{ "Event": { "analysis": "1", "date": "2026-07-22", "extends_uuid": "", "info": "[Threat Intel] Abusing Trusted Business Workflows: A Multi-Stage Phantom Stealer Campaign", "protected": false, "publish_timestamp": "1785653967", "published": true, "threat_level_id": "3", "timestamp": "1785577598", "uuid": "e6f26d78-1d75-453f-8dd3-a8bf273ac278", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#57356b", "local": false, "name": "misp-galaxy:producer=\"Seqrite\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#d58a16", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Mail Protocols - T1071.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#00f752", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Alternative Protocol - T1048\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#915448", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Phantom Stealer\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784775617", "to_ids": false, "type": "link", "uuid": "d8e07a6f-0889-4a99-944a-dd92281d744c", "value": "https://www.seqrite.com/blog/abusing-trusted-business-workflows-a-multi-stage-phantom-stealer-campaign/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784775617", "to_ids": false, "type": "text", "uuid": "3ee5dc2f-afa9-45bb-afaf-5bd2bdee74c5", "value": "A sophisticated phishing campaign impersonates legitimate business entities including UPS and the Malaysian Inland Revenue Board to distribute Phantom Stealer v3.5.0. The attack begins with convincing emails containing compressed archives housing malicious JavaScript files. Once executed, the JavaScript launches obfuscated PowerShell scripts that operate entirely in memory, deploying multiple stages of encrypted and encoded payloads. The infection chain utilizes Base64 encoding, AES encryption, and XOR ciphering to conceal its activities. The final payload, Phantom Stealer, harvests credentials from browsers, cryptocurrency wallets, messaging applications, and system information before exfiltrating stolen data via SMTP over port 587 using STARTTLS encryption. The multi-layered approach significantly reduces on-disk footprint and employs reflective code loading and process injection into legitimate binaries to evade traditional security defenses." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784775617", "to_ids": false, "type": "text", "uuid": "0be71bb7-82a9-4c52-ba42-a66ee60eef61", "value": "Name: Abusing Trusted Business Workflows: A Multi-Stage Phantom Stealer Campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"reflective loading\", \"smtp exfiltration\", \"multi-stage attack\", \"phantom stealer\", \"process injection\", \"powershell obfuscation\", \"phishing\", \"credential theft\"]\nTgtd countries: [\"Malaysia\"]\nMlwr families: [\"Phantom Stealer\"]\nAttack_ids: [\"T1059.007\", \"T1566.001\", \"T1082\", \"T1005\", \"T1140\", \"T1555\", \"T1036\", \"T1055\", \"T1218\", \"T1560\", \"T1071.003\", \"T1555.003\", \"T1057\", \"T1059.001\", \"T1048\", \"T1027\", \"T1573\"]\nIndustries: [\"Finance\", \"Government\"]" }, { "category": "Payload delivery", "comment": "username for malware authenticate with SMTP server - Base64 encoded in malware", "deleted": false, "disable_correlation": false, "timestamp": "1785100136", "to_ids": true, "type": "email-src", "uuid": "604b0f05-9f8d-4c63-a527-82d689c83e4d", "value": "ruhi@aktekmetal.com.tr" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119987", "uuid": "98c20d5d-953b-40d2-b8d6-f530dffc6b42", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "md5", "timestamp": "1785119987", "to_ids": true, "type": "md5", "uuid": "cb6c7617-bb63-4b64-b438-4c3ff0462533", "value": "34bfa888695b9aaa41bd575245972043", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "sha1", "timestamp": "1785118287", "to_ids": true, "type": "sha1", "uuid": "83b044d4-5c3b-4c3b-95d8-b5c8e8c80f9c", "value": "89d0d2a2a5f5a3977970cafabbdd2eb1ee3c25d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "sha256", "timestamp": "1785118288", "to_ids": true, "type": "sha256", "uuid": "81418433-0641-43e9-9d18-616dd4753d5d", "value": "2dbe2d425a14555edf552b1e4d0bce31c132be969a2f9ad08218d6587fc27ab1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "text", "timestamp": "1785116876", "to_ids": false, "type": "text", "uuid": "a00a3c8c-67f1-4db3-adbb-5189e17de1a8", "value": "Type