{ "Event": { "analysis": "1", "date": "2026-05-26", "extends_uuid": "", "info": "[Threat Intel] A stealthy RAT burrowing deep into Android devices", "protected": false, "publish_timestamp": "1780521446", "published": true, "threat_level_id": "3", "timestamp": "1780521446", "uuid": "0da26aa9-86b0-415a-a8c4-0ce1d326a101", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#8675c7", "local": false, "name": "misp-galaxy:producer=\"ESET\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#2afb09", "local": false, "name": "misp-galaxy:target-information=\"Argentina\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"BTMOB RAT\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#170059", "local": false, "name": "rectifyq:topic=\"mobile-attack\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#5f0077", "local": false, "name": "ms-caro-malware:malware-platform=\"AndroidOS\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780311618", "to_ids": false, "type": "link", "uuid": "71b0194d-6ff2-4687-b88b-58ab2b55ec00", "value": "https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780311618", "to_ids": false, "type": "text", "uuid": "232e7d69-f6ed-4c8c-a5e8-4fcdc8e1053f", "value": "BTMOB is an Android remote access trojan that evolved from SpySolr malware and poses significant threats beyond traditional banking trojans. The malware combines phishing-led delivery with an APK builder interface that enables rapid payload generation without coding skills. Distributed through fake app stores impersonating streaming services, cryptocurrency platforms, and government agencies, BTMOB abuses Android Accessibility Services to gain elevated permissions. Marketed as malware-as-a-service with a reported $5,000 lifetime license, it provides adversaries with capabilities to exfiltrate sensitive data, capture screenshots, record device activity, and establish remote control. The tool's customizable phishing lures have been adapted for specific regions, including campaigns impersonating Argentine tax authorities, making it a rapidly evolving threat with global reach." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780311618", "to_ids": false, "type": "text", "uuid": "475c0e83-7cfc-48eb-838d-d3e34541f62c", "value": "Name: A stealthy RAT burrowing deep into Android devices\nAuthor: AlienVault\nAdversary: \nTags: [\"android rat\", \"latin america\", \"phishing campaigns\", \"spysolr evolution\", \"apk builder\", \"remote access\", \"brazil\", \"accessibility abuse\", \"malware-as-a-service\", \"spysolr\", \"btmob\"]\nTgtd countries: [\"Argentina\", \"Brazil\"]\nMlwr families: [\"BTMOB\", \"SpySolr\"]\nAttack_ids: []\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780498982", "to_ids": true, "type": "ip-dst", "uuid": "ca2146c6-dbd6-468c-a711-4e3fa5a65a68", "value": "191.96.225.241", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499003", "to_ids": true, "type": "ip-dst", "uuid": "067d9c02-cc93-4428-9506-e457c71445bc", "value": "191.96.79.41", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499024", "to_ids": true, "type": "ip-dst", "uuid": "9b9d4dac-0627-42cf-acc6-47fa2ee7d8a0", "value": "191.96.79.133", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499045", "to_ids": true, "type": "ip-dst", "uuid": "1d7ee4ca-f98e-4cd7-914d-f9b61c898ef4", "value": "200.9.155.153", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499066", "to_ids": true, "type": "ip-dst", "uuid": "39652361-49ed-4db5-b704-8ee0a692e47f", "value": "191.96.224.87", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499087", "to_ids": true, "type": "ip-dst", "uuid": "41759ce6-e0d6-4dd0-9d74-980c9c0a88d0", "value": "191.96.78.172", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499109", "to_ids": true, "type": "ip-dst", "uuid": "3041b215-6390-4e58-b6ae-a758412aff48", "value": "195.160.221.203", "Tag": [ { "colour": "#b5af8f", "local": false, "name": "asn:asn=\"43641\"", "relationship_type": "" }, { "colour": "#c3fbbc", "local": false, "name": "asn:as-owner=\"SOLLUTIUM-NL\"", "relationship_type": "" }, { "colour": "#ec0428", "local": false, "name": "asn:as-country=\"PL\"", "relationship_type": "" }, { "colour": "#c9412f", "local": false, "name": "misp-galaxy:country=\"poland\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499130", "to_ids": true, "type": "ip-dst", "uuid": "6734cd11-41e4-40a1-b167-0a1194f07948", "value": "191.96.79.179", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499151", "to_ids": true, "type": "domain", "uuid": "eb5a5c23-c438-4efe-a91f-80ddcad2bf0b", "value": "arbsniper.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499172", "to_ids": true, "type": "ip-dst", "uuid": "72b99abf-30b0-4bab-ae0f-c73bb40191ee", "value": "191.101.131.250", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499194", "to_ids": true, "type": "ip-dst", "uuid": "5f2eb6a0-2722-4d67-92a2-16c0f29d2633", "value": "191.96.78.28", "Tag": [ { "colour": "#bee68d", "local": false, "name": "asn:asn=\"270353\"", "relationship_type": "" }, { "colour": "#0d9aeb", "local": false, "name": "asn:as-owner=\"Tyna Host - Datacenter no Brasil\"", "relationship_type": "" }, { "colour": "#178852", "local": false, "name": "asn:as-country=\"BR\"", "relationship_type": "" }, { "colour": "#d46af0", "local": false, "name": "misp-galaxy:country=\"brazil\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:03/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780498043", "to_ids": true, "type": "sha256", "uuid": "139b86b5-17c2-4fc1-aa8b-6685cf812931", "value": "1a60cb5f7e2fb7c09fc3dc8459108b26ac98ee73131f37a28cfdad5fc75b7a7d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:03/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780498045", "to_ids": true, "type": "sha256", "uuid": "8cf1048a-13c0-418a-bad8-23f5f470b386", "value": "676cb2d0a60403afc06cea1b572cb7261f706365fac65621b5a4907893e7ac0d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:03/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780498045", "to_ids": true, "type": "sha256", "uuid": "676276e4-5331-48e5-b491-3c4f2a3a4337", "value": "702261ba38b57ecc3a5407fed28b2f0611a74c2ec0c116aea4f9e6def0899aed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:03/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780498046", "to_ids": true, "type": "sha256", "uuid": "8202c839-7d3e-4496-bb53-22ce15e0c51b", "value": "a764d73795abe47ae640ba09999a18c47b5340e5ecc7b897afebf34f3f37638f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:03/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780498047", "to_ids": true, "type": "sha256", "uuid": "e4dd790e-a593-4d35-8b7f-06e23563e475", "value": "c6199e175fb988cbbeacdf0f5acdf9ed83f5bdaae5c95b7a6c27ee72cd11b0b1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499215", "to_ids": true, "type": "ip-dst", "uuid": "3c0740d1-bef0-426f-a059-92ee4b84a429", "value": "74.125.202.103", "Tag": [ { "colour": "#1bd0e0", "local": false, "name": "asn:asn=\"15169\"", "relationship_type": "" }, { "colour": "#6cfea6", "local": false, "name": "asn:as-owner=\"GOOGLE\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499236", "to_ids": true, "type": "ip-dst", "uuid": "c3405b4a-4db9-4823-9ff6-c97885c90e0b", "value": "142.251.183.138", "Tag": [ { "colour": "#1bd0e0", "local": false, "name": "asn:asn=\"15169\"", "relationship_type": "" }, { "colour": "#6cfea6", "local": false, "name": "asn:as-owner=\"GOOGLE\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499257", "to_ids": true, "type": "ip-dst", "uuid": "3e0d3db2-e615-4562-9422-0384be30a84e", "value": "173.194.193.138", "Tag": [ { "colour": "#1bd0e0", "local": false, "name": "asn:asn=\"15169\"", "relationship_type": "" }, { "colour": "#6cfea6", "local": false, "name": "asn:as-owner=\"GOOGLE\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499279", "to_ids": true, "type": "ip-dst", "uuid": "caf998e6-9b59-4b24-8221-f3f2cf0cf3c9", "value": "173.194.206.106", "Tag": [ { "colour": "#1bd0e0", "local": false, "name": "asn:asn=\"15169\"", "relationship_type": "" }, { "colour": "#6cfea6", "local": false, "name": "asn:as-owner=\"GOOGLE\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499300", "to_ids": true, "type": "ip-dst", "uuid": "bac7eeb9-d9be-4b3c-b01d-413e81c32aa5", "value": "178.156.177.192", "Tag": [ { "colour": "#380b94", "local": false, "name": "asn:asn=\"213230\"", "relationship_type": "" }, { "colour": "#a98027", "local": false, "name": "asn:as-owner=\"HETZNER-CLOUD2-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499322", "to_ids": true, "type": "ip-dst", "uuid": "285d4776-a83e-45f3-92c7-1ae4d6f6e2ad", "value": "104.21.64.137", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499343", "to_ids": true, "type": "ip-dst", "uuid": "dc839484-b904-4882-8e3d-f86c6a4157b4", "value": "173.194.194.94", "Tag": [ { "colour": "#1bd0e0", "local": false, "name": "asn:asn=\"15169\"", "relationship_type": "" }, { "colour": "#6cfea6", "local": false, "name": "asn:as-owner=\"GOOGLE\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499365", "to_ids": true, "type": "ip-dst", "uuid": "5b3a6c52-e71d-4433-b616-ab93413bdd2c", "value": "192.178.209.95", "Tag": [ { "colour": "#1bd0e0", "local": false, "name": "asn:asn=\"15169\"", "relationship_type": "" }, { "colour": "#6cfea6", "local": false, "name": "asn:as-owner=\"GOOGLE\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499386", "to_ids": true, "type": "ip-dst", "uuid": "ec6223ed-cc17-4b31-8f5d-2076990cb003", "value": "74.125.132.95", "Tag": [ { "colour": "#1bd0e0", "local": false, "name": "asn:asn=\"15169\"", "relationship_type": "" }, { "colour": "#6cfea6", "local": false, "name": "asn:as-owner=\"GOOGLE\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499407", "to_ids": true, "type": "ip-dst", "uuid": "f5058330-7460-4f46-b0b2-e5ba47f2aadf", "value": "78.135.93.123", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780499428", "to_ids": true, "type": "ip-dst", "uuid": "c5acea56-ecd8-4a83-a237-b86ba2398230", "value": "79.133.57.141", "Tag": [ { "colour": "#e6fbdc", "local": false, "name": "asn:asn=\"214036\"", "relationship_type": "" }, { "colour": "#18a54c", "local": false, "name": "asn:as-owner=\"ULTAHOST-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499450", "uuid": "e1760d36-eb49-4e33-8842-a08b2b5ce509", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499450", "to_ids": true, "type": "md5", "uuid": "26e1c0c9-978b-4919-9368-25790429abed", "value": "25e3c200de4868d754a3b4f4f09ec2bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498006", "to_ids": true, "type": "sha1", "uuid": "37f47448-adae-4dc7-b49e-2e5ad13f5993", "value": "2de67a7c23d3b96b3dbec9a81cf3e01ebefdeee9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498006", "to_ids": true, "type": "sha256", "uuid": "f07d77bb-8b99-4e51-9399-cbaeb17ba846", "value": "0a542751724a432a8448324613e0ce10393e41739a1800cbb7d5a2c648fcdc35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496493", "to_ids": true, "type": "ssdeep", "uuid": "a15ae76f-8b00-415d-8fd4-90af79336263", "value": "196608:cZ7Q4hCz0tH7M/G4uWH1VS2wb2GtV8PK6hnQSnZYREACmTIVxV6NQPEqdmpG:6YzzfwiuePK6h7ZeCjVAQ8u" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496493", "to_ids": false, "type": "size-in-bytes", "uuid": "ff3be52a-8f8e-4a8f-864e-9233b98aa5bc", "value": "12518201" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496493", "to_ids": true, "type": "vhash", "uuid": "d5251f05-f17d-4646-a094-1b554383bf58", "value": "635f28e3addb535788bf716957720db1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496493", "to_ids": true, "type": "filename", "uuid": "b6fd63de-dde1-4693-8dc9-5edbb96f2833", "value": "ntdll.dll" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496493", "to_ids": false, "type": "text", "uuid": "3a8dd196-a3f1-4595-b0af-ad3a48542c64", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:20/66\nFirst Submission:2025-11-14T05:45:44.000000+00:00\nLast Submission:2025-11-14T07:58:14.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499471", "uuid": "ace7a6fb-5447-4132-94a8-bafb3e5c244f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499471", "to_ids": true, "type": "md5", "uuid": "f785fcc5-77a1-4c1c-b4cc-ef1b6b696d3f", "value": "94cd8ba7c79fa2962b505fcef5e25601", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498007", "to_ids": true, "type": "sha1", "uuid": "0f799fe6-f9f7-4ce6-83f9-a7c7cc20c292", "value": "ebfade04b81e5ac679ef7e6beff7b850e3ff6ded", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498007", "to_ids": true, "type": "sha256", "uuid": "a4567cbe-eaf3-472c-bee2-8a51f13964fd", "value": "aa56f350882ce63429c6626567487b041f06168bb60f4fc371a262eabadfa660", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496515", "to_ids": true, "type": "ssdeep", "uuid": "4d1e561b-b65f-418f-a534-e952238659e3", "value": "393216:QQcyma+8+4xxwHtn5Oqiunmy5YS4QaehOtb0atH2Mb:QQcahxmHh5OOT4HecyY2Mb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496515", "to_ids": false, "type": "size-in-bytes", "uuid": "03ddf5f4-6d9d-47d1-8b9d-3ec6207cd704", "value": "15362231" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496515", "to_ids": true, "type": "vhash", "uuid": "5add1ead-b12e-4d52-8500-7079f8a2614c", "value": "776b9e3a496f8ae1d16a57b05d65dca7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496515", "to_ids": true, "type": "filename", "uuid": "2347b9de-7f2c-41fd-84f5-48b60a6a2ec6", "value": "aa56f350882ce63429c6626567487b041f06168bb60f4fc371a262eabadfa660.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496515", "to_ids": false, "type": "text", "uuid": "c626d386-c99b-4b42-a3b8-1191170bd10d", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:25/67\nFirst Submission:2026-03-10T08:22:43.000000+00:00\nLast Submission:2026-03-23T19:41:29.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499492", "uuid": "46aa76ff-6805-43b7-8d49-75ba2a79cff5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499492", "to_ids": true, "type": "md5", "uuid": "0cf92a0b-8c52-4a9f-8b3e-b4c676a32bb3", "value": "54d37f09251cbe283f42f64964083ca8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498009", "to_ids": true, "type": "sha1", "uuid": "799afdbb-7c17-48c0-aa0f-b6dfd48b1ec1", "value": "5c9d9649b439b86cf18987865b32dab228ace037", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498009", "to_ids": true, "type": "sha256", "uuid": "45ba5eb5-ddab-43d5-ac16-0c3714c7d814", "value": "0628ad6d1fd836b13b22e75fa169502d8ce78b7ad20f0261eb5151da98437bca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496537", "to_ids": true, "type": "ssdeep", "uuid": "d8652f4f-570b-4ba5-8bc4-97efbc58008e", "value": "786432:Qi4HkZXQEAj5xfQLOmf+MjT4HecyY2M/XxM:+HktQEQORfjT4YY2M/u" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496537", "to_ids": false, "type": "size-in-bytes", "uuid": "a29bc1cf-a65a-4339-a2b0-d2124173e8b2", "value": "26053444" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496537", "to_ids": true, "type": "vhash", "uuid": "f7b79abc-3533-4d85-ab36-f8a151b2f0eb", "value": "fe92ca2eac0e69a691981d68e433a690" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496537", "to_ids": true, "type": "filename", "uuid": "462cfd20-5a5a-45ef-9aba-6a482e168005", "value": "0628ad6d1fd836b13b22e75fa169502d8ce78b7ad20f0261eb5151da98437bca.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496537", "to_ids": false, "type": "text", "uuid": "795ce85e-2eb1-47d9-9f98-1888e6b12a90", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:31/65\nFirst Submission:2026-03-15T08:22:22.000000+00:00\nLast Submission:2026-06-01T00:11:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499513", "uuid": "6070adc5-fe9a-4ee7-b156-25c16ae516ee", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499513", "to_ids": true, "type": "md5", "uuid": "a5c73537-6bd7-4fb1-a4fd-4f86cd3b66a4", "value": "0f22e6ed962180838c03cb70af8bd66a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498010", "to_ids": true, "type": "sha1", "uuid": "a8799763-3414-4494-b650-0ff882712e8c", "value": "3544b924c689b5d93b9452ad4e53bdfe86aef3c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498010", "to_ids": true, "type": "sha256", "uuid": "bc706316-2008-4293-b7cc-e07978f043e4", "value": "5a4e86bbcf0ebc455d2995db225d9ad682e9b37b6bad472a604a462099d988bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496559", "to_ids": true, "type": "ssdeep", "uuid": "47256cbc-1a98-45ba-926f-ba738297d9df", "value": "196608:SAzhbhxw0x1G6zKgtEnzCB1O9ebV6FVQmqCmI89JMvmv5svmfaAV+UzNNVbPtSM6:/VwsYgR1OAbV6QklqYEwzA5NvrtReD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496559", "to_ids": false, "type": "size-in-bytes", "uuid": "a4d5d7c8-a9f9-4f3b-abea-08560a0004e8", "value": "15022437" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496559", "to_ids": true, "type": "vhash", "uuid": "10222782-fbcc-4ae8-9d17-7e7ceaa8db4e", "value": "657ba345d4e3aca97b75189785fefcff" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496559", "to_ids": true, "type": "filename", "uuid": "af6bb4f8-e19b-4e9b-8239-0e82e3105478", "value": "JadLog Cliente.