{ "Event": { "analysis": "1", "date": "2026-07-30", "extends_uuid": "", "info": "[Threat Intel] Toy Ghouls\u2019 new toy: the GenieLocker ransomware", "protected": false, "publish_timestamp": "1785648838", "published": true, "threat_level_id": "2", "timestamp": "1785648838", "uuid": "04596f5b-2204-490f-a92a-ab883cfdc2e7", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#7773ac", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#b2a633", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#aad818", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#657ac3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"", "relationship_type": "" }, { "colour": "#682cad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": "" }, { "colour": "#07ff3c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#b596f0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Lateral Tool Transfer - T1570\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#370063", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#15cd0b", "local": false, "name": "misp-galaxy:target-information=\"Russia\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Babuk (Windows)\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"LockBit (Windows)\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"MimiKatz\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"RedAlert Ransomware\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785495616", "to_ids": false, "type": "link", "uuid": "c44ce8ad-73ed-4909-b838-6f182c8d3df8", "value": "https://securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1785495616", "to_ids": false, "type": "text", "uuid": "eecc7fd6-6787-49ce-90fe-77392fc26c08", "value": "GenieLocker is a new ransomware family active since March 2026, targeting organizations in the Russian Federation, primarily in manufacturing. Attributed to the financially motivated Toy Ghouls group (also known as Bearlyfy, Labubu, and Laboo.boo), this custom-designed ransomware marks a shift from their previous reliance on third-party encryption tools like RedAlert, LockBit, and Babuk. GenieLocker exists in two variants: PE builds for Windows and ELF builds for Linux and ESXi. The Windows version features sophisticated capabilities including process termination, service shutdown, anti-debugging techniques, and advanced encryption using the libsodium library with XChaCha20-Poly1305 algorithm. Initial access typically occurs through compromised VPN credentials from trusted partners, followed by deployment of tools like Mimikatz, SoftPerfect Network Scanner, and SSH utilities for lateral movement before deploying ransomware using PsExec and PAExec." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1785495616", "to_ids": false, "type": "text", "uuid": "8c7686c4-7f50-48c7-9f18-ddfdc70fd79b", "value": "Name: Toy Ghouls\u2019 new toy: the GenieLocker ransomware\nAuthor: AlienVault\nAdversary: Toy Ghouls\nTags: [\"manufacturing\", \"mimikatz\", \"esxi\", \"babuk\", \"ransomware\", \"bearlyfy\", \"xchacha20-poly1305\", \"redalert\", \"lockbit\", \"encryption\", \"genielocker\", \"labubu\", \"russian federation\", \"libsodium\"]\nTgtd countries: [\"Russian Federation\"]\nMlwr families: [\"GenieLocker\", \"RedAlert\", \"LockBit\", \"Babuk - S0638\", \"Babyk\", \"Vasa Locker\", \"Mimikatz\"]\nAttack_ids: [\"T1133\", \"T1489\", \"T1497.001\", \"T1021.004\", \"T1135\", \"T1555\", \"T1219\", \"T1572\", \"T1021\", \"T1003.001\", \"T1083\", \"T1059.001\", \"T1562.001\", \"T1078\", \"T1486\", \"T1570\", \"T1027.002\", \"T1018\", \"T1021.001\", \"T1490\"]\nIndustries: [\"Manufacturing\", \"Construction\", \"Finance\", \"Retail\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1785495616", "to_ids": false, "type": "threat-actor", "uuid": "1b8dcc36-af91-4ea3-a1e4-56b3fbfbd026", "value": "Toy