Description: Win32 EXE\nOriginal name: stub.exe\nMicrosoft: Trojan:MSIL/Heracles.SPPX!MTB\nClamAV: None\nVT Total Detection: 58/74\nFirst Submission: 2026-06-10T07:05:46+00:00\nLast Submission: 2026-06-10T07:05:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "creation-time", "timestamp": "1785116876", "to_ids": false, "type": "datetime", "uuid": "ce57b7f6-fe9b-4f91-8f3b-fa684708fc4d", "value": "2044-08-04T08:18:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "ssdeep", "timestamp": "1785116876", "to_ids": true, "type": "ssdeep", "uuid": "1d8b9c90-f2b3-4ae6-948f-e42394d5607e", "value": "12288:v9mUY4kqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabh3NUW6:v9zkqjVnlqud+/2P+ATAS/JYeL3NUn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116876", "to_ids": false, "type": "size-in-bytes", "uuid": "68b89f81-00cb-4b69-bc2c-a05792c73246", "value": "750592" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "vhash", "timestamp": "1785116876", "to_ids": true, "type": "vhash", "uuid": "ed3abd72-97da-4b2f-9055-41e0ec0abf12", "value": "27503675151300c3c873910f79" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T07:05:46+00:00", "last_seen": "2026-06-10T07:05:46+00:00", "object_relation": "filename", "timestamp": "1785116876", "to_ids": true, "type": "filename", "uuid": "bd7ea105-434a-4e07-9c37-bd66789edd35", "value": "stub.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T11:41:03+00:00", "last_seen": "2026-06-25T11:41:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120008", "uuid": "7f8ec070-fc05-4c48-96e2-192f81f79fe0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T11:41:03+00:00", "last_seen": "2026-06-25T11:41:03+00:00", "object_relation": "md5", "timestamp": "1785120008", "to_ids": true, "type": "md5", "uuid": "bff379f7-4efd-4b35-a22c-5f3ef4fc6bd6", "value": "5f238710a5ef4f6ddbbe7a118c822705", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T11:41:03+00:00", "last_seen": "2026-06-25T11:41:03+00:00", "object_relation": "sha1", "timestamp": "1785118289", "to_ids": true, "type": "sha1", "uuid": "307984fd-90fd-456b-bacb-3a9b084e1ff6", "value": "1c958586cde32dcedf4ec5b01ccd6e7b9e46826f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T11:41:03+00:00", "last_seen": "2026-06-25T11:41:03+00:00", "object_relation": "sha256", "timestamp": "1785118289", "to_ids": true, "type": "sha256", "uuid": "9fab0247-86fd-41ba-96a9-d73f82dc52be", "value": "782e88aa43b06058105d717d5183f20e4f22222239df2ac4c8205ea71bc4fa4e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T11:41:03+00:00", "last_seen": "2026-06-25T11:41:03+00:00", "object_relation": "text", "timestamp": "1785116897", "to_ids": false, "type": "text", "uuid": "8e7254fa-b9b3-4245-9c8f-50ad6c96e2a6", "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/DarkCloud.P!MTB\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-06-25T11:41:03+00:00\nLast Submission: 