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496559", "to_ids": false, "type": "text", "uuid": "4999f4be-d767-447e-b338-09c5c6e90520", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:20/66\nFirst Submission:2026-03-02T23:15:33.000000+00:00\nLast Submission:2026-03-03T14:11:33.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499534", "uuid": "0e024771-4f1e-409e-a084-156ec9ffe0ba", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499534", "to_ids": true, "type": "md5", "uuid": "4d6e8233-857b-4f03-9005-4952379a2557", "value": "1011ac97559249522143d32338b08036", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498011", "to_ids": true, "type": "sha1", "uuid": "9d07dd8d-d5d5-48db-af3b-f2364194141e", "value": "6409d1583a15a906ff76556ae0cb8a3611145ec3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498011", "to_ids": true, "type": "sha256", "uuid": "17d1eb2c-5658-440f-853c-7c9d2c72a558", "value": "140a7f995b0336942691a2e93e2017fd575267c017c7d0728d69169306f91963", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496581", "to_ids": true, "type": "ssdeep", "uuid": "43afc0e3-313d-4449-8f18-0a54e5cfe89c", "value": "196608:4q1VKB1vY5kGUzNULEX8bCDBlKhD7Q4ZdkI8wHjqTddMPHr:dUM5kGyNUIMbEBlcDk4VydmHr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496581", "to_ids": false, "type": "size-in-bytes", "uuid": "07427ef4-ad91-4eb6-bc8f-546d313c18f8", "value": "14342510" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496581", "to_ids": true, "type": "vhash", "uuid": "8c7498fe-3c77-4174-bb26-f884e2da9cbc", "value": "e2a824ba792c1c684ff8ae014dc4de79" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496581", "to_ids": true, "type": "filename", "uuid": "de46790b-64aa-440f-9da8-b059e09dd3be", "value": "Certificado PagBank SA-56.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496581", "to_ids": false, "type": "text", "uuid": "3ff0bd79-82b1-4577-b799-4a7f03af8c29", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:20/66\nFirst Submission:2026-02-27T15:22:00.000000+00:00\nLast Submission:2026-02-27T15:22:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499555", "uuid": "3ebd81a0-974d-42d6-a76a-c8d5fdca8f00", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499555", "to_ids": true, "type": "md5", "uuid": "7e558624-ed1d-42f5-b79d-ec00901e54e1", "value": "26ce4d8ea691bb54864c3455ed6b7620", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498012", "to_ids": true, "type": "sha1", "uuid": "2076e7c0-d8e7-47ca-8dd4-34229d563412", "value": "a154ccae7aec83a3e85edc67c91ff9607fb27d8a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498012", "to_ids": true, "type": "sha256", "uuid": "7d7db6b3-3320-48ee-b09a-01fb4667adf3", "value": "a1e457c52eab430c20d48f2ac476e080386313f16efb135a0471902cf68ce475", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496604", "to_ids": true, "type": "ssdeep", "uuid": "83c38e89-7c8a-4815-abad-829920a8d717", "value": "196608:eCE7kGBiB5MekUVgBHbbEPeyO7+s33j42U5TeRmgcklAKjO1C3wy7GBjOmN4U7J8:7buy5RoHL7t3z42lQg0Kx6ZFV8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496604", "to_ids": false, "type": "size-in-bytes", "uuid": "77438cfe-7214-4bd4-a1e2-c4d80711b29d", "value": "14391654" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496604", "to_ids": true, "type": "vhash", "uuid": "ba7f3f25-88d3-4d9d-b860-ef99650f6eed", "value": "a5161c8a4e0ec4a2ff517febeb1e8ba8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496604", "to_ids": true, "type": "filename", "uuid": "5bec2bdf-5c84-4584-9bd5-eb9c02dbc636", "value": "Maxogram (1).apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496604", "to_ids": false, "type": "text", "uuid": "6cb24a27-021d-49d5-9cff-e891688684f7", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:21/66\nFirst Submission:2026-03-02T01:23:05.000000+00:00\nLast Submission:2026-03-02T08:03:47.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499577", "uuid": "684f3d67-7ab6-4259-ae02-7dcfeba557e2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499577", "to_ids": true, "type": "md5", "uuid": "1e5b0fbf-bfa8-487c-9a7c-8209777fb2b6", "value": "3673d505d3050503be6f30eb235afcc4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498014", "to_ids": true, "type": "sha1", "uuid": "db1743fe-246f-4ef0-91a6-16efe30df5d4", "value": "e35893fabebb69483640687d6c43fab7919d46ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498014", "to_ids": true, "type": "sha256", "uuid": "7000c445-a865-4233-be46-03a17ea3ce66", "value": "58ac130a8ebb09e37592ac69841483edc5695d1545b1f04f23d5b760ac17cd94", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496625", "to_ids": true, "type": "ssdeep", "uuid": "2853a93c-3819-4f44-bfef-5abdb5d15423", "value": "98304:QUDTwW/pC91++YS+X8t0lIpBMgYF/OxTYXtLddU+pueNREaHXv:QUDTwFlp+X8WlIwgM/OpYXth4e73" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496625", "to_ids": false, "type": "size-in-bytes", "uuid": "2612e270-8f60-4b58-b9de-24aae32b385f", "value": "5346942" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496625", "to_ids": true, "type": "vhash", "uuid": "e5a8a4ac-0f2a-44c3-81fe-577f79fe7525", "value": "bb63c2117475daa7ebf59efbbe4d967c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496625", "to_ids": true, "type": "filename", "uuid": "52979eaa-809d-4b6b-999e-c69a18fba95d", "value": "58ac130a8ebb09e37592ac69841483edc5695d1545b1f04f23d5b760ac17cd94.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496625", "to_ids": false, "type": "text", "uuid": "d110966b-e048-4af0-9fda-04b4862e857d", "value": "Type Description: Android\nMicrosoft: Trojan:AndroidOS/SAgnt!MTB\nVT Total Detection:21/64\nFirst Submission:2025-05-26T12:46:08.000000+00:00\nLast Submission:2025-08-06T09:06:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499599", "uuid": "d6aac0fa-8e7f-492e-8ad4-3fdc248460bc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499599", "to_ids": true, "type": "md5", "uuid": "4b98e1a6-0498-4845-90b5-c3f9d84a0b88", "value": "38fe4db3b191c2ccb3cd71a36a38b9d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498015", "to_ids": true, "type": "sha1", "uuid": "9fed56ef-7831-4ee3-9dac-f3f74e8ead1f", "value": "ef2f51aa47fdc2372df6d561a3b881da8e518d6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498015", "to_ids": true, "type": "sha256", "uuid": "384d1e98-4d64-46d9-9a34-c393c1f93aa5", "value": "2525d1e427a9983b0b4ca0906a4b44ffb9814b23d53fd8a2e3ab6512b027c733", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496647", "to_ids": true, "type": "ssdeep", "uuid": "003de6ab-4d6a-42b9-9b40-0cbc04396581", "value": "393216:epeREff1oLMwXQxO2urlLWagrMr4BKLaQAO9D1QvRUt:ezn7+Q2rkU4Gz7t+at" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496647", "to_ids": false, "type": "size-in-bytes", "uuid": "0ca75f24-86f9-4506-8b8e-8dd638f36ef9", "value": "14427698" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496647", "to_ids": true, "type": "vhash", "uuid": "e8a282b7-290e-40d9-9aff-2afa29e867dc", "value": "d436b78930a33f4b7d2daa827b4388a1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496647", "to_ids": true, "type": "filename", "uuid": "52fb2f33-6445-4c26-9f34-a2750b0c1014", "value": "ProximusVersie.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496647", "to_ids": false, "type": "text", "uuid": "e977691d-8320-4532-afc5-f8e4c9377b32", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:18/65\nFirst Submission:2026-01-22T10:08:26.000000+00:00\nLast Submission:2026-04-15T17:19:45.