{ "Event": { "analysis": "1", "date": "2026-06-08", "extends_uuid": "", "info": "[Threat Intel] Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open", "protected": false, "publish_timestamp": "1782398489", "published": true, "threat_level_id": "2", "timestamp": "1782398484", "uuid": "19d42e7a-969a-4f87-8931-af8fecb5aa8b", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#717bc3", "local": false, "name": "misp-galaxy:producer=\"Trend Micro\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#a05856", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#8bde06", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"NTFS File Attributes - T1564.004\"", "relationship_type": "" }, { "colour": "#e4d611", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#1c006d", "local": false, "name": "rectifyq:topic=\"geopolitical\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"GIFTEDCROOK\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781002805", "to_ids": false, "type": "link", "uuid": "f986c720-ad2d-48df-9168-d43586464aa1", "value": "https://www.trendmicro.com/en_us/research/26/f/old-winrar-flaw-fuels-attacks-on-ukraine.html" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781002805", "to_ids": false, "type": "text", "uuid": "0ed5bd57-21f1-4c30-9bc1-e6f0821900b0", "value": "Two Russia-aligned campaigns continue exploiting CVE-2025-8088, a WinRAR path traversal vulnerability patched in July 2025, against Ukrainian organizations through April 2026. SHADOW-EARTH-066 deploys an evolved GIFTEDCROOK information stealer using in-memory DLL loading via direct NT system calls, harvesting browser credentials, session cookies, and documents across 35 file extensions before self-deleting. Earth Dahu employs an HTA-based infection chain delivering espionage modules through Cloudflare Workers infrastructure. Both campaigns leverage the same CVE-2025-8088 exploit but use distinct tooling: SHADOW-EARTH-066 relies on compiled C++ with RC4-encrypted C&C communication, while Earth Dahu uses script-based approaches with Dynamic DNS. The persistent exploitation nearly a year post-patch demonstrates how unmanaged software lacking centralized update mechanisms creates enduring attack surfaces that threat actors deliberately target." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781002805", "to_ids": false, "type": "text", "uuid": "5d4d5911-aad2-4a42-a4f7-e1c573f4508e", "value": "Name: Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open\nAuthor: AlienVault\nAdversary: SHADOW-EARTH-066, Earth Dahu\nTags: [\"giftedcrook\", \"giftedcrook stealer\", \"cve-2025-8088\", \"winrar exploitation\", \"information stealer\", \"ukraine targeting\", \"hta infection chain\", \"credential theft\", \"russia-aligned threats\", \"gammasteel\"]\nTgtd countries: [\"Ukraine\"]\nMlwr families: [\"GIFTEDCROOK\", \"GammaSteel\"]\nAttack_ids: [\"T1539\", \"T1204.002\", \"T1573.001\", \"T1566.001\", \"T1005\", \"T1036\", \"T1555.003\", \"T1497\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1485\", \"T1070.004\", \"T1071.001\", \"T1564.004\"]\nIndustries: [\"Government\", \"Defense\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1781315213", "to_ids": false, "type": "threat-actor", "uuid": "ebc9f23e-f3f3-4afd-b0f6-931fd794ed44", "value": "SHADOW-EARTH-066", "Tag": [ { "colour": "#717bc3", "local": false, "name": "misp-galaxy:producer=\"Trend Micro\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Gamaredon Group\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781002805", "to_ids": false, "type": "vulnerability", "uuid": "acd2b875-6d72-4f08-bd76-0d9e5b913368", "value": "CVE-2018-20250" }, { "category": "Network activity", "comment": "Earth Dahu: Attacker-controlled email sending domain", "deleted": false, "disable_correlation": false, "timestamp": "1781324270", "to_ids": true, "type": "domain", "uuid": "6294f787-0d78-4dd6-ba29-af3158441a1b", "value": "astrocaf.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS61317 digital energy technologies ltd.", "deleted": false, "disable_correlation": false, "timestamp": "1781324291", "to_ids": true, "type": "ip-dst", "uuid": "ca3519ec-a9e3-4e09-98a1-2c377c445292", "value": "166.0.132.237", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781002805", "to_ids": false, "type": "vulnerability", "uuid": "73c95f1a-c52e-4f5b-ae99-f81a1887f7a8", "value": "CVE-2025-8088" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781002805", "to_ids": false, "type": "vulnerability", "uuid": "d1752062-2be4-457b-9ead-1a701dd482f9", "value": "CVE-2025-6218" }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: C&C server (port 9623)", "deleted": false, "disable_correlation": false, "timestamp": "1781324313", "to_ids": true, "type": "ip-dst", "uuid": "a4af55b2-c3a9-42f1-80f7-00f07f7e3bc4", "value": "38.225.209.229", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: Potential C&C server (port 8941)", "deleted": false, "disable_correlation": false, "timestamp": "1781324334", "to_ids": true, "type": "ip-dst", "uuid": "29e74b13-8097-4366-807b-bcddca1d540f", "value": "23.26.237.80", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: C&C server (port 8406)", "deleted": false, "disable_correlation": false, "timestamp": "1781324355", "to_ids": true, "type": "ip-dst", "uuid": "f5d43c85-d827-4366-826f-7e461dfbad82", "value": "136.0.141.138", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: C&C exfiltration