{ "Event": { "analysis": "1", "date": "2026-06-23", "extends_uuid": "", "info": "[Threat Intel] A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally", "protected": false, "publish_timestamp": "1782454626", "published": true, "threat_level_id": "3", "timestamp": "1782454626", "uuid": "1020917f-50ab-45f2-b524-d364ac9d122a", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#177fb7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#8b05c0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Audio Capture - T1123\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#ece0df", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Video Capture - T1125\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#4bc785", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#44b2c2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782270012", "to_ids": false, "type": "link", "uuid": "e1736c48-4910-46c2-a3b8-3ee1942c4132", "value": "https://labs.k7computing.com/index.php/a-multi-stage-steganographic-loader-campaign-deploying-diverse-payloads-globally", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782270012", "to_ids": false, "type": "text", "uuid": "4ff8887d-cbe9-4c5f-aea5-1c7834a28cb6", "value": "A sophisticated phishing campaign was identified distributing multiple malware families through a multi-stage loader utilizing steganography and fileless techniques. The infection chain begins with archive attachments containing files disguised as financial documents, primarily targeting Indian organizations using names related to GST, NEFT, RTGS, and IMPS transactions. The loader employs in-memory execution to avoid disk-based artifacts and uses embedded .NET Bitmap objects to conceal payloads. Various malware families have been deployed including Remcos RAT, Agent Tesla, MassLogger, Phantom Stealer, Dark Cloud, Red Line Stealer, Snake keyloggers, Formbook, and xworm. The final payloads establish persistence through registry Run keys, perform process hollowing, steal browser credentials, record audio and webcam, and exfiltrate data to command-and-control infrastructure. The campaign exhibits characteristics of a loader-as-a-service operation serving multiple threat actors globally." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782270012", "to_ids": false, "type": "text", "uuid": "94410c01-d71b-4927-ad78-2fb991bb772c", "value": "Name: A Multi-Stage Steganographic Loader Campaign Deploying Diverse Payloads Globally\nAuthor: AlienVault\nAdversary: \nTags: [\"fileless\", \"loader-as-a-service\", \"steganography\", \"phantom stealer\", \"formbook\", \"masslogger\", \"infostealer\", \"dark cloud\", \"remcos rat\", \"phishing campaign\", \"red line stealer\", \"xworm\", \"snake\", \"process hollowing\", \"agent tesla\", \"credential theft\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"India\"]\nMlwr families: [\"Remcos RAT\", \"Agent Tesla - S0331\", \"MassLogger\", \"Phantom Stealer\", \"Dark Cloud\", \"Red Line Stealer\", \"EKANS - S0605\", \"SNAKEHOSE\", \"Formbook\", \"xworm\"]\nAttack_ids: [\"T1113\", \"T1218.011\", \"T1056.001\", \"T1123\", \"T1497.001\", \"T1566.001\", \"T1005\", \"T1140\", \"T1112\", \"T1555.003\", \"T1125\", \"T1083\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1055.012\", \"T1027\", \"T1564.001\"]\nIndustries: [\"Finance\"]" }, { "category": "Network activity", "comment": "Remcos C2", "deleted": false, "disable_correlation": false, "timestamp": "1782360203", "to_ids": true, "type": "ip-dst|port", "uuid": "0e612311-47a0-4e90-a35d-f2a60ca63895", "value": "62.102.148.212|37393" }, { "category": "Network activity", "comment": "Remcos C2", "deleted": false, "disable_correlation": false, "timestamp": "1782360203", "to_ids": true, "type": "ip-dst|port", "uuid": "318b0b6c-9157-4961-add1-1ca8bede2185", "value": "217.138.252.123|42830" }, { "category": "Network activity", "comment": "Remcos