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499620", "uuid": "adbc3d84-a4ee-4c84-bc96-9a7eef7a5912", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499620", "to_ids": true, "type": "md5", "uuid": "569ff63c-b696-4dac-976d-63c60ca6f09f", "value": "516e0f3e44924d0a5595b4e28728d291", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498016", "to_ids": true, "type": "sha1", "uuid": "a82283e4-2e0a-4e9a-baeb-4d08b5efa0e9", "value": "8763e26ca6e9db481f49c4f8c15340e3093cae40", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498016", "to_ids": true, "type": "sha256", "uuid": "b9066e86-415d-479b-8020-f8445af353f6", "value": "6101d1e1811db052f869f7eb3402dad28da7e92103d4a44ee43f95846a075012", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496669", "to_ids": true, "type": "ssdeep", "uuid": "7806c605-f881-4a7d-9f63-48e5ae630045", "value": "196608:eGJX8lZfqhR7CvDdp/KCXY48KBwaXi7v4xJQ/WMxANiKb5lMDU:HX8lRq3A5XlwMmvFuEAYK1UU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496669", "to_ids": false, "type": "size-in-bytes", "uuid": "55d79902-cd39-419b-8334-1975a85fe8b8", "value": "14269928" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496669", "to_ids": true, "type": "vhash", "uuid": "7753246f-dbad-4fee-bba1-57e47503719d", "value": "a6ebcfaecfb83e3ebd174c303bc50f64" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496669", "to_ids": true, "type": "filename", "uuid": "baae8e40-0826-4fef-bb39-b03d2dcdc5d7", "value": "com.vqtcho.ekioqxv_12160.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496669", "to_ids": false, "type": "text", "uuid": "569fb8c3-139e-4ee5-9b1a-312abd00339a", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:20/67\nFirst Submission:2026-02-06T12:39:06.000000+00:00\nLast Submission:2026-02-06T12:39:06.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499642", "uuid": "bc3731a3-7cee-4346-83ba-c159e8673f39", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499642", "to_ids": true, "type": "md5", "uuid": "a833626c-d668-46f1-a9cb-aae2c0e59e7f", "value": "53d007e850871473321f3a4f68ab3615", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498018", "to_ids": true, "type": "sha1", "uuid": "2d4dc61c-4ee6-49b2-b719-64eb6c403496", "value": "5798d4eeb49cb3da09e2236ed3606332412e93e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498018", "to_ids": true, "type": "sha256", "uuid": "d16e9d87-bb13-47af-b4ed-c0785241ad19", "value": "f76b13040c634f82a8332ff9443d84c89a5bced51ae9adad7fd15c05fadb4324", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496691", "to_ids": true, "type": "ssdeep", "uuid": "d26d0f9b-6bd9-447e-8919-54c8a6768b5c", "value": "196608:iSonhV3LR8YZuR1e0SmgSi9oU/ZSDGEj+rI5/0zbwEc2r7LPAoHqFvS8ZfW:WnzFkCr7SiSm1Ej//0Pe2r7Loj2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496691", "to_ids": false, "type": "size-in-bytes", "uuid": "d158660c-6718-45a0-9ec0-95dd1e1bb48e", "value": "10843124" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496691", "to_ids": true, "type": "vhash", "uuid": "413537bc-b604-4238-9dfc-be7d75a72ea6", "value": "e04ae1d673e8df0a89ffcb799b60bdb8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496691", "to_ids": true, "type": "filename", "uuid": "cbfaf05f-8834-4d95-9b23-3c28eea952c7", "value": "\u0420\u0430\u0434\u0430\u0440 \u0414\u041f\u0421.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496691", "to_ids": false, "type": "text", "uuid": "fe66ca54-c0f7-48c5-9402-a536abbe3250", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:25/65\nFirst Submission:2026-02-21T01:03:45.000000+00:00\nLast Submission:2026-02-22T06:48:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499663", "uuid": "98980eef-3101-4833-b1bf-e931661a7154", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499663", "to_ids": true, "type": "md5", "uuid": "119de575-674f-42c7-b7bc-0507d3771baa", "value": "54ce4a5145402b10b4660312ffe8385f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498019", "to_ids": true, "type": "sha1", "uuid": "66af1800-d512-4e73-9a8b-0c6087058d73", "value": "606c4427da725b5dd7d399cb3177009e66432cc7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498019", "to_ids": true, "type": "sha256", "uuid": "6c25bd3a-2c64-43ce-9f80-3eab34b991ba", "value": "6ae94ce710016d86ed7457236deef2c4c51478587f3609b6e827a348828b3931", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496713", "to_ids": true, "type": "ssdeep", "uuid": "d47ad546-998e-4f11-849f-587feb75962f", "value": "196608:vCRc12kttvuzxFuy8gh0WOfYm9b+2zABMgOmZ+hVMRDbKXfKpORdsNoEWBatsa8K:aOtUxryWA/E5Z+2vKv1ku/0tsa8ds" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496713", "to_ids": false, "type": "size-in-bytes", "uuid": "4c667dd9-19fc-41a3-9b80-4753a614e9d6", "value": "14771001" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496713", "to_ids": true, "type": "vhash", "uuid": "bd44b93a-1b27-4d90-8dd4-846f60d2f690", "value": "608d19654db05ff32484941ce7b7cf23" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496713", "to_ids": true, "type": "filename", "uuid": "312ab82d-527c-48bf-bc97-e47c41d0843f", "value": "eb5xpm.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496713", "to_ids": false, "type": "text", "uuid": "b66e4dd1-cd0f-41f9-9590-11d37626a31a", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:15/66\nFirst Submission:2025-11-21T16:00:25.000000+00:00\nLast Submission:2025-11-24T09:40:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499684", "uuid": "5390e906-39a5-4a7c-b7f2-e7178b281746", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499684", "to_ids": true, "type": "md5", "uuid": "1c6df706-1977-4619-b4d0-d0f379cdcaf5", "value": "5652ea26835619fdd6b3609326ba9ea0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498020", "to_ids": true, "type": "sha1", "uuid": "d2af781a-d281-4393-8f4e-d073c24cb871", "value": "6cc79ccdcf6a1fd08d69479f830f85a258152abf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498020", "to_ids": true, "type": "sha256", "uuid": "f0498bd6-51ae-4254-ae55-c2a86d555762", "value": "168f50bf9a87099094ef410e3ac33e676a6a8740a5437cd09e7b63d73df8431a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496734", "to_ids": true, "type": "ssdeep", "uuid": "57bfbfe7-cdcf-4f0d-8125-0b308485b491", "value": "196608:7P+Rj0jrZfj0L416BpAi+CWIqUMVPZwuP6a0fH9PnXBI1Anze:7GaBGH+1IJMVB7gfFnX07" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496734", "to_ids": false, "type": "size-in-bytes", "uuid": "c88d0595-f087-4ca6-ac2d-f837549be320", "value": "12289051" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496734", "to_ids": true, "type": "vhash", "uuid": "6634a4bd-711b-4d2f-8d3d-793e89f67450", "value": "a80a673d27810be64746de6702bd3aff" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496734", "to_ids": true, "type": "filename", "uuid": "982e03f7-3b1a-44fd-aa4a-6e77d93b5657", "value": "AdobeAcrobat.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496734", "to_ids": false, "type": "text", "uuid": "4d42236c-3cf8-4ea2-9dfb-2d5f76196321", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:23/64\nFirst Submission:2026-02-04T13:24:18.000000+00:00\nLast Submission:2026-02-06T09:56:29.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499705", "uuid": "a1006c48-5bb4-4bfe-896d-68d570a62a18", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499705", "to_ids": true, "type": "md5", "uuid": "14ef14be-01dc-48a9-a532-95b69beb1cab", "value": "61c30bd7eb4914eb9419661af821944c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498021", "to_ids": true, "type": "sha1", "uuid": "9d688018-46cf-4b6a-b759-6b8be0e3c461", "value": "99d0bce258388ccce6ead0e4a36d7986c9c431db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498021", "to_ids": true, "type": "sha256", "uuid": "94992c42-e585-41f2-ac60-163ae24fce98", "value": "d55057cd9110d12a192281356f06b94f342b9febb305cf0a5898a7e6af40758f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496756", "to_ids": true, "type": "ssdeep", "uuid": "8983b530-931a-4293-8aa8-b0e8ecb99743", "value": "196608:WawsJTacnmL74+0WA2q0mEwHfgeSz0IMM3LNOoDjwpXC0K1lgibgdhlN:WaNTacnm4KUEwIlz0JM3LNEilgnN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496756", "to_ids": false, "type": "size-in-bytes", "uuid": "43a058eb-b0e9-4365-9d2c-1b99d47a10c1", "value": "11564034" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496756", "to_ids": true, "type": "vhash", "uuid": "be38e894-62c9-4f07-a5cb-3e5642250865", "value": "fbacf826511c1974c05656f083a46610" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496756", "to_ids": true, "type": "filename", "uuid": "ff54aebc-deb8-4bb9-9f2c-79a4fa0f8b66", "value": "olf98i.