endpoint", "deleted": false, "disable_correlation": false, "timestamp": "1781324377", "to_ids": true, "type": "url", "uuid": "9ba7bb93-964a-4f63-a250-7dd3ac4ffa48", "value": "https://136.0.141.138:8406/rcv/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Earth Dahu: IP associated with astrocaf[.]com", "deleted": false, "disable_correlation": false, "timestamp": "1781324398", "to_ids": true, "type": "ip-dst", "uuid": "fffe743f-1de7-4b17-9fbd-6c2d99fe9d35", "value": "194.58.66.82", "Tag": [ { "colour": "#19bb78", "local": false, "name": "asn:asn=\"26383\"", "relationship_type": "" }, { "colour": "#8f7197", "local": false, "name": "asn:as-owner=\"ASNET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS18779 egihosting", "deleted": false, "disable_correlation": false, "timestamp": "1781324419", "to_ids": true, "type": "ip-dst", "uuid": "e45e650d-6ad8-4017-8f45-814e74d866fd", "value": "136.0.141.112", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: C&C server (port 9580)", "deleted": false, "disable_correlation": false, "timestamp": "1781324440", "to_ids": true, "type": "ip-dst", "uuid": "3af3ab74-4706-4340-8ae0-7ba3729c1c5f", "value": "136.0.141.41", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: Potential C&C server (port 8009)", "deleted": false, "disable_correlation": false, "timestamp": "1781324462", "to_ids": true, "type": "ip-dst", "uuid": "552785db-8173-4753-b103-5611ff54ffd6", "value": "38.225.209.122", "Tag": [ { "colour": "#14d0ec", "local": false, "name": "asn:asn=\"149440\"", "relationship_type": "" }, { "colour": "#1b81cb", "local": false, "name": "asn:as-owner=\"EVOXTENTERPRISE-AS-AP Evoxt Enterprise\"", "relationship_type": "" }, { "colour": "#12ee4d", "local": false, "name": "asn:as-country=\"MY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781324483", "to_ids": true, "type": "domain", "uuid": "0727d57d-26be-48b5-a74e-9f7488bf5ce7", "value": "joymobile.com.ua", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of 3c0330f9f934f86b6b70e108ff279a009b88a4a815acbed4adb3664e322e3e59 No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323433", "to_ids": true, "type": "md5", "uuid": "9182e46f-febe-4966-8764-d26a6f75737b", "value": "a84375d4bd67c46d50fef7f7af31c7fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:SHA1 of 3c0330f9f934f86b6b70e108ff279a009b88a4a815acbed4adb3664e322e3e59 No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323434", "to_ids": true, "type": "sha1", "uuid": "6dff4296-53c3-47c2-b750-77d82a1442df", "value": "526833a16669a85f0546809bfc35122e6f0bc17b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323435", "to_ids": true, "type": "sha256", "uuid": "a9309700-22e4-4edc-9824-a462e8ac6f36", "value": "2d9adb7932b7842dfb0e0f453b87e5d28dd4552094105e6340bad009956d8c2b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323436", "to_ids": true, "type": "sha256", "uuid": "e4226453-e403-40e4-ae76-8e93448f8013", "value": "378809699c7252dc38b31969b9cc40858397759f15d6e418246dfaba9088fdd1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323437", "to_ids": true, "type": "sha256", "uuid": "4cbd2bff-ce7e-44aa-97ba-94787f423cb1", "value": "3c0330f9f934f86b6b70e108ff279a009b88a4a815acbed4adb3664e322e3e59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323438", "to_ids": true, "type": "sha256", "uuid": "d90cbd56-b3cf-41ec-bd43-3a596dc414b4", "value": "4e21c4c97aeb391473ee1e44961676f32de2ee8b56ecb136c1d8081df97c3db4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323439", "to_ids": true, "type": "sha256", "uuid": "0e9273fd-e4b8-4816-aea7-e6a67292bd79", "value": "77963398e2c5c2fdf9d28d9c5f9c2791cfbf422ba02225e01635dd7f5b31eff8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323440", "to_ids": true, "type": "sha256", "uuid": "bbb24f8d-fb16-4204-a3a3-04b006151724", "value": "7d3ba419751e5ea52b567e1162f6a366bf3d06c44c8956a9f14520e9fb6ed0b1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323441", "to_ids": true, "type": "sha256", "uuid": "641a1954-3113-4e1a-a86e-8af2c9be63a9", "value": "82fda6ea769d61aba230c3487787087cec53dd378e22f22a8fb8f0bd5ae83ded", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323442", "to_ids": true, "type": "sha256", "uuid": "f43663b9-ba5e-48da-b6b5-1f498e0ac73a", "value": "89d20418450b34efe698bd36214100cfa49f60adf1c39a8bc8d65991b1ce2c23", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:13/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781323443", "to_ids": true, "type": "sha256", "uuid": "e7b2ad57-7abe-4b6e-8431-1f92b2a54f92", "value": "dc5082b07eb994ddee343a4080dce0a9ec2e891e5690654e24ae74ba9eabe422", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Earth Dahu: IP associated with astrocaf[.]com", "deleted": false, "disable_correlation": false, "timestamp": "1781324504", "to_ids": true, "type": "ip-dst", "uuid": "4c5159fc-19da-4ff8-b322-233b18d73fb2", "value": "194.58.66.53", "Tag": [ { "colour": "#19bb78", "local": false, "name": "asn:asn=\"26383\"", "relationship_type": "" }, { "colour": "#8f7197", "local": false, "name": "asn:as-owner=\"ASNET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: C&C exfiltration endpoint", "deleted": false, "disable_correlation": false, "timestamp": "1781324525", "to_ids": true, "type": "url", "uuid": "6b74703d-339b-455c-82b1-4f75b7b1a88a", "value": "https://136.0.141.41:9580/rcv/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: C&C exfiltration endpoint", "deleted": false, "disable_correlation": false, "timestamp": "1781324547", "to_ids": true, "type": "url", "uuid": "06a35202-5425-4083-94c5-1dc26f3e3348", "value": "https://166.0.132.237:7044/rcv/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SHADOW-EARTH-066: C&C exfiltration