C2", "deleted": false, "disable_correlation": false, "timestamp": "1782360203", "to_ids": true, "type": "ip-dst|port", "uuid": "1e607d93-3b82-4457-b9ac-56495300cd8e", "value": "146.70.244.90|37393" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447251", "uuid": "85fd51ad-53ac-42ed-b33e-8cdba81701d3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447251", "to_ids": true, "type": "md5", "uuid": "99cd63d9-fed5-45a9-9832-40c3c730a363", "value": "897abf678edad72998554ec18675092f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445624", "to_ids": true, "type": "sha1", "uuid": "b71e11e9-8b70-42ff-8915-71909a2fe43b", "value": "be36ef651eed6808760153200a3a2a2b7060cce5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445624", "to_ids": true, "type": "sha256", "uuid": "0ddacdd6-3e0d-403f-9e51-4d859467c1eb", "value": "372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782445048", "to_ids": true, "type": "ssdeep", "uuid": "9b753bb1-02e7-4216-8954-87d2779e2a1e", "value": "12288:xgo9w60PqBA0dfSFOrWyziDZUYBPu3bdyY/euBkVaryapVRd:a4nffyU9cYWu+VaO8D" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782445048", "to_ids": false, "type": "size-in-bytes", "uuid": "5db6177f-02b0-452b-b1b9-77d49081806a", "value": "808960" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782445048", "to_ids": true, "type": "vhash", "uuid": "722b002f-50d4-440c-b5d4-48ce68df43fe", "value": "28503675151200822e2862124" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782445048", "to_ids": true, "type": "filename", "uuid": "874025e7-46af-4fe2-8acd-1c1e84030707", "value": "oacY.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782445048", "to_ids": false, "type": "text", "uuid": "348845df-86b5-4503-afd3-1a46dd4e77c2", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:MSIL/Masslogger.AMS!MTB\nVT Total Detection:57/70\nFirst Submission:2026-05-16T18:36:36.000000+00:00\nLast Submission:2026-05-16T18:36:36.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447272", "uuid": "eeae9df9-fcf2-448f-8d9b-2504e806a6c8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447272", "to_ids": true, "type": "md5", "uuid": "5dc046f4-6266-48cd-ba74-f1a7c8ef882c", "value": "afe085b7324d72673eef749ff5f21a49", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445625", "to_ids": true, "type": "sha1", "uuid": "667a230f-9cde-4824-a735-46758650d576", "value": "a86f1039a8877804b1b2c99aed91312846cd40e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445625", "to_ids": true, "type": "sha256", "uuid": "aad59784-4dc4-4786-b374-d45a9babf4fc", "value": "363ee51fc02f20cb206039434758c3afa1c71bc7d316c6db4a39b0d310ab92f9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782445070", "to_ids": true, "type": "ssdeep", "uuid": "484e1b71-ce11-47f7-b9b5-fb83c21e071f", "value": "1536:NE8gZ0sao+KqKEycKwr3ii5Acg+dEPRnbciS:NE9JDpqKEycKwryi6cBj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782445070", "to_ids": false, "type": "size-in-bytes", "uuid": "f57cfcfb-f5a2-40f5-904e-591901401e6a", "value": "71168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782445070", "to_ids": true, "type": "vhash", "uuid": "551c61a8-cf3e-4fdc-862d-fcc532b4d6b1", "value": "37403655151f07113183020" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782445070", "to_ids": true, "type": "filename", "uuid": "671b7174-0b9e-4bad-82b8-aa570ad09834", "value": "OptiMax.dll" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782445070", "to_ids": false, "type": "text", "uuid": "a42e6e5c-7372-4d9c-9750-9913a81664ef", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:39/70\nFirst Submission:2026-05-13T02:27:03.000000+00:00\nLast Submission:2026-05-18T13:00:31.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447293", "uuid": "6c8113da-4673-4346-8a52-1f50bdadafe4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447293", "to_ids": true, "type": "md5", "uuid": "b7e98e79-7bb6-4206-9993-ee44d891e111", "value": "c2e25aba8e2ad4cafdd6c633b8ca0906", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445627", "to_ids": true, "type": "sha1", "uuid": "8a40c28c-c329-49a2-9d24-426be3c67188", "value": "37f861cecc47b173ca005f690bbbb10b8611c6e8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445627", "to_ids": true, "type": "sha256", "uuid": "2f771e66-3e9f-4030-b047-370eda07f87a", "value": "46f57ac6d3ae603fde4c11f0b4b49c9234b45918b34dc225e24ab0958f176e71", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782445091", "to_ids": true, "type": "ssdeep", "uuid": "632c3a4e-aefe-4003-9d1a-2946ade81307", "value": "12288:GLbD3EVtUxWp7fMiJ07Sw7yTsdgQATv1gHa+n6RLMcsQLVB5Po+hhZacpTKJ:Gfst6Wp72S4yWgZZ9ym4gLX5jhZaJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782445091", "to_ids": false, "type": "size-in-bytes", "uuid": "5994b47e-ba35-4961-ad64-b5f4d93ada8a", "value": "752161" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782445091", "to_ids": false, "type": "text", "uuid": "c5ec696f-1583-4f0a-8291-806ab07c36d3", "value": "Type