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496756", "to_ids": false, "type": "text", "uuid": "b2c2a9ce-0322-4c60-b9ae-a06024441847", "value": "Type Description: Android\nMicrosoft: TrojanDropper:AndroidOS/Multiverze!rfn\nVT Total Detection:25/66\nFirst Submission:2026-01-05T22:35:10.000000+00:00\nLast Submission:2026-01-05T22:35:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499726", "uuid": "6f9601e6-ee10-4608-bf20-1446db4ba0d0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499726", "to_ids": true, "type": "md5", "uuid": "efbd4b9c-72ba-4cea-97e8-e3ac027f5676", "value": "7881c012c247d29dbf43b05c8b042cc1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498022", "to_ids": true, "type": "sha1", "uuid": "9af7bf79-7f00-4dd1-bd71-383795971a5d", "value": "fda4e742ead8a0492c2d7cb61f256f1f400af06f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498022", "to_ids": true, "type": "sha256", "uuid": "6dbea550-9d30-426d-b176-ac161989aa08", "value": "75dd4fb011ed598374a46fc0d9c0d1d64a298341c34afc83a56a6983cfd27764", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496778", "to_ids": true, "type": "ssdeep", "uuid": "7187185f-a3ec-48ea-b1a2-5c10cea64f78", "value": "393216:UOaIi8v2qWkn+7T3x/Lb6pfJGVuU4vpFZMjSSnqUQ1FvFwmsOmw3gMCMIK:mIP+on+P3x/H6plbxFZwS+QLGmN+M9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496778", "to_ids": false, "type": "size-in-bytes", "uuid": "68252cad-a412-4678-aaf0-3186297f575f", "value": "21764090" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496778", "to_ids": true, "type": "vhash", "uuid": "4b534a57-cd49-46e5-ac63-904ca73fc6e4", "value": "36f0b9f02c55cc5b674b2cd6f37d8924" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496778", "to_ids": true, "type": "filename", "uuid": "9c0433d3-3036-4c2f-be9e-a4c21610172d", "value": "75dd4fb011ed598374a46fc0d9c0d1d64a298341c34afc83a56a6983cfd27764.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496778", "to_ids": false, "type": "text", "uuid": "e2061d5d-54fe-4bcd-8167-0b5c60f2d025", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/66\nFirst Submission:2026-01-17T00:44:57.000000+00:00\nLast Submission:2026-04-24T21:15:57.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499747", "uuid": "f72e799b-a6a2-4370-9dc7-13a2ef3e8659", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499747", "to_ids": true, "type": "md5", "uuid": "36bed842-cf68-4ff4-9c0e-bcd8e53d8c21", "value": "7db5fb56b60db0077b86e00eeff37394", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498023", "to_ids": true, "type": "sha1", "uuid": "5feed44e-0dcf-4c49-a11e-2c00bfd2cad9", "value": "79e9925c155be31a917aa595ca1a41dd46486259", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498024", "to_ids": true, "type": "sha256", "uuid": "a34b61c1-7963-4fb0-baae-acddc6aacf28", "value": "ddce0219923d152b8facd303f058a6286cf1f6924992b9fb9f5bf4d96436cc39", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496800", "to_ids": true, "type": "ssdeep", "uuid": "22ad45b6-827a-4e5c-9ec3-9850069dda46", "value": "196608:lxwsJTwcnFzXKlc5EHrg39rJ62tA44lCs1qeP+mDd3B58EjHMAA2v8lyibi:lxNTwcnFzuc5/9rJ62ezhjR5hTMtf1u" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496800", "to_ids": false, "type": "size-in-bytes", "uuid": "00010e8a-553d-43c6-9f7f-8e83be0c7a7c", "value": "11633666" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496800", "to_ids": true, "type": "vhash", "uuid": "54d83d90-ec6e-4db9-b0bc-dd363c08b33f", "value": "fbacf826511c1974c05656f083a46610" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496800", "to_ids": true, "type": "filename", "uuid": "fca51cf1-9935-432c-8819-696fbc4bac54", "value": "7zyqdcqw.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496800", "to_ids": false, "type": "text", "uuid": "729d3d56-b4cd-458b-8d1a-7b2be7458d46", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:24/66\nFirst Submission:2026-01-04T15:24:35.000000+00:00\nLast Submission:2026-01-04T18:02:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499768", "uuid": "0e20dfaa-f692-480f-9a9f-3296359048e3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499768", "to_ids": true, "type": "md5", "uuid": "e4e1ca34-17ee-431c-9ae5-83491660b71e", "value": "7e2ab284b1068420178f0ced7895c064", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498024", "to_ids": true, "type": "sha1", "uuid": "d53c8ff3-5710-4a4b-9595-3b5473c8b2ac", "value": "91d17bf2241eb10deb245c9ce8eda6e39a18b3d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498024", "to_ids": true, "type": "sha256", "uuid": "c577e401-13b9-484d-88eb-a5a42ba6a029", "value": "7ac974899e8e05aaacd417577c97e382d5e8c5f7f4a85632cffb47ec2f6ae4e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496822", "to_ids": true, "type": "ssdeep", "uuid": "c1ea065e-66a6-4e96-bbce-06abd16fb151", "value": "196608:aN8xm2Xkzx7ejYqAcD8DeLGdmgpNSdGBoheXvx9Q6vWmowrL:a2m2Xkz9cD8U/gpNSAECxJWmx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496822", "to_ids": false, "type": "size-in-bytes", "uuid": "2f98e566-ae8d-4b86-a500-542c1a52b6ad", "value": "12297661" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496822", "to_ids": true, "type": "vhash", "uuid": "82fc413e-2806-4a6c-b3b4-41e8cc045d92", "value": "a80a673d27810be64746de6702bd3aff" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496822", "to_ids": true, "type": "filename", "uuid": "9f1aa826-b7fc-4a28-9f02-84d03eb5b57c", "value": "tl1le34.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496822", "to_ids": false, "type": "text", "uuid": "3ebda282-9a5d-40df-bfb6-69a3c41c8270", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:22/65\nFirst Submission:2026-01-30T06:15:39.000000+00:00\nLast Submission:2026-01-30T06:15:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499790", "uuid": "0ef125f8-95a6-47a2-b185-7d05ba7ebf45", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499790", "to_ids": true, "type": "md5", "uuid": "0528edb5-1a7c-432c-8cf6-5094f37986d3", "value": "7f493c8b8c3a1117c90e1f679c782d42", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498025", "to_ids": true, "type": "sha1", "uuid": "1f7599bc-a5ef-4d05-bdc9-3dbdec4c8c97", "value": "015259747ddb8f227fe56a6d12b0fc7f0dadd20e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498025", "to_ids": true, "type": "sha256", "uuid": "632291d2-713f-456b-9bee-f4d534f1d428", "value": "e5a9fdff900dd502e8f3dce52d2d1b69aa9afafb5094a28f9037e8770db0e63b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496844", "to_ids": true, "type": "ssdeep", "uuid": "ede98480-f913-453e-885c-9cc318ca48eb", "value": "49152:vnd3iQbqj7iq+vPOxWiVUPScpehyiKcn9zygiv3Rl3:P9PbqjL+vP4Uatyhcn9zav3Rl3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496844", "to_ids": false, "type": "size-in-bytes", "uuid": "e32c590b-a12d-4b4b-9d51-6087e93e64b0", "value": "2090957" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496844", "to_ids": true, "type": "vhash", "uuid": "6cc07653-c3e4-4a19-b361-a13355afcea4", "value": "7d0793a4d1be92765e087ccc3d45a807" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496844", "to_ids": true, "type": "filename", "uuid": "f62b0f46-81f7-4936-bb26-f7d210d53297", "value": "download-apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496844", "to_ids": false, "type": "text", "uuid": "74dda12a-025b-4226-a68c-4d749baf7cb4", "value": "Type Description: Android\nMicrosoft: Trojan:AndroidOS/SAgnt!MTB\nVT Total Detection:21/66\nFirst Submission:2025-11-20T17:06:20.000000+00:00\nLast Submission:2025-11-21T22:14:38.