endpoint", "deleted": false, "disable_correlation": false, "timestamp": "1781324568", "to_ids": true, "type": "url", "uuid": "6ca0ce26-675b-4668-9459-740d9cd3c030", "value": "https://38.225.209.229:9623/rcv/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 7044", "deleted": false, "disable_correlation": false, "timestamp": "1781315262", "to_ids": true, "type": "ip-dst|port", "uuid": "1623cf04-7efe-443e-8351-bf51c1aa69c4", "value": "166.0.132.237|7044" }, { "category": "Network activity", "comment": "On port 9580", "deleted": false, "disable_correlation": false, "timestamp": "1781315262", "to_ids": true, "type": "ip-dst|port", "uuid": "dca3f217-7b07-451d-9dcf-9cc8f7cc8abb", "value": "136.0.141.41|9580" }, { "category": "Network activity", "comment": "On port 9623", "deleted": false, "disable_correlation": false, "timestamp": "1781315262", "to_ids": true, "type": "ip-dst|port", "uuid": "8dd7c99d-5c1d-4251-8b11-4da4fa92e9a2", "value": "38.225.209.229|9623" }, { "category": "Network activity", "comment": "On port 8406", "deleted": false, "disable_correlation": false, "timestamp": "1781315262", "to_ids": true, "type": "ip-dst|port", "uuid": "e2f3686b-2fa7-4253-815f-d90984c58563", "value": "136.0.141.138|8406" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781315458", "to_ids": true, "type": "email-src", "uuid": "abfd35e3-9c97-4612-9c47-72446d8dd0e2", "value": "vodafonenovic33@joymobile.com.ua" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324589", "uuid": "efec90c7-8f4c-4061-a216-d9dcea769835", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324589", "to_ids": true, "type": "md5", "uuid": "ae72aa01-a67c-422a-86c6-373172ff1f78", "value": "c0b73ff43312d442260328a8cefdf3b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323399", "to_ids": true, "type": "sha1", "uuid": "42a666bd-0094-42f5-881d-95db11dc1185", "value": "4528d5cf07bf0e1ac769b390236cab1bf34b938c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323399", "to_ids": true, "type": "sha256", "uuid": "273c7c0f-d42b-4e0b-aece-8cda046d7342", "value": "2a8ea9f1ad8936fb302243faa64b91c5767df411923715cbdb1a869e3bfd7e6d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318436", "to_ids": true, "type": "ssdeep", "uuid": "a8d60621-ac1f-4dd7-b3d0-c44515c3d377", "value": "24576:bPAwUTHcrdwpcqHbCof0fAY1PDtTS1BJk+aVCK9o9y2rht5qJRX5DVgvJV6J:rJUTHcJwpovAY1PDZS1BJk+g8trZq7/m" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318436", "to_ids": false, "type": "size-in-bytes", "uuid": "df3d2ebf-945e-4a15-8001-121756634202", "value": "1117696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781318436", "to_ids": true, "type": "vhash", "uuid": "ed62a6f1-378e-48e4-9934-bb36530d6171", "value": "116066655d755d0550a2z122z76uz226z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318436", "to_ids": true, "type": "filename", "uuid": "467e6c2d-5fa7-46eb-ad29-f1e58c299522", "value": "2a8ea9f1ad8936fb302243faa64b91c5767df411923715cbdb1a869e3bfd7e6d.exe" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318436", "to_ids": false, "type": "text", "uuid": "84cdb586-77a1-4fb2-8d0a-8864187d54dc", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nVT Total Detection:48/71\nFirst Submission:2026-04-09T20:37:17.000000+00:00\nLast Submission:2026-04-11T03:18:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324610", "uuid": "2bae8f35-4da4-4cd9-a23f-f27ca73f2add", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:ALF:AGGR:LinkifierA:95!ml", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324610", "to_ids": true, "type": "md5", "uuid": "c4d942c6-17fc-4152-8bc1-bdd990ff033c", "value": "2af0a6135df3502a7f6de4d2de6db73b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:ALF:AGGR:LinkifierA:95!ml", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323400", "to_ids": true, "type": "sha1", "uuid": "91546b4e-988c-4a23-9bef-1e557c6e562e", "value": "b1c4a94df23638d70dae45f3193a64a6b036056d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:ALF:AGGR:LinkifierA:95!ml", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323400", "to_ids": true, "type": "sha256", "uuid": "8698fa77-307e-4792-b77f-a78bb4fd10e9", "value": "7200a9f1e1ea51b66ab9c9274e9d8f805633179634e8ff4dcb8ef82bc02518df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318458", "to_ids": true, "type": "ssdeep", "uuid": "0073e33e-4840-4286-9249-28006e41c73d", "value": "12288:uLGfum7l/F2gOla3Wvej9xwyOiduNAgYwi7wGK/VpLTru+n08k/Iow4EmQeSary:u9m7j5mv1yzsi7wGK/VpLTa+nI/I/hma" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318458", "to_ids": false, "type": "size-in-bytes", "uuid": "3968ae5b-ae25-40d3-9499-ec46234dd213", "value": "749270" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318458", "to_ids": true, "type": "filename", "uuid": "0925c78c-c69c-4e3f-99e6-9b7d3793fb5d", "value": "7200a9f1e1ea51b66ab9c9274e9d8f805633179634e8ff4dcb8ef82bc02518df.rar" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318458", "to_ids": false, "type": "text", "uuid": "7f11ee97-39ee-4958-ab82-f099d98e017e", "value": "IOC-title:ALF:AGGR:LinkifierA:95!ml\r\nType Description: RAR\nMicrosoft: None\nVT Total Detection:33/64\nFirst Submission:2026-04-09T09:20:07.000000+00:00\nLast