2026-06-25T11:41:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T11:41:03+00:00", "last_seen": "2026-06-25T11:41:03+00:00", "object_relation": "ssdeep", "timestamp": "1785116897", "to_ids": true, "type": "ssdeep", "uuid": "0bfdb0cd-aeec-4c76-af9e-4c8925f2debb", "value": "1536:RQuAlBgT3lAxGkVH9h3eOXOG3FbM+lHTW5D8O7Cn2Cmogo3REqCv/U8cSsGcMIMW:RQuRTVAYk1b3eyOqFQ+M98O7Y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T11:41:03+00:00", "last_seen": "2026-06-25T11:41:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116897", "to_ids": false, "type": "size-in-bytes", "uuid": "e210dfe8-46bc-41c5-b0b8-41a82412672a", "value": "2531026" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T11:41:03+00:00", "last_seen": "2026-06-25T11:41:03+00:00", "object_relation": "filename", "timestamp": "1785116897", "to_ids": true, "type": "filename", "uuid": "f3e435dd-1ddc-47ce-82b5-69c5cd142bd6", "value": "sleestak_payload_1.ps1" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T06:17:14+00:00", "last_seen": "2026-06-25T09:45:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120029", "uuid": "071a0d81-4f4f-4b06-aa0c-bab7475a7bd5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:17:14+00:00", "last_seen": "2026-06-25T09:45:21+00:00", "object_relation": "md5", "timestamp": "1785120029", "to_ids": true, "type": "md5", "uuid": "0a1a619c-b876-4ff0-beca-d39d6d5770c7", "value": "6bbfc88534d5d515dddb0ec9bb618530", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:17:14+00:00", "last_seen": "2026-06-25T09:45:21+00:00", "object_relation": "sha1", "timestamp": "1785118290", "to_ids": true, "type": "sha1", "uuid": "61a6449d-de71-402c-a29d-9e7815bc87e3", "value": "0a7ecb8e5dc667acc7c950e6bbcb0448368ad488", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:17:14+00:00", "last_seen": "2026-06-25T09:45:21+00:00", "object_relation": "sha256", "timestamp": "1785118290", "to_ids": true, "type": "sha256", "uuid": "5a22e52e-e168-430b-bda8-485beef7bd65", "value": "501ba63e1e26e7d58e16dd1294b292161a5d274991f98e896461735d5c9e995a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 26/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:17:14+00:00", "last_seen": "2026-06-25T09:45:21+00:00", "object_relation": "text", "timestamp": "1785116919", "to_ids": false, "type": "text", "uuid": "7f5acc7c-ca4a-47d3-9221-53219a3f1fe1", "value": "Type Description: JavaScript\nMicrosoft: TrojanDownloader:JS/FormBook.AA!AMTB\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-06-25T06:17:14+00:00\nLast Submission: 2026-06-25T09:45:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:17:14+00:00", "last_seen": "2026-06-25T09:45:21+00:00", "object_relation": "ssdeep", "timestamp": "1785116919", "to_ids": true, "type": "ssdeep", "uuid": "fe091e36-8abf-4adf-9dc7-eaa8cc56cb9b", "value": "49152:RMBk0U++I4Bu3QfoT8pELgTEmVhsWkZq0K9taU5dlX:9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:17:14+00:00", "last_seen": "2026-06-25T09:45:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116919", "to_ids": false, "type": "size-in-bytes", "uuid": "30a8d4b3-83b2-4029-8efa-b75cafb2ca16", "value": "4642116" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:17:14+00:00", "last_seen": "2026-06-25T09:45:21+00:00", "object_relation": "filename", "timestamp": "1785116919", "to_ids": true, "type": "filename", "uuid": "d5b09721-418b-4c5f-b51b-a5c963254eac", "value": "CKHT800A_RUJ ATC13529CWYE25M.js" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T06:57:39+00:00", "last_seen": "2026-06-25T06:57:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120050", "uuid": "41f95aed-7680-4992-96a4-645626af7e31", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:57:39+00:00", "last_seen": "2026-06-25T06:57:39+00:00", "object_relation": "md5", "timestamp": "1785120050", "to_ids": true, "type": "md5", "uuid": "9d91d4cb-e2df-4f34-ab90-d8496ac50448", "value": "8a620e451e64f418bc21fd458e952f2e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:57:39+00:00", "last_seen": "2026-06-25T06:57:39+00:00", "object_relation": "sha1", "timestamp": "1785118291", "to_ids": true, "type": "sha1", "uuid": "761d7dba-4cc6-4b9f-acb1-eb3f0d5e3e84", "value": "ddb91e512fa3ae6a38eed741868526ffbc40a864", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:57:39+00:00", "last_seen": "2026-06-25T06:57:39+00:00", "object_relation": "sha256", "timestamp": "1785118292", "to_ids": true, "type": "sha256", "uuid": "e579cea6-2b0d-4a94-8de4-99ff6bdc879a", "value": "64a68e4e1b93f1347c0935875395672784db5b49027c6508f13983efa98971f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 