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499811", "uuid": "edf7c243-9b0f-4bee-bed3-620db180b04f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499811", "to_ids": true, "type": "md5", "uuid": "4e05f8fd-2756-4f72-837d-72d04f7dc1f8", "value": "9989b5cf30f42f3ac013b5fb4c898b07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498027", "to_ids": true, "type": "sha1", "uuid": "f5e97cb5-82d5-4836-9d2e-7f903c66a3ba", "value": "1cb0d3de945cec63dc0cd00cb4404d48079e565b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498027", "to_ids": true, "type": "sha256", "uuid": "eaff10d5-189a-40e4-bbc4-edb882e7b43f", "value": "6bba64fa9e8a7b11cb2476cd071de08986db44b0783eff211c68fa5594ef8143", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496865", "to_ids": true, "type": "ssdeep", "uuid": "77b92021-fd54-455a-ab50-3d94b9df6605", "value": "98304:qCnPC0J7HCQyaz8ytSJ5gginrXmX0tI7o/KrRxeMIdT:qyL9BSTgdrWodT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496865", "to_ids": false, "type": "size-in-bytes", "uuid": "ad1bbe6f-6f17-4f3e-b128-847e6ff4d755", "value": "5255095" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496865", "to_ids": true, "type": "vhash", "uuid": "8fbde8e0-3ae6-4223-8f5c-a52fc5c70777", "value": "d93a8352fbc6697ee41b7d6baace8c79" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496865", "to_ids": true, "type": "filename", "uuid": "569d11f0-c834-4c91-8c27-99a658e08c5f", "value": "6bba64fa9e8a7b11cb2476cd071de08986db44b0783eff211c68fa5594ef8143.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496865", "to_ids": false, "type": "text", "uuid": "107a7b16-1110-4a3b-b263-d053ebdbf26f", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:30/66\nFirst Submission:2025-10-23T07:23:42.000000+00:00\nLast Submission:2025-12-18T13:29:59.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499832", "uuid": "a16f1681-6a04-4ed7-8ade-9fa0dfad22eb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499832", "to_ids": true, "type": "md5", "uuid": "1f4bc140-97d9-4cbc-9a79-4cb36902a2a4", "value": "a4bd7b38313d8cd94e76a48b83683f57", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498028", "to_ids": true, "type": "sha1", "uuid": "fef2ec9f-f472-4501-aa4a-f245f822e0cb", "value": "0198883f685b52ff5adf0f7d2e64adbbf3c9c9da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498028", "to_ids": true, "type": "sha256", "uuid": "e07937b1-acf8-4c64-8fa2-758aa6edcca3", "value": "6f9832ebb4c3054bee4a6ce5ccb69c00e2020053e1308353343097e6a4041109", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496888", "to_ids": true, "type": "ssdeep", "uuid": "692c2abe-4a10-4c4c-bd6b-05212216b04c", "value": "196608:rMYWLD2yGfWvcqu0srnP3XXR7KHu5B79LtQUqfyVjqagYn2PmMYY:xzjP3XXR71LtSEjIPm+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496888", "to_ids": false, "type": "size-in-bytes", "uuid": "0ddc3956-b996-4042-8948-9242c1bdb802", "value": "12263277" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496888", "to_ids": true, "type": "vhash", "uuid": "754bb79d-e4a0-4d70-aad9-3b1369c951c6", "value": "a80a673d27810be64746de6702bd3aff" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496888", "to_ids": true, "type": "filename", "uuid": "4db90d06-5070-44a3-a293-ab7ea97b7d0d", "value": "h44cdo7zk.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496888", "to_ids": false, "type": "text", "uuid": "b24cfd37-4f9d-4089-b6a4-5ec2202f5052", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:23/65\nFirst Submission:2026-01-26T10:03:16.000000+00:00\nLast Submission:2026-01-26T10:03:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499854", "uuid": "f88db771-731e-4058-96c4-04e222fec804", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499854", "to_ids": true, "type": "md5", "uuid": "ffc263b6-ed24-4a28-b420-6c92d9345d96", "value": "a7a5c56f3549a65fe18ed356c56c595a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498029", "to_ids": true, "type": "sha1", "uuid": "32bd52d8-d257-4e5f-847c-feee1d60a40f", "value": "8491a0c251ffd9cdbbd9d6bebbe2cb3a430f16e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498029", "to_ids": true, "type": "sha256", "uuid": "f8a3df72-0193-4b51-8867-88045dd84d7b", "value": "5aaaf972c8bf39a98f2748e526de3cc0370ba831997d7d9765cdaba599645c0d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496910", "to_ids": true, "type": "ssdeep", "uuid": "93f8c46a-3043-4a2c-9a86-1dff4dbb84c3", "value": "196608:aFwsJTFcnVFVxEx0YN6h2+cHxkYDJG1sTOKdcaAzw2a4tQrNkN/eK:aFNTFcnVPxEy2+cKMssD8w2aeD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496910", "to_ids": false, "type": "size-in-bytes", "uuid": "5215b071-633d-4b42-a332-caadc1f334b8", "value": "10978306" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496910", "to_ids": true, "type": "vhash", "uuid": "bfc5da54-a792-4dab-8bba-0a133313cf3b", "value": "b9b5ac68e9bd8bbc35e2916d1f9bcda4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496910", "to_ids": true, "type": "filename", "uuid": "d5fb3db7-9d53-49e8-953e-fd6047f9b6b3", "value": "pejrkxc41.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496910", "to_ids": false, "type": "text", "uuid": "980a4fa8-d512-4e7b-b461-376a3dae91cd", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:20/67\nFirst Submission:2025-12-18T18:27:48.000000+00:00\nLast Submission:2025-12-19T06:18:29.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499875", "uuid": "5b93a3ef-dc5a-49ae-bb4c-c9292890d4da", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499875", "to_ids": true, "type": "md5", "uuid": "deddc232-81a7-4384-b3c9-9dfb7ceb65ca", "value": "bb02daf9c37f7cd0df5a2ca0c0c1790f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498030", "to_ids": true, "type": "sha1", "uuid": "1963e818-b961-4b09-abad-fcda737951c9", "value": "a7f68bd1566f67bbddb1a2a10ab093aa1d9366b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498030", "to_ids": true, "type": "sha256", "uuid": "6835cc35-ce89-40ae-8575-215511ab9ba5", "value": "752c1cfe783ed343e470ab95a4843a23872cdc98b7d3ed5633dd6c881c071a14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496931", "to_ids": true, "type": "ssdeep", "uuid": "51a898b3-25cb-4a02-9f43-2db948a94b86", "value": "196608:aAtrh//5Tut47eCNm880dbCqK2WOpaUtIc6O41uEpBV4hmFQ8KLf03UfBxnKHkGh:aN4KIbLWO8IIcFEpBV4xTNfLkh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496931", "to_ids": false, "type": "size-in-bytes", "uuid": "3fc2ee17-5994-41b4-b137-1e8441230d72", "value": "12022575" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496931", "to_ids": true, "type": "vhash", "uuid": "eb76eda1-dac0-4b1c-8418-dc4b601ea98c", "value": "d99a555ca61ffe6d4d01b364487f038f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496931", "to_ids": true, "type": "filename", "uuid": "b44d96ca-5d20-417e-b03d-2fe04dee821e", "value": "m46g5lwy.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496931", "to_ids": false, "type": "text", "uuid": "6240f087-d7f9-4c38-8666-e96b1153c74d", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/66\nFirst Submission:2026-03-13T06:50:00.000000+00:00\nLast Submission:2026-03-13T06:50:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499897", "uuid": "1a26bd0d-97a0-4444-9836-f041c107047f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499897", "to_ids": true, "type": "md5", "uuid": "f461b4f3-8edc-48eb-9b80-4b31747e3719", "value": "bfd7d041bdfb28b62921b64af068ccab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498031", "to_ids": true, "type": "sha1", "uuid": "5e2eab18-2791-4b35-86cc-2e7b58b6ab5c", "value": "7ad568aa207f5bf58b75bbc388c2401b63169eb2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498032", "to_ids": true, "type": "sha256", "uuid": "9598bc40-9e4a-4989-9601-5e328af171a2", "value": "6844ce1539014571360495c6fb50965e813c2721663bdd40d577d9e5163773c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496953", "to_ids": true, "type": "ssdeep", "uuid": "f8200ad9-3939-4902-a810-356c67f57edb", "value": "196608:JZtreXd17TxzrfTErLZlvGETploACrAYzdaXxmQzBZqqoZYV3/FQCBKHxjzv0:J81xrbGLLvdp0lRaXxJzXqad/FQCwI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496953", "to_ids": false, "type": "size-in-bytes", "uuid": "dbba468b-b11b-4fa0-8ecc-e0ba37d73bc0", "value": "12010287" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496953", "to_ids": true, "type": "vhash", "uuid": "da957c5e-f5db-49b2-bd89-b2d1507f54bc", "value": "d99a555ca61ffe6d4d01b364487f038f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496953", "to_ids": true, "type": "filename", "uuid": "36415ab0-a03f-4085-a00c-582ca6e6c996", "value": "1lagfjq25.