Submission:2026-04-10T06:13:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324631", "uuid": "3d74b730-e312-4947-b454-a45302fd9be4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324631", "to_ids": true, "type": "md5", "uuid": "b5f0a1ce-1420-4687-90ba-37203c5f47d1", "value": "5d462d0f3704d7db1b1d8c2cdcb19033", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323401", "to_ids": true, "type": "sha1", "uuid": "59262e9c-b2f7-4fdd-bfe7-f8395038c0a6", "value": "82accb65a9fa2b0f500024b9b35999e9be36943b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323401", "to_ids": true, "type": "sha256", "uuid": "932ff198-242a-4430-9121-b1495e3b575e", "value": "3d371ef71e40c34a75c168d4647db096c2f386499d99a88d4e16b63cd4acda25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318479", "to_ids": true, "type": "ssdeep", "uuid": "26112b23-8d86-4e4b-9b06-84706ef4dcc1", "value": "12288:cHIqV67/NjbaZN7kGR3S8ZbXYfCZuB/y2kf1SAT7XSc/tBrv4X69Y6b6xqcKfIQ/:cBOiH/b9XYKZu5stSAPZrQXVY6xeL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318479", "to_ids": false, "type": "size-in-bytes", "uuid": "4aea62b9-c2f8-44be-9ed8-789c3c39b716", "value": "743265" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 13/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318479", "to_ids": false, "type": "text", "uuid": "b98a07b9-20bb-4942-9f9d-86284c568802", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:31/64\nFirst Submission:2026-02-03T13:02:01.000000+00:00\nLast Submission:2026-02-03T13:02:01.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324652", "uuid": "5abe6ba9-0725-4a62-88d1-d0da8a1fb752", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324652", "to_ids": true, "type": "md5", "uuid": "740a2ea9-c51f-40dc-82ef-f0e8a0b15285", "value": "587a464ffc174288d3f66d1845133229", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323402", "to_ids": true, "type": "sha1", "uuid": "5e0c4e26-64fe-4d06-b783-f3de66df81b6", "value": "23e076f5db64fb51226ef56a60bae6424b06a432", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323402", "to_ids": true, "type": "sha256", "uuid": "f47b05ed-91a0-417d-b661-8db127c54328", "value": "1c170b7470d507378ddb78e9d66305f1184e965baaf2d27ededb23a318a58953", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318545", "to_ids": true, "type": "ssdeep", "uuid": "7395e5de-b66b-432c-afeb-83687e31c752", "value": "24:8+XQWJeEyZRrACe+/5+nX4aanzIq9nYg/izm:80+bHcq+X4ZzdY6k" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318545", "to_ids": false, "type": "size-in-bytes", "uuid": "d107db13-f131-4fab-8592-6f7b336ccceb", "value": "1203" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781318545", "to_ids": true, "type": "vhash", "uuid": "9bbdecae-d799-4424-ba90-ec7ece2a04a6", "value": "c7a10c5a7b2a8b203eaca2239715ccf5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318545", "to_ids": true, "type": "filename", "uuid": "c2e375f2-3d7a-4e49-9aa0-69d7f28640f3", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260316-9055897-1.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_yXZ9BtFU2OewE.lnk" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 13/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318545", "to_ids": false, "type": "text", "uuid": "9873cdc0-9722-433c-a54f-8b05d8775f43", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:33/62\nFirst Submission:2026-03-17T05:49:39.000000+00:00\nLast Submission:2026-03-17T05:49:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324674", "uuid": "b9a6a28b-9b4e-4937-9cb6-e690154a1e64", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324674", "to_ids": true, "type": "md5", "uuid": "6ca878e9-2856-43e3-b7f9-065447810bd6", "value": "c1d02459038d86dcc96c0a721724a3a0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323404", "to_ids": true, "type": "sha1", "uuid": "4ae174b0-2915-4af4-a9a1-cde56209b547", "value": "a15007356acf6609d2fbbb8fb59257ae66ec4b6b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323404", "to_ids": true, "type": "sha256", "uuid": "ca95ef04-7631-49b7-8456-f6a5d284941c", "value": "37b42a83715f7a34e00d3458d4f4b6e53b8c95372677ce020a2e38e80e60ba87", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318609", "to_ids": true, "type": "ssdeep", "uuid": "30b79f36-38c1-4984-bc30-c80334ec468d", "value": "12288:Mj1SEXxujU3sSOPt9AV+uQiMsPtOTkPGyysE2cc4CltIxTWTZmvisQyq6TpekZ/8:MpSEXxeU3dOPt9ADPtO8Gyw2OLxTWTZn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318609", "to_ids": false, "type": "size-in-bytes", "uuid": "50fb288c-be01-4232-b140-1a606c861447", "value": "742394" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318609", "to_ids": true, "type": "filename", "uuid": "4cc88960-a011-4ca0-8de2-e7d5faf43efe", "value": "\u041f\u043e\u0432\u0456\u0441\u0442\u043a\u0430-160-453-26.rar" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 13/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318609", "to_ids": false, "type": "text", "uuid": "3390d804-07b8-486a-a3b4-b4d9f7f2fb9d", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:20/64\nFirst Submission:2026-02-03T08:57:57.000000+00:00\nLast Submission:2026-02-03T13:01:47.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324695", "uuid": "f7f9b209-3cae-4e00-b5cd-59592dc5724e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324695", "to_ids": true, "type": "md5", "uuid": "3d41c341-2acf-45ee-9737-9be5e78f9e99", "value": "c17e8387f2718a55948c7d8d45ee8100", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323405", "to_ids": true, "type": "sha1", "uuid": "4a547e0b-e6a6-478b-ad6f-1f6405db0fca", "value": "4a16e8b0a5b3783c8d369d70ec36bb127ca9cc34", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323405", "to_ids": true, "type": "sha256", "uuid": "e3fb1e27-c9be-461f-b103-02b3594f7065", "value": "44f6f7ba668fc645129d66353e6f60402822ae929ce54648cae0bba6348a18ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318652", "to_ids": true, "type": "ssdeep", "uuid": "4dad9f82-31ec-4a4f-9334-8436453a66e2", "value": "12288:3HjKaZN7kGR3S8ZbXYfCZuB/y2kf1SAT7XSc/tBrv4X69Y6b6xqcKfIQ/:3bH/b9XYKZu5stSAPZrQXVY6xeL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318652", "to_ids": false, "type": "size-in-bytes", "uuid": "45485828-236f-4228-a661-b73c9d70788a", "value": "743259" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 13/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318652", "to_ids": false, "type": "text", "uuid": "f6c6d6cf-60ee-4291-952d-e893fddb53ba", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:30/64\nFirst Submission:2026-02-03T13:04:40.000000+00:00\nLast Submission:2026-02-03T13:04:40.