Description: RAR\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:45/63\nFirst Submission:2026-05-16T18:39:19.000000+00:00\nLast Submission:2026-05-16T18:39:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447314", "uuid": "326a8255-8097-4043-b576-90e5a897facd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447314", "to_ids": true, "type": "md5", "uuid": "f51c542d-4797-4858-9f4f-bb249cbfaefa", "value": "4924369c0bdaf73b21eb992eb9db4dea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445628", "to_ids": true, "type": "sha1", "uuid": "790451bb-b80a-4044-b80f-956ae980eab4", "value": "3cdc153ef4767f2022d043758b6e1a35db02c1c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445628", "to_ids": true, "type": "sha256", "uuid": "ff85ed57-9b90-488b-8876-1a2225cd6a6e", "value": "ec8a9737390da2cd6c85585e1bea64c0c9ba3b14d47b0441fcee042386763473", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782445113", "to_ids": true, "type": "ssdeep", "uuid": "e0be41eb-57a1-46e4-a4bf-03a8d54f4991", "value": "1536:3hhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6hrw:RhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+Z" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782445113", "to_ids": false, "type": "size-in-bytes", "uuid": "75f7473f-28be-4208-9a52-abcc7c5132f5", "value": "86528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782445113", "to_ids": true, "type": "vhash", "uuid": "6b79d82e-ce64-4a3f-b9f2-63b3f210314d", "value": "0840466d5d1560f5za004c2cfz50101231z40709595z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782445113", "to_ids": true, "type": "filename", "uuid": "060029c2-2ee3-4e9e-b213-561d15569210", "value": "xec8a9737390da2cd6c85585e1bea64c0c9ba3b14d47b0441fcee042386763473.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782445113", "to_ids": false, "type": "text", "uuid": "db6dfc2b-a2b2-4e0f-8033-2e239c4a1709", "value": "Type Description: Win32 EXE\nMicrosoft: Backdoor:Win32/Rescoms!pz\nVT Total Detection:67/71\nFirst Submission:2026-05-13T18:47:49.000000+00:00\nLast Submission:2026-05-13T21:35:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782447335", "uuid": "43da47b4-8283-4b98-abea-1109049ccbe6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782447335", "to_ids": true, "type": "md5", "uuid": "d12fb330-e0ae-4aa6-8213-f66ae8474bdb", "value": "f3626a38fcf488c9eed54beb8c7c116f", "Tag": [ { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782445629", "to_ids": true, "type": "sha1", "uuid": "53b01d55-aa29-4068-8852-3e586bd3b6ec", "value": "fdf561d56684cebf0fda59229e1264dbff25e6c7", "Tag": [ { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782445629", "to_ids": true, "type": "sha256", "uuid": "a9ead59b-954b-4f66-b281-6892a60b9474", "value": "b63a319115c2a8b74ceebe7fd42b71728f2da696c376d82bf7c3907311ec5b2a", "Tag": [ { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782445135", "to_ids": true, "type": "ssdeep", "uuid": "c195b66f-7b86-40a8-81e9-9ed23385f7c7", "value": "12288:BQseUf2i2/e/lc0wZ9eWpZuc+jwgRYn74S39g:ReUe1ZXgwU6739" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782445135", "to_ids": false, "type": "size-in-bytes", "uuid": "e5d33278-f5db-4e6f-881c-2f19a610625f", "value": "701440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782445135", "to_ids": true, "type": "vhash", "uuid": "8ab94964-b7a1-4ffa-88ee-7f28aed629cd", "value": "375036651516b08c34383470" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782445135", "to_ids": true, "type": "filename", "uuid": "cc7ac16a-57cb-4d4c-bc9e-c8f01d6ca851", "value": "System Optimizer Ultimate.dll" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782445135", "to_ids": false, "type": "text", "uuid": "954d3c10-1f64-4423-b5a1-33b5447c353f", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:49/70\nFirst Submission:2026-05-17T00:03:28.000000+00:00\nLast Submission:2026-05-17T00:03:28.000000+00:00" } ] } ] } }