Ghouls" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643829", "to_ids": true, "type": "md5", "uuid": "22fc4025-e9c1-4237-8c9f-bed91c8c992d", "value": "18f61c6d686cffd131c9fd3f3437064b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643851", "to_ids": true, "type": "md5", "uuid": "308926c5-54e6-4672-bd28-f8ed71c05e2b", "value": "25480dad40152ef3d0c6d38eecc9bd9b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643871", "to_ids": true, "type": "md5", "uuid": "8d2522f1-cac7-402f-90b7-db3c903dff84", "value": "34a7f28e0bb69b0d49bacc88bdf20ac1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643892", "to_ids": true, "type": "md5", "uuid": "dda01a80-dbe6-4f10-8786-9a503b60bfbe", "value": "34b8828635f88078735799a3c1ac8e28", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643913", "to_ids": true, "type": "md5", "uuid": "2cec6edb-6f7b-4a54-a883-53727329fae0", "value": "3a4479b51890373bfc4a011ef41fe376", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643934", "to_ids": true, "type": "md5", "uuid": "cb611862-9025-4d09-8e71-10ed1c587c1a", "value": "58c0dda52b8f069660166d61fd74f911", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643955", "to_ids": true, "type": "md5", "uuid": "dd12b0b6-5b8d-4a1a-9cef-e8145f8334c7", "value": "5d62c1349b8981c396c9a23f4f8f053c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643976", "to_ids": true, "type": "md5", "uuid": "5f1ca7ce-3900-4150-aebd-7e0488ac1b6f", "value": "780c8f4c6f077da4da96582987920362", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785643997", "to_ids": true, "type": "md5", "uuid": "5a669ffe-4690-43ce-97bd-8d97f63f4afa", "value": "7dad78584795aa5c160520cc6accf260", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644018", "to_ids": true, "type": "md5", "uuid": "ccc61975-93fe-40c3-a146-04fb9fbc2885", "value": "824ca1e906cc073ee5b0f3519df69a8f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644060", "to_ids": true, "type": "md5", "uuid": "9daea2d2-40c9-4f14-9731-058a6d614e4b", "value": "9969a8221312dba70dd5cbddf83a146c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644081", "to_ids": true, "type": "md5", "uuid": "9eef462f-26c3-4b2d-ac2b-f58b71f2820e", "value": "9cd514ff2809ce0b993e3b8649e82a94", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644124", "to_ids": true, "type": "md5", "uuid": "f55a2850-5154-449f-9fd9-09cd0de2fae9", "value": "a8842616c9057d5cf6e1fe1fa8c3c160", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644167", "to_ids": true, "type": "md5", "uuid": "21f656bf-6ba5-44f8-a8aa-3fa49cddf739", "value": "c68b6862725777651085650db34947fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644187", "to_ids": true, "type": "md5", "uuid": "47745b8b-d091-464d-8ae9-ca56fafff8fb", "value": "d3e06eb34d8eee7ef92cac3ad0a20ff5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644230", "to_ids": true, "type": "md5", "uuid": "e2beb2f9-9a29-4501-bce5-3d2eebb64ea2", "value": "d87d0b01d95acc936b7dc47b8f41937a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644251", "to_ids": true, "type": "md5", "uuid": "02631a3b-9afd-4325-b50b-88fe4c562b88", "value": "de3cfbb50f66079bfee20a6f64e59433", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644272", "to_ids": true, "type": "md5", "uuid": "9ffcc45d-a29b-4cbe-8a09-3f0e7cce953d", "value": "f08f476f26b01d142ca73923de65fc0c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644292", "to_ids": true, "type": "md5", "uuid": "bd4b23c6-5fef-4091-9eb0-7f7b68ed46ba", "value": "f7b9e36e94163a9a303160945f99267a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644314", "to_ids": true, "type": "md5", "uuid": "2078d937-85a4-4baa-be3e-5626d3d04745", "value": "fd46a80c2f45577263328984edf7f4dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648733", "to_ids": true, "type": "ip-dst", "uuid": "83b6d9b6-61fc-48d1-9cc5-55115d45b32c", "value": "89.125.66.101", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785648754", "uuid": "4f755965-a7a8-406e-9055-a91d7deaee24", "Attribute": [ { "category": "Payload delivery", "comment": "GenieLocker for Linux and ESXi", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "object_relation": "md5", "timestamp": "1785648754", "to_ids": true, "type": "md5", "uuid": "e6babe85-d5aa-44f5-8c6c-d0be488eb7b9", "value": "9201e35e2993612612919a3c71302cab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "GenieLocker for Linux and ESXi", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "object_relation": "sha1", "timestamp": "1785644019", "to_ids": true, "type": "sha1", "uuid": "f4bae3f2-0df0-4323-90eb-ee675a4e12ee", "value": "c73b1e43324c570e53e786ebe45d3a8450697b4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "GenieLocker for Linux and