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324717", "uuid": "fa7f092c-e43b-4503-be72-130296fc5073", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324717", "to_ids": true, "type": "md5", "uuid": "5a98f0c3-e0b6-41c3-b8b9-aee8b5da36db", "value": "addf25d1f994729f2d3cbb3d0ab49897", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323406", "to_ids": true, "type": "sha1", "uuid": "af74f495-2798-46b9-9630-3bc04b460e89", "value": "ad102478adda75ef6c6985187fc1e8b0bc1edded", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323406", "to_ids": true, "type": "sha256", "uuid": "2139643e-4e9e-4ca7-9d6a-a8111d7e55a7", "value": "507b2fcdae058cebbd550965b90c44e878d7a2463058c846eeb68f0dc1b48eda", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318695", "to_ids": true, "type": "ssdeep", "uuid": "706b2611-4e55-4394-85f8-abc9adb5a370", "value": "24:8VYQWJml1Ul9XACe+/5+d4khI2Hl8q9nYg/izm:8VYGl1fq44khI2H7Y6k" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318695", "to_ids": false, "type": "size-in-bytes", "uuid": "00e5e172-fa19-4747-ac5e-429be21a0cb1", "value": "1207" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781318695", "to_ids": true, "type": "vhash", "uuid": "1e66386e-6be2-41d6-ae48-5a6a92dcbb44", "value": "c7a10c5a7b2a8b203eaca2239715ccf5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318695", "to_ids": true, "type": "filename", "uuid": "ede58d3e-755e-4988-b32f-930d39203de5", "value": "2523_20535887.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_bfF3BxteabXqg.lnk" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318695", "to_ids": false, "type": "text", "uuid": "ee620ab4-a425-46f8-9bcb-075351ee63bf", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:30/62\nFirst Submission:2026-02-03T13:04:18.000000+00:00\nLast Submission:2026-02-03T13:04:18.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324738", "uuid": "4b70393b-b23d-4014-a0ef-e844d1abcc37", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324738", "to_ids": true, "type": "md5", "uuid": "98f6cb94-e2a0-48cb-934f-3eade887696d", "value": "6e99ea85251d4def4eccb32dd4c10c18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323408", "to_ids": true, "type": "sha1", "uuid": "f327c686-9cbd-4c8f-afbb-102403d1b238", "value": "9489a954de11471119c788c74dff14114748756f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323408", "to_ids": true, "type": "sha256", "uuid": "f2b36fc0-4bd6-48e6-9c74-9650c16253b8", "value": "6083aac5376b7ca74cc363e0d66f70beaffee543d098c612b820b16fbfb0aa52", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318716", "to_ids": true, "type": "ssdeep", "uuid": "fde182a8-a6f0-4304-917c-210353feb6ec", "value": "24576:wOV8tx+uP3H9QGRiooimg7vPavTUzYFysXB9oM1Wyof3N4iF2ebf:B8t8uPtQqixg7vPabUzYFysxRQf94k2o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318716", "to_ids": false, "type": "size-in-bytes", "uuid": "fbcb884f-6812-4e36-90d0-adab4c844eb9", "value": "1119234" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781318716", "to_ids": true, "type": "vhash", "uuid": "d141c6ed-3d28-49f7-83dd-26a66c8ec5d9", "value": "116066655d755d0550a2z122z76uz226z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318716", "to_ids": true, "type": "filename", "uuid": "f8469472-27bf-475d-9304-d181da7998af", "value": "e0qmagll.exe" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318716", "to_ids": false, "type": "text", "uuid": "6412b922-cf25-4e97-b2ae-f19edc6384d5", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:45/71\nFirst Submission:2026-03-17T08:43:39.000000+00:00\nLast Submission:2026-03-17T08:43:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324759", "uuid": "a52cfef2-4301-40fb-9c56-4943a9ed548c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324759", "to_ids": true, "type": "md5", "uuid": "c56d7df9-d90d-4850-8957-2dedd1306bb3", "value": "8aa796cf85858d9113aac294ca0bdd96", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323409", "to_ids": true, "type": "sha1", "uuid": "d2bf7af9-17ad-4a2f-b7df-dab093dda4e1", "value": "08807a3c52910568265193e96f048775ed287af8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323409", "to_ids": true, "type": "sha256", "uuid": "a71b99c0-150b-47a8-be47-3847abe9fbba", "value": "65c053030558b4a3588e2590c5c4961a9912180b731686deb3f4c831e765a095", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318738", "to_ids": true, "type": "ssdeep", "uuid": "8334b0d8-4bc3-4bd3-a107-6a06fced9d85", "value": "12288:7Hc+KmHbXw3sSOPt9AV+uQiMsPtOTkPGyysE2cc4CltIxTWTZmvisQyq6TpekZ/8:7v7Xw3dOPt9ADPtO8Gyw2OLxTWTZQDQN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318738", "to_ids": false, "type": "size-in-bytes", "uuid": "368c6438-e213-44b3-9b3e-32d778d823f3", "value": "742209" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318738", "to_ids": true, "type": "filename", "uuid": "bdb25060-3cfc-439d-9fb0-731471c03192", "value": "\u041f\u043e\u0432\u0456\u0441\u0442\u043a\u0430-181-426-26.rar" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318738", "to_ids": false, "type": "text", "uuid": "7b7aecd4-8b08-48e4-976a-d8633f2eebe2", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:31/64\nFirst