "uuid": "a7d1624e-9e60-4365-94fc-7c13cee73b2b", "value": "24a827336a1f942925fd57e763109e3a83b1a5762c077c1e80bd057bb1b15bad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1770870152", "to_ids": true, "type": "ssdeep", "uuid": "99b2aa31-6731-4e07-9635-06bc75838a5c", "value": "1536:QahOrhUNuV9NnkqnhhWMC8tOadBvwZoXRUqHekyN/1H5xuM8b/3d:Q5JxkqnhhWMhtOqcoXRUq+xN/1Zx2r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1770870152", "to_ids": false, "type": "size-in-bytes", "uuid": "50e30973-e5fa-4257-bb12-00604f5edca9", "value": "86208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1770870152", "to_ids": true, "type": "vhash", "uuid": "a51c8713-9b8d-4c76-b8a5-d2e7d53ded16", "value": "9e1cc1e9349e778117ed0a258bfb4d36" }, { "category": "Other", "comment": "Checked: 12/02/2026\nLast-scan\t: 19/12/2024", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1770870152", "to_ids": false, "type": "text", "uuid": "626ba366-272c-4e4e-8f72-38c83923be91", "value": "Noodle RAT for Linux type 0x03A2\r\nType Description: ELF\nMicrosoft: Backdoor:Linux/Rekobee\nVT Total Detection:43/64\nFirst Submission:2024-04-11T02:39:56.000000+00:00\nLast Submission:2024-04-11T02:39:56.000000+00:00" } ] } ] } }