ESXi", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "object_relation": "sha256", "timestamp": "1785644019", "to_ids": true, "type": "sha256", "uuid": "0d3a0767-1208-4e9b-af81-ed9bcb461228", "value": "fb6feb9eb3ab5a245f5d3a57683e48d34261fd4e23e47a8347ba405dd8a5d3ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "object_relation": "text", "timestamp": "1785644018", "to_ids": false, "type": "text", "uuid": "c935aad6-1d22-4778-a3fd-87eaa7421012", "value": "GenieLocker for Linux and ESXi\r\nType Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 23/75\nFirst Submission: 2026-03-29T16:42:31+00:00\nLast Submission: 2026-03-29T16:42:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "object_relation": "ssdeep", "timestamp": "1785644018", "to_ids": true, "type": "ssdeep", "uuid": "2af24ee1-3c8b-45fb-b3ab-ab97dee51057", "value": "24576:wYN/dilfkuz2k5v46PxgiI7SRDcRO0dX/ANyET7q://d+f0Ev46m7SR4xX/AM8q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1785644018", "to_ids": false, "type": "size-in-bytes", "uuid": "2f9dc8f9-d352-448b-a322-cb9a349bdd41", "value": "1210680" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "object_relation": "vhash", "timestamp": "1785644018", "to_ids": true, "type": "vhash", "uuid": "f5141b07-5f32-421e-b5fb-c72fd61df160", "value": "f11aec73a7ff598aa661e18023564e7a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-29T16:42:31+00:00", "last_seen": "2026-03-29T16:42:31+00:00", "object_relation": "filename", "timestamp": "1785644018", "to_ids": true, "type": "filename", "uuid": "8b1d72c3-d064-4169-a473-c0424197f2c5", "value": "qgwacn.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785648776", "uuid": "8be818ae-e74c-4e58-a83e-15bba4741f9c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "md5", "timestamp": "1785648776", "to_ids": true, "type": "md5", "uuid": "34a3687a-63d5-4ea4-808a-81bcc9f4575f", "value": "a50eaaf514f4f84e61ca2455a8789753", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "sha1", "timestamp": "1785644083", "to_ids": true, "type": "sha1", "uuid": "f54598cc-a1ba-4f37-968d-1b81a86f761e", "value": "006a89966de7db1cf9b3f826edfd3e76a15c134a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "sha256", "timestamp": "1785644083", "to_ids": true, "type": "sha256", "uuid": "e5ece448-2da6-4164-8f8c-13cd113ae353", "value": "46b55c1bda53cf8aa9ac963fe0f478198efe658dd2d9027d40943ac6c9efce25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "text", "timestamp": "1785644082", "to_ids": false, "type": "text", "uuid": "7d9fe7a0-af62-4bae-9d65-8f611d7aabe7", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/GenieLocker!AMTB\nClamAV: None\nVT Total Detection: 49/75\nFirst Submission: 2026-04-28T11:21:20+00:00\nLast Submission: 2026-04-28T11:21:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "creation-time", "timestamp": "1785644082", "to_ids": false, "type": "datetime", "uuid": "16d2e2c5-4bbc-40db-9ea1-2811b6532d29", "value": "2026-04-26T18:36:43+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "ssdeep", "timestamp": "1785644082", "to_ids": true, "type": "ssdeep", "uuid": "cf2203ad-36cc-4fa3-a98f-2f6f54fc1d6a", "value": "6144:0EqvH+SWv9x8pwpTlBr0k4Tc/F8SPwYFybaGu37TV50DEr9iOr:gvH9WDEQT3N4WF8cKpo7kD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1785644082", "to_ids": false, "type": "size-in-bytes", "uuid": "d75e89ed-2dfc-4cbd-872b-d3b4c4245e38", "value": "376320" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "vhash", "timestamp": "1785644082", "to_ids": true, "type": "vhash", "uuid": "34eb7cf2-8e3d-4a14-91f0-ce98da6b78c1", "value": "035076656d155d05555068z76nz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-28T11:21:20+00:00", "last_seen": "2026-04-28T11:21:20+00:00", "object_relation": "filename", "timestamp": "1785644082", "to_ids": true, "type": "filename", "uuid": "63d56823-a4c5-432d-9d34-7fcb35fede16", "value": "hczfqeww.