Submission:2026-02-03T08:59:22.000000+00:00\nLast Submission:2026-02-03T13:01:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324780", "uuid": "b3705c8a-c7b7-408b-9f13-5be53cbd0448", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324780", "to_ids": true, "type": "md5", "uuid": "c80c697a-15ed-414a-8732-a03e8f285be0", "value": "454ea7aa75d57543bd36131d7f2dd7ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323410", "to_ids": true, "type": "sha1", "uuid": "52529930-6566-4b87-8af9-d2078452b7f1", "value": "ec96c37eaa81339163c6f259a431567b71a6d326", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323410", "to_ids": true, "type": "sha256", "uuid": "d88b101a-2cf4-4a42-9a72-dea111175669", "value": "718465f44c0680740fb61790eda3d2f4c5218c9de0c560299c580fa1602dc9c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318760", "to_ids": true, "type": "ssdeep", "uuid": "b2b4942c-dab2-4bba-84f9-2731294652d0", "value": "12288:3Yoe3z9DXHzA2AZMmrQhrtEqWeq23KvCA0grfAIm04oblnM8gzD4AAUzHXQbmrQN:3Y33zZzqDMvEven3Sl0KfXmWM8gz1AUa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318760", "to_ids": false, "type": "size-in-bytes", "uuid": "ad6b47e5-10b8-4bd7-805c-15eca7a94128", "value": "753132" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318760", "to_ids": true, "type": "filename", "uuid": "eb97fa3e-dc03-4229-ae2e-cd11b45af882", "value": "_718465f44c0680740fb61790eda3d2f4c5218c9de0c560299c580fa1602dc9c7.rar" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318760", "to_ids": false, "type": "text", "uuid": "7abe7ad7-b515-4f16-aae6-601c2a06d4ff", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:27/64\nFirst Submission:2026-03-17T05:49:19.000000+00:00\nLast Submission:2026-03-24T10:16:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324801", "uuid": "17b85907-5cab-4db3-bb63-8d7d9d20a779", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324801", "to_ids": true, "type": "md5", "uuid": "2cf03338-4d3f-422d-8fac-425d4ea68b2e", "value": "014623f6f39501eb1afc07f608036e3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323411", "to_ids": true, "type": "sha1", "uuid": "20de2214-f773-4286-a504-cc19f4049725", "value": "9509ea87cf739f1cb8d63b5343175bf6210f4037", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323411", "to_ids": true, "type": "sha256", "uuid": "6bdbc9a7-b786-477e-8f76-36d2f02ce4d5", "value": "8150b2b39fa62fa2de177ed8526c621a3581c0eb481dd9740fc5894ce2b7c13b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318825", "to_ids": true, "type": "ssdeep", "uuid": "e38d5543-c7f5-4016-b420-8041f55bb872", "value": "24576:JMHMGZQpKrEldWOtqaJm/SpF1FOEwRTGUqbmdSm:JMHPV4cfSpF1F/w9Gpq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318825", "to_ids": false, "type": "size-in-bytes", "uuid": "3a5ea9eb-b411-4344-b678-4e9283847430", "value": "896474" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318825", "to_ids": true, "type": "filename", "uuid": "3a3135a6-d434-4785-b3f4-0a68907bfdb2", "value": "8150b2b39fa62fa2de177ed8526c621a3581c0eb481dd9740fc5894ce2b7c13b.rar" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318825", "to_ids": false, "type": "text", "uuid": "930ce99f-0192-4f0e-9e00-89baa3632bb1", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:31/64\nFirst Submission:2026-03-05T13:26:39.000000+00:00\nLast Submission:2026-03-06T04:00:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324822", "uuid": "da6acc76-381d-4155-96a9-7c3002b59142", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324822", "to_ids": true, "type": "md5", "uuid": "f648f09b-d191-43a5-b5ce-5116dd8c065e", "value": "31bc8b17da2ba7a94335e8c29391368a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323412", "to_ids": true, "type": "sha1", "uuid": "19a8f36a-df9d-4948-9f9b-71ec33cb71e5", "value": "89083ad4cd38d828e95cac69cbd3a686dae20646", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323412", "to_ids": true, "type": "sha256", "uuid": "49599c0a-a784-4761-8dc9-7c2f94702a58", "value": "a717dd74c01fcfce35a28f374e1c6f9ded06d6f7b0cc04618ce9454ad64febb8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318889", "to_ids": true, "type": "ssdeep", "uuid": "49516ee7-8cec-4938-85ce-87beba694270", "value": "1536:xmt2kga/dHfku/A6J1RDWnZpaBg24cfKBQD:xmt5rkuxJnWnZpsf2QD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318889", "to_ids": false, "type": "size-in-bytes", "uuid": "f6e7fdd0-25e6-4423-b89f-a8cc7d4c2b29", "value": "69899" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781318889", "to_ids": true, "type": "vhash", "uuid": "73624d01-395e-4409-960e-bd50e635421b", "value": "ca54c1b14b5f2906277552727e0d6e86" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318889", "to_ids": true, "type": "filename", "uuid": "82c64fbf-481f-441d-b760-cd83e08431fa", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260409-7496423-1.pdf:.._.._.._.._.._.._.._.._.._.._.._.._ProgramData_O5fE" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318889", "to_ids": false, "type": "text", "uuid": "ad8b8776-bce7-46cc-84cb-89cfff3270af", "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:32/62\nFirst Submission:2026-04-10T06:21:15.000000+00:00\nLast