25/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:57:39+00:00", "last_seen": "2026-06-25T06:57:39+00:00", "object_relation": "text", "timestamp": "1785116940", "to_ids": false, "type": "text", "uuid": "676cd3fe-5200-400c-9216-45c180f439df", "value": "Type Description: Text\nMicrosoft: Trojan:PowerShell/AsyncRAT.AA!AMTB\nClamAV: None\nVT Total Detection: 30/74\nFirst Submission: 2026-06-25T06:57:39+00:00\nLast Submission: 2026-06-25T06:57:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:57:39+00:00", "last_seen": "2026-06-25T06:57:39+00:00", "object_relation": "ssdeep", "timestamp": "1785116940", "to_ids": true, "type": "ssdeep", "uuid": "ab237d44-0ed1-4e6e-86c1-2e42ea9fc31d", "value": "49152:QpDhvUEeDqVQa0Q3vFy0kfHdWwYyy9IqQk6:L" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:57:39+00:00", "last_seen": "2026-06-25T06:57:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116940", "to_ids": false, "type": "size-in-bytes", "uuid": "374d201d-76df-4924-9358-938330912236", "value": "3421118" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:57:39+00:00", "last_seen": "2026-06-25T06:57:39+00:00", "object_relation": "filename", "timestamp": "1785116940", "to_ids": true, "type": "filename", "uuid": "aa229b65-1302-49d1-8b21-d98429567b8a", "value": "ps_vgiKYCxm04vY_1782395561548.ps1" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785120071", "uuid": "28a3a5bc-830e-49f1-a648-a36eb67e73a3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "md5", "timestamp": "1785120071", "to_ids": true, "type": "md5", "uuid": "8f9b7060-a772-4520-9ce2-bd3d7348d969", "value": "a30b628d0c087f305b35be3e3f5281b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "sha1", "timestamp": "1785118293", "to_ids": true, "type": "sha1", "uuid": "497a2fdf-3f75-4684-bdb2-3e6e6a7e3350", "value": "ffb6776c66458ca0e0f6230499757a810e96a948", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "sha256", "timestamp": "1785118293", "to_ids": true, "type": "sha256", "uuid": "ecc2d431-70b2-4d78-94dc-9b5dd6a003f4", "value": "149e5005577a5276339f33442d369d56e1bfa13c84da34471404223cda8d4518", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "text", "timestamp": "1785116963", "to_ids": false, "type": "text", "uuid": "60cba507-1b4d-4b34-92fb-92fffba7d48a", "value": "Type Description: Win32 DLL\nOriginal name: WWWWOMENNN.dll\nMicrosoft: Trojan:MSIL/Injector.NYA!MTB\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2026-06-25T06:48:38+00:00\nLast Submission: 2026-06-25T06:48:38+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "creation-time", "timestamp": "1785116963", "to_ids": false, "type": "datetime", "uuid": "12ffbbaf-fb70-4bf4-af7d-9f5c0b795272", "value": "2026-06-24T23:13:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "ssdeep", "timestamp": "1785116963", "to_ids": true, "type": "ssdeep", "uuid": "5d276659-3fdd-4a3b-9b66-a47537cc0140", "value": "768:gWq1aDQqO/zPzgWpUmNH4ft4sMBaz5mxS0qLf:gWqrqO/YWpUi4F4sM8zwSF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116963", "to_ids": false, "type": "size-in-bytes", "uuid": "3f7a89ad-5d61-4c2a-9e86-b012d9b42b92", "value": "27648" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "vhash", "timestamp": "1785116963", "to_ids": true, "type": "vhash", "uuid": "e7d573d2-739e-49e9-95d3-1e587116ca81", "value": "32403665151100a21152030" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T06:48:38+00:00", "last_seen": "2026-06-25T06:48:38+00:00", "object_relation": "filename", "timestamp": "1785116963", "to_ids": true, "type": "filename", "uuid": "86d5e320-cc7b-4050-932e-e19566d6ccdb", "value": "WWWWOMENNN.dll" } ] } ] } }