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785648797", "uuid": "9783c1e5-a99a-4f7e-bd5d-fc4fb29c4d19", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "md5", "timestamp": "1785648797", "to_ids": true, "type": "md5", "uuid": "01aee9da-f0b4-459b-8b85-976953e07c66", "value": "b893eafed0659f70d4ac250f09073723", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "sha1", "timestamp": "1785644126", "to_ids": true, "type": "sha1", "uuid": "e55dda1d-d04e-4ed3-9baa-5146ee03db9b", "value": "191f02d1b516ce3bcfc53110ba1e394e485567a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "sha256", "timestamp": "1785644126", "to_ids": true, "type": "sha256", "uuid": "2a8b612e-4096-4698-b234-d3b87361947b", "value": "99acdf11b74029d053ee7daf62575e50dd43a42b474efd44853b78e29b4fa7cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "text", "timestamp": "1785644125", "to_ids": false, "type": "text", "uuid": "0c549624-20c3-4508-8a55-319d7b369207", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/GenieLocker.YBE!MTB\nClamAV: None\nVT Total Detection: 50/75\nFirst Seen In The Wild: 2026-04-16T16:00:56+00:00\nFirst Submission: 2026-03-09T06:30:15+00:00\nLast Submission: 2026-03-09T06:30:15+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "creation-time", "timestamp": "1785644125", "to_ids": false, "type": "datetime", "uuid": "8b711dc2-88bb-45b8-affe-7bdaf1b8b64c", "value": "2026-03-08T19:34:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "ssdeep", "timestamp": "1785644125", "to_ids": true, "type": "ssdeep", "uuid": "6f138ae5-f96a-4274-964b-075821e2953d", "value": "6144:uek+yjWv9x8p1ptt8qddW0Oio0fMeIod37kxSruNLV50DErkQjJC:uek+yjWDErtBvW4o0UsoYruN8DIs" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1785644125", "to_ids": false, "type": "size-in-bytes", "uuid": "676aa929-8329-4eab-b95a-749ae7f778d0", "value": "376320" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "vhash", "timestamp": "1785644125", "to_ids": true, "type": "vhash", "uuid": "e860914e-1389-41da-a4c5-c7ac2c549c0d", "value": "035076656d155d05555068z76nz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-09T06:30:15+00:00", "last_seen": "2026-03-09T06:30:15+00:00", "object_relation": "filename", "timestamp": "1785644125", "to_ids": true, "type": "filename", "uuid": "4e0c19c4-67a9-4bd0-b7cf-3594f8a393d3", "value": "x1aczjih.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785648818", "uuid": "41c0a498-d235-4620-bbf0-fe41be0a0f3b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "md5", "timestamp": "1785648818", "to_ids": true, "type": "md5", "uuid": "23e204ac-28c5-40d8-a06b-8ddf131c779e", "value": "d661cf666b9acbab7cfeae1127a261a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "sha1", "timestamp": "1785644189", "to_ids": true, "type": "sha1", "uuid": "33d46fa0-05b8-46cd-9512-079538f0b38c", "value": "2e6bc8ba12a9a3150257880fcd2a97f702a28d47", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "sha256", "timestamp": "1785644189", "to_ids": true, "type": "sha256", "uuid": "886dd274-416c-4256-8373-6aa53543e5db", "value": "dce818f0738af0dc9592627b7db5f4d3e02aadfe24c8de8d4f10161a7b5f75df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "text", "timestamp": "1785644188", "to_ids": false, "type": "text", "uuid": "e9efd005-70fb-4109-8bd7-17ca7e73f16e", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/GenieLocker.YBE!MTB\nClamAV: None\nVT Total Detection: 53/75\nFirst Seen In The Wild: 2026-04-16T16:00:57+00:00\nFirst Submission: 2026-03-21T10:36:04+00:00\nLast Submission: 2026-03-26T05:34:48+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "creation-time", "timestamp": "1785644188", "to_ids": false, "type": "datetime", "uuid": "02130417-31c9-4506-a65e-d289267e5901", "value": "2026-03-20T21:19:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "ssdeep", "timestamp": "1785644188", "to_ids": true, "type": "ssdeep", "uuid": "dbf45dc8-2c9b-452a-aef7-2e2137f3c33a", "value": "6144:jek+yjWv9x8p1ptt8qddW0Oio0fMeIod37kxSruNLV50DErkejJC:jek+yjWDErtBvW4o0UsoYruN8DCs" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1785644188", "to_ids": false, "type": "size-in-bytes", "uuid": "2baa0d19-2324-48a6-ae09-82e8ba5f3aba", "value": "376320" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "vhash", "timestamp": "1785644188", "to_ids": true, "type": "vhash", "uuid": "bb771820-188b-46e3-9a53-2af29856e675", "value": "035076656d155d05555068z76nz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-21T10:36:04+00:00", "last_seen": "2026-03-26T05:34:48+00:00", "object_relation": "filename", "timestamp": "1785644188", "to_ids": true, "type": "filename", "uuid": "c0d2c605-06ab-421a-95a8-1b204262de0f", "value": "dce818f0738af0dc9592627b7db5f4d3e02aadfe24c8de8d4f10161a7b5f75df.exe" } ] } ] } }