Submission:2026-04-10T06:21:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324843", "uuid": "bcbfa23f-1405-4b51-95a1-6432b1c03673", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324843", "to_ids": true, "type": "md5", "uuid": "c92b3e42-11e6-4fdb-a5ff-fd3281ac4c40", "value": "d2cf055f564664cc761287628d24953b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323414", "to_ids": true, "type": "sha1", "uuid": "3f5de8bb-48a9-44b8-a4a7-38a73c026fea", "value": "316f753560b2e96098c0a47d49adcf81fe2426c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323414", "to_ids": true, "type": "sha256", "uuid": "59fc6d28-8991-493a-a250-89c348f3b7f7", "value": "b01f31c9541579ad34f4e50acafec252eb419f5b1ca98155e0ec84c19d12c9e4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318910", "to_ids": true, "type": "ssdeep", "uuid": "c3752a84-80b6-449e-88b2-393e0436ebac", "value": "24576:iaERrg+RHFlrQQJyYIlTISGKmz7WFE+kc7PoYHIEs4oapIYonkqmsgwD1:HArbFKYZohFE+kcf7pIrkRs1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318910", "to_ids": false, "type": "size-in-bytes", "uuid": "47c6d822-199a-44da-9b69-cb5fd8ff85f1", "value": "1119232" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318910", "to_ids": true, "type": "filename", "uuid": "981cc0a6-e76b-444c-9591-ff41981ba7f0", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260316-9055897-1.pdf:.._.._.._.._.._.._.._.._.._.._.._.._ProgramData_YDV" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 12/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318910", "to_ids": false, "type": "text", "uuid": "ce876fd8-5997-4ae8-be77-5a27c4c194e3", "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:7/61\nFirst Submission:2026-03-17T10:04:23.000000+00:00\nLast Submission:2026-03-17T10:04:23.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324865", "uuid": "7c84a3c4-691f-4768-a2ce-6cd31ec993f6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324865", "to_ids": true, "type": "md5", "uuid": "f7b0d72e-51bf-4589-9409-5bb50a048a10", "value": "8ca36b9cbd72d1f4ab4a9c8fcf85fe7e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323414", "to_ids": true, "type": "sha1", "uuid": "3f49fa35-043c-4440-bc2c-0ae2905d1be5", "value": "4f29c2059dcba412c3ef0100e839cf85fb0f62c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323414", "to_ids": true, "type": "sha256", "uuid": "d1647a33-e037-49d3-981c-9f73d9978bf5", "value": "bf338d88f60c0d352cd0d1b5e4bc6a1d9f1ac8fe1df48516ec0042cafda821e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318932", "to_ids": true, "type": "ssdeep", "uuid": "e37a100b-482f-4ab4-9739-afe1fa2a17a2", "value": "24:8hQWJmlK2UjcOACe+/5+Ux4MaufDCEq9nYg/izm:8hGlr3qF4mbCJY6k" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318932", "to_ids": false, "type": "size-in-bytes", "uuid": "777b37c7-837f-49b7-86da-73a27ffab4b7", "value": "1213" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781318932", "to_ids": true, "type": "vhash", "uuid": "0e70efeb-9ec1-476b-bfb2-2366eb410e60", "value": "c7a10c5a7b2a8b203eaca2239715ccf5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318932", "to_ids": true, "type": "filename", "uuid": "50ad0e3f-56d7-4e48-92ea-d20da3fb450a", "value": "\u0406\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u0430 \u0440\u043e\u0442\u0430.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_bSU3CQN_vy.lnk" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 12/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318932", "to_ids": false, "type": "text", "uuid": "25b0cdef-f8c2-4055-8026-94eab2218611", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:33/62\nFirst Submission:2026-03-05T13:29:01.000000+00:00\nLast Submission:2026-03-05T13:29:01.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324886", "uuid": "f57cc050-aa54-42cb-acca-3e1d0f6aa483", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324886", "to_ids": true, "type": "md5", "uuid": "d9a5b9d6-4086-434e-926f-1fa8a5555302", "value": "dcdeba12bdfc3a0dce97b2f2ce60789a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323415", "to_ids": true, "type": "sha1", "uuid": "6b4e4e8e-d1bb-4319-a2be-be8160e2d537", "value": "27ead27e8f5cea47bf213f6174ca21e33747d198", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323415", "to_ids": true, "type": "sha256", "uuid": "28e88492-295b-413c-94cc-38a3730066c0", "value": "ce78748acd8e9be741b143ad716d735dc682bd5a010427a199744b81456f8e35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318955", "to_ids": true, "type": "ssdeep", "uuid": "8dd07275-b00b-4ac7-882c-66dcef324058", "value": "1536:LqQiHEoxW/HuqUVvFeE3I1SOWZiHaP68HJ:LhXUWvwv/Y1dWMaP6eJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318955", "to_ids": false, "type": "size-in-bytes", "uuid": "df95f345-bd23-4f11-ac93-e7ab1d1a5b63", "value": "69024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781318955", "to_ids": true, "type": "vhash", "uuid": "16f7bdd9-2127-4825-9ed5-7bd69e3645eb", "value": "8e7346fc0804bca2cd2e01ec9177f5ae" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318955", "to_ids": true, "type": "filename", "uuid": "6231d550-1b23-4429-8595-96853c00ae28", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260316-9055897-1.pdf:.._.._.._.._.._.._.._.._.._.._.._.._ProgramData_U0U" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318955", "to_ids": false, "type": "text", "uuid": "4f2add35-609d-41fe-8ceb-32ec0d796196", "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:22/62\nFirst Submission:2026-03-17T10:05:04.000000+00:00\nLast