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496953", "to_ids": false, "type": "text", "uuid": "aadb2d41-f337-4651-a9ca-5ea34f2db7b7", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:21/67\nFirst Submission:2026-03-16T07:44:59.000000+00:00\nLast Submission:2026-03-16T07:44:59.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499918", "uuid": "b371d898-3f6e-4df9-a6db-1d8d010defcc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499918", "to_ids": true, "type": "md5", "uuid": "17f40cc2-f76b-457f-9d44-65024b3149cf", "value": "c09e71fca97d609f48b0de1ffd669454", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498033", "to_ids": true, "type": "sha1", "uuid": "0d08d7df-6f74-45ad-aba0-30610f9af3b7", "value": "4038a93e767eac600e344ad9707a1c4643f0cb4b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498033", "to_ids": true, "type": "sha256", "uuid": "54fea3d5-54e1-4157-8c30-06ad81415e5a", "value": "02a52c4cc11748d44c9b49d508ee4e46425661981fa1406f30ec0830cb69ddc5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496976", "to_ids": true, "type": "ssdeep", "uuid": "2da04778-f788-4207-a82a-482f59d5f395", "value": "196608:OWnuP9NjkTucRv7YTWj5V1DWdsE60Ozn4P/0wfqip20BCvIeoGBvGmxAMz0PR4j5:OWn2jyfRvMoOQb4P/0tlvT/MPR4jLF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496976", "to_ids": false, "type": "size-in-bytes", "uuid": "72aae707-4a67-4ea1-9051-04f4a4aa7bfb", "value": "14360353" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496976", "to_ids": true, "type": "vhash", "uuid": "9249b933-5ade-4945-85a5-2e36c53df3f7", "value": "d436b78930a33f4b7d2daa827b4388a1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496976", "to_ids": true, "type": "filename", "uuid": "4e2edd0a-bf07-4e9e-b30e-062a464a7323", "value": "qwerty.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496976", "to_ids": false, "type": "text", "uuid": "0b683937-c429-4bad-9f46-80559b35e214", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:26/65\nFirst Submission:2026-01-25T09:29:42.000000+00:00\nLast Submission:2026-02-12T06:43:57.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499940", "uuid": "80746b75-635f-4077-9158-3896f05bdfb9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499940", "to_ids": true, "type": "md5", "uuid": "ad25522e-ea80-4225-baf3-da03d62e17c7", "value": "cd882f00cb63cfb382a4fa6013705ca6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498034", "to_ids": true, "type": "sha1", "uuid": "577ed746-d0df-409a-81c8-86bb72fc8d04", "value": "8954f531421de2a8e9faa1857924a91963c2ce62", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498034", "to_ids": true, "type": "sha256", "uuid": "7f3122b7-a507-4af4-abfa-fdfab1975ae3", "value": "c99139b0053c4c698ea0246d26d747f2a984c7aba4613da818ecd9f97899ef3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780496997", "to_ids": true, "type": "ssdeep", "uuid": "d2b0396e-06da-48b8-899b-49bc2dcb0eb1", "value": "196608:ScY71zcuHT3Pnk+iHsROnl9g0emHA+JuhyX6WzJ:01ogT3/zjSltNhuhtM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780496997", "to_ids": false, "type": "size-in-bytes", "uuid": "237be551-dd39-4a13-a077-c38ebc24d5e9", "value": "13369851" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780496997", "to_ids": true, "type": "vhash", "uuid": "6822f35a-e75a-40a6-860a-d7de1135d232", "value": "c459aeea6b47595513b257205fc8b346" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780496997", "to_ids": true, "type": "filename", "uuid": "09f8539a-1460-416c-b05f-da6251753544", "value": "Maxogram.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780496997", "to_ids": false, "type": "text", "uuid": "a2760f2b-c6d0-4418-8235-2b24e50f3e06", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:20/66\nFirst Submission:2026-02-23T20:46:41.000000+00:00\nLast Submission:2026-02-24T09:05:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499961", "uuid": "fde13967-37c5-4eaf-b70d-46142d20689f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499961", "to_ids": true, "type": "md5", "uuid": "7276b949-e980-4fd7-ace9-9701b1bb4437", "value": "d15a9b899b55b379933871ffb303613a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498034", "to_ids": true, "type": "sha1", "uuid": "03035f66-2a96-48fe-b1cf-f3b4948ecd8a", "value": "96f3b957f46d4ccea82b9d2ee0f5bbdc3d97d01b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498035", "to_ids": true, "type": "sha256", "uuid": "ed4cd942-b619-4690-8a9a-c799ff07c039", "value": "97a0497de585d3be6ec75064ab3bd0979cd85561193c1f0669ccf4db31330687", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780497019", "to_ids": true, "type": "ssdeep", "uuid": "0684d7c1-43ea-4a05-8d35-12d1ec2b8b70", "value": "393216:G5vaumaNB7do3CPmJwnWQRTXeNB11JqzRD:GkuJb76bmnWqXk/W" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780497019", "to_ids": false, "type": "size-in-bytes", "uuid": "346fba6e-70bc-4686-a74b-50e44bfe072a", "value": "14277441" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780497019", "to_ids": true, "type": "vhash", "uuid": "12dab807-a516-4802-8753-102e7000b835", "value": "0e1d1fb45c2cad633a2debd9dc7272b1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780497019", "to_ids": true, "type": "filename", "uuid": "56f5c076-504d-4ef0-a45c-938351e4d08e", "value": "erk5kgsw.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780497019", "to_ids": false, "type": "text", "uuid": "49f2400d-3f64-4024-8f8b-489b14b4b618", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:20/67\nFirst Submission:2026-02-10T12:55:59.000000+00:00\nLast Submission:2026-02-10T12:56:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780499982", "uuid": "877c3855-87ba-4b98-8df9-7f9299ed322c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780499982", "to_ids": true, "type": "md5", "uuid": "53a47514-33b5-4042-8724-f9f0f5f7473e", "value": "d46ba296b0a3894b04597a7c4cd731c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498036", "to_ids": true, "type": "sha1", "uuid": "5e5e68e7-3b81-49ee-b25e-6576b4509f52", "value": "72b086db438d2cf2574b3ecd62c022fea7b85c36", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498036", "to_ids": true, "type": "sha256", "uuid": "7f7998fa-a69d-41b9-839d-9b13eeb4e9bd", "value": "8f09274e808e0063d51f34cac82a5770b3df30c792e426da2f6a80657f27affc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780497041", "to_ids": true, "type": "ssdeep", "uuid": "3c6d96a8-b935-4af8-b695-d8f14a7c64cf", "value": "196608:NyMclbn23DxZ8obPuAx+2hPfq8nHlx2NNjzk43xY3sRZ:IM4bjULx+2lJnHl+Bzk4fZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780497041", "to_ids": false, "type": "size-in-bytes", "uuid": "6be5fa5c-f345-406f-b509-97a7fe0e222c", "value": "13740375" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780497041", "to_ids": true, "type": "vhash", "uuid": "b6c2af43-d488-45e2-b6ab-4787dca33855", "value": "42c3f21c279fc8e10f6e6a5f603c1b6b" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780497041", "to_ids": false, "type": "text", "uuid": "b2a424ad-b912-4de9-bbd2-a9a13dcecfb8", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:19/66\nFirst Submission:2026-02-27T05:51:44.000000+00:00\nLast Submission:2026-02-27T05:51:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780500003", "uuid": "05de54dc-3cd5-4bca-8107-9268e8aec452", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780500003", "to_ids": true, "type": "md5", "uuid": "c19ed72b-46a1-44cf-bfa2-cf3afb0d6540", "value": "dbd8934e2e80890a7067097079a40182", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498037", "to_ids": true, "type": "sha1", "uuid": "b1fd4172-c4d6-4f6c-b92f-4f633585a1ff", "value": "5cf24613f0c98f8bf7f90a8da6e028c62a2d0a76", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498037", "to_ids": true, "type": "sha256", "uuid": "cea0eded-a189-411b-9237-fb82347bcce7", "value": "a892f1ef2e530d67bf948a48c734da3f27718eb8b883ca0b686ddb0a81071731", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780497063", "to_ids": true, "type": "ssdeep", "uuid": "1e5a72d5-8276-46a6-a184-0ca82846cf03", "value": "393216:MBteYUPvEK4k9NHHkkQDTXPIRPaFf7dl1d:M7eYUHEK4uhEkQDTARYfpl1d" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780497063", "to_ids": false, "type": "size-in-bytes", "uuid": "fe72a99d-c065-4dad-b5b6-68f98903ed41", "value": "13841588" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780497063", "to_ids": true, "type": "vhash", "uuid": "02855714-929f-4d30-8653-44ec031ce0d4", "value": "5b69d26ed866f0608e8c6cb7f446d941" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780497063", "to_ids": true, "type": "filename", "uuid": "3071c8a4-80e9-4406-8d59-57e0c0f75109", "value": "\u041f\u0443\u0442\u0435\u0432\u043e\u0439 \u041f\u043e\u043c\u043e\u0449\u043d\u0438\u043a.