Submission:2026-03-17T10:05:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324907", "uuid": "ea04ea52-a6d8-42bd-b253-887e93191e43", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324907", "to_ids": true, "type": "md5", "uuid": "1336da82-274e-4065-b54c-40325d2c7c75", "value": "f819578d740cec4708e1b96eae967515", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323417", "to_ids": true, "type": "sha1", "uuid": "5d0f04eb-cad7-43bc-9519-998b9af983cf", "value": "a97b80ba462d7cb69da3d0ea64f7ba9d5750832e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323417", "to_ids": true, "type": "sha256", "uuid": "de9fa7a2-8d86-4bad-8740-6484935fa41f", "value": "d1d26b0f68e26ac591848796aeef7b9c766442bbff47af8823f9b23d1b588836", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781318977", "to_ids": true, "type": "ssdeep", "uuid": "c61ed4a1-d57a-4079-9074-0626e97cf6a4", "value": "24:8N5MwZsxC7w2HkeYrI2AMze+/5+u4G3CZZEQF5040b/ifcq:8DNBNWU+L4G3C8QH3mUJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781318977", "to_ids": false, "type": "size-in-bytes", "uuid": "1d923f1f-9828-47ba-948f-0d8da361af8f", "value": "1381" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781318977", "to_ids": true, "type": "filename", "uuid": "02baad77-909a-4870-83ad-fe5812eb47f3", "value": "lnk.txt" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781318977", "to_ids": false, "type": "text", "uuid": "0f367611-877f-4de2-aa00-949ca032f8d4", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:2/62\nFirst Submission:2026-02-03T13:00:30.000000+00:00\nLast Submission:2026-02-03T13:00:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324929", "uuid": "b2f15e6c-4ac2-4373-8322-71cce62bff42", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324929", "to_ids": true, "type": "md5", "uuid": "7e28b4ff-f604-4794-a60d-a2ec4176ffc3", "value": "a1cce40d02e350e96cd7dc20d4d9f5c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323418", "to_ids": true, "type": "sha1", "uuid": "2f65e287-6b3e-4d60-93dc-4a1a6d47bc52", "value": "5da002f3eb0c661adfc18015940c62f1e5b41997", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323418", "to_ids": true, "type": "sha256", "uuid": "0ad21f80-2153-4386-b88d-3ed4da720a43", "value": "e08dcb80346ded2bb2393a180e3f2612ed4c2ff0d3842390a5b527d003060212", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319021", "to_ids": true, "type": "ssdeep", "uuid": "e3e34c93-7466-4164-9feb-d5624a3a8791", "value": "24576:FtZytID2xGKDG40g20SiQix3qZTVrstkmZCxEMaZynNwWd0hl6hkdVl:vUID2UKD93Qix3qNVrstkm8yoNN4l6hk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319021", "to_ids": false, "type": "size-in-bytes", "uuid": "c8b14bc9-507a-4a1b-9763-aaca3deb1071", "value": "1131520" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319021", "to_ids": true, "type": "vhash", "uuid": "ab854229-ba25-43f5-bfa2-525d2337304e", "value": "116066655d755d0550a2z122z76uz226z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319021", "to_ids": true, "type": "filename", "uuid": "27875b75-2ef8-4f11-ad51-707ad67f6d4d", "value": "jhm4mqvu.exe" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319021", "to_ids": false, "type": "text", "uuid": "3542014b-1b13-4833-aeaf-ffa74d424ffc", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:36/71\nFirst Submission:2026-03-05T23:34:12.000000+00:00\nLast Submission:2026-03-05T23:34:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324950", "uuid": "16f02d91-5661-4d74-a7bc-a28e433cf3ed", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324950", "to_ids": true, "type": "md5", "uuid": "c8fdef0c-e789-4e1d-970d-15d8f8bdec61", "value": "be9ed70483a0820810b937358a52b24e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323419", "to_ids": true, "type": "sha1", "uuid": "061cc427-933c-4e7e-beb0-6f4422c5a1a7", "value": "d81aebf352da8a4383e6aaafd93d1c702c76b8ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323419", "to_ids": true, "type": "sha256", "uuid": "6451614b-6de9-48a5-b632-cd9a2c0b104b", "value": "e6bd725a2af981cd2b5c2217c1d7d906369d8daf48f02023fb73635f9e2b9659", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319042", "to_ids": true, "type": "ssdeep", "uuid": "e72aefef-b237-4a59-b525-c6696c1a58d4", "value": "24576:meYRZ7c8BBJcsyhZiGpmwyvMqsecZb3AYyMC7fS:qa8BBJcsTGavgd3AYyMn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319042", "to_ids": false, "type": "size-in-bytes", "uuid": "2fd395fc-1808-40c1-bd83-b3a2cad697be", "value": "1117696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319042", "to_ids": true, "type": "filename", "uuid": "b5a74186-73a1-4b80-9dd8-0ac09e4af0d7", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260409-7496423-1.pdf:.._.._.._.._.._.._.._.._.._.._.._.._ProgramData_Arj" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319042", "to_ids": false, "type": "text", "uuid": "59345f75-2656-4334-8384-eb57c4c5a2fc", "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:26/61\nFirst Submission:2026-04-10T06:19:06.000000+00:00\nLast Submission:2026-04-10T06:23:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324972", "uuid": "164a86de-4ae5-4c85-b451-b30ac5d6e2f7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324972", "to_ids": true, "type": "md5", "uuid": "67fa745f-0fba-4572-a3c6-ecfcb4e808ca", "value": "082b9caaa287ba26c26387e6489c93d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323421", "to_ids": true, "type": "sha1", "uuid": "0d2220a7-f779-4bd5-8ad4-a75879128be5", "value": "6f60128b75bd4b2c40227dac389ea3fc80bcc90e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323421", "to_ids": true, "type": "sha256", "uuid": "29cefe75-e61b-4450-af4c-72c5a55695d1", "value": "e9d6938c9980cab735e8fb2eaa082ddc6f5dd7f2ff84d8ece01e8caaefdbb930", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319064", "to_ids": true, "type": "ssdeep", "uuid": "7fce0