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780497063", "to_ids": false, "type": "text", "uuid": "9ebc35c2-7c5b-42e0-8097-3d399451062d", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:24/67\nFirst Submission:2026-03-10T12:33:32.000000+00:00\nLast Submission:2026-03-10T13:14:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780500024", "uuid": "02d7a205-20f9-4c6c-b120-fe1f67f5ac2f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780500024", "to_ids": true, "type": "md5", "uuid": "6392c454-cc08-47c7-9efd-3d3116f6bb2b", "value": "434e9e0e6ccbf20172f31aab63586ea7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498039", "to_ids": true, "type": "sha1", "uuid": "d058ea60-3dfe-422b-afc8-b6bda4920130", "value": "47ebf1f0ce0f93794b5db80e2a367fcb00fc9bff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498039", "to_ids": true, "type": "sha256", "uuid": "131ba198-4fe3-4f47-a71b-be4b0bd4bfc6", "value": "244d81fd9908cd17815501d4edadeb1baf1c421aa25d8bd61c7cb481c939540e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780497105", "to_ids": true, "type": "ssdeep", "uuid": "d32d0d96-c3c2-4d45-8e2d-187b4daffdf7", "value": "768:B3DmMkdrbbbbbbLBdQb32y2DWdrbbbbbLB41U:BCrbbbbbbLB+rbbbbbLBz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780497105", "to_ids": false, "type": "size-in-bytes", "uuid": "13948b58-c8a5-42a0-82d3-388c76d02b5a", "value": "75445" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 03/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780497105", "to_ids": false, "type": "text", "uuid": "65e71a16-5294-4b99-917a-918f277fe0bf", "value": "Type Description: HTML\nMicrosoft: None\nVT Total Detection:9/61\nFirst Submission:2026-01-19T12:52:36.000000+00:00\nLast Submission:2026-01-19T12:52:36.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780500045", "uuid": "b1f6bc88-053f-4435-9470-d9d8d930e6ba", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780500045", "to_ids": true, "type": "md5", "uuid": "05cf2b54-1e02-459e-ac36-099805fee903", "value": "6377be88ba0ef67fb6ffab49c32ccfad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498040", "to_ids": true, "type": "sha1", "uuid": "833cfa77-3b47-4cb8-aa2e-75981c34eff9", "value": "e1e5af28ab858893c9baec1e0d7f2f199f97f56b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498040", "to_ids": true, "type": "sha256", "uuid": "639890ef-d8cf-4d0e-89b3-6c2b3b63713a", "value": "26a2268281e8043125ef72b92f8980b42912048753d56894bc378fb54c7c188a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780497127", "to_ids": true, "type": "ssdeep", "uuid": "47c60777-2f5f-4f03-b3be-5e80443a83ff", "value": "98304:zTJg3oy8h79GOSWBAm9Ih0tgUo/KrRd+HE8dsH:xs8hB5XI+Eze" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780497127", "to_ids": false, "type": "size-in-bytes", "uuid": "61967975-8d6a-4786-918b-7d8ef04c3791", "value": "4433077" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780497127", "to_ids": true, "type": "vhash", "uuid": "a28eb518-02cd-4185-b686-6b91058e4238", "value": "d93a8352fbc6697ee41b7d6baace8c79" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780497127", "to_ids": true, "type": "filename", "uuid": "5268b8ad-8751-42ce-969d-1d15a52636dc", "value": "0wgzr.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780497127", "to_ids": false, "type": "text", "uuid": "95a8bbef-6f1a-4ac5-83db-627d23be8b16", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:17/66\nFirst Submission:2025-11-17T14:35:31.000000+00:00\nLast Submission:2025-11-17T14:35:31.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780500066", "uuid": "cea511cd-a867-4023-8191-c560d3fe1364", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780500066", "to_ids": true, "type": "md5", "uuid": "73e86c56-9dca-4e5d-b495-a8d80cce93db", "value": "589ac68824823649437f4ca3e03e94f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498041", "to_ids": true, "type": "sha1", "uuid": "29d4118e-94e5-411e-91dd-906c69db9f06", "value": "1c085c7663518f499396cbe95b5613ca8e46a011", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498041", "to_ids": true, "type": "sha256", "uuid": "8595bb94-6a1a-4b52-b177-ebd0009f08db", "value": "512ede9f2fa794907999f3c26165557fdfd383b7aad71ba022ce2c8ba6c0019d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780497149", "to_ids": true, "type": "ssdeep", "uuid": "86d1f1aa-d197-4040-bdb2-12ea4ceaf7b9", "value": "393216:ueLwtQcniI/m88P2+bEAk7VsmdlyALls/EZSZh5:dbim842wEH7VsUL2/V" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780497149", "to_ids": false, "type": "size-in-bytes", "uuid": "32d9e75d-3fa2-4499-aa14-2051a1e27d0f", "value": "13493250" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780497149", "to_ids": true, "type": "vhash", "uuid": "a433aaa6-1811-41f9-9be4-146ed155545e", "value": "fbacf826511c1974c05656f083a46610" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780497149", "to_ids": true, "type": "filename", "uuid": "f2288560-f2a3-45fc-ad8a-9906a88e9957", "value": "Radar DPS.apk" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780497149", "to_ids": false, "type": "text", "uuid": "43a2bbd7-ad6f-47b4-8a0f-f6a350ddb0db", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:23/66\nFirst Submission:2026-01-30T05:58:34.000000+00:00\nLast Submission:2026-01-30T06:01:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780500088", "uuid": "fad6bd1d-d58b-4617-9411-79020258e272", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780500088", "to_ids": true, "type": "md5", "uuid": "8b708667-7888-4ec7-9a30-7ae67c1d15b7", "value": "f20ba894c80e68c9324e211565319523", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780498043", "to_ids": true, "type": "sha1", "uuid": "afe5d6b3-11f4-481f-bbcc-54351c66c1c1", "value": "c4ed9c1043b924f1739f57a66731336beb8378c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780498043", "to_ids": true, "type": "sha256", "uuid": "f7b85d2b-32d0-48de-99c7-aa578b0a5cf2", "value": "998a7ed1572ad9dc11375bc25294e1954e606b7cff9fabc5c120713e597cd274", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780497213", "to_ids": true, "type": "ssdeep", "uuid": "86b8da1b-9bc4-4c0c-a51e-4fa90c2840da", "value": "196608:ZCsJeLHPcnLXSdM70JBI1Z9sZXuBT777d6I/5zj2EsPIEg+a9Yq8qEOarLZ9rf93:ZreLHPcnGLG1Z9sZy6I/5SIEva9YV/fZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780497213", "to_ids": false, "type": "size-in-bytes", "uuid": "265ee620-158c-49e6-8cef-b10739b191fb", "value": "12354562" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780497213", "to_ids": true, "type": "vhash", "uuid": "9c264a6c-76d4-407b-8bf3-ef9418b8ff93", "value": "fbacf826511c1974c05656f083a46610" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780497213", "to_ids": true, "type": "filename", "uuid": "17429bfb-f2c5-458f-ac72-cfefac680661", "value": "zbhj34lba.exe" }, { "category": "Other", "comment": "Checked: 03/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780497213", "to_ids": false, "type": "text", "uuid": "a46de538-2e87-401d-8bd5-d84bd50866f3", "value": "Type Description: Android\nMicrosoft: None\nVT Total Detection:16/66\nFirst Submission:2026-01-15T05:47:13.000000+00:00\nLast Submission:2026-01-20T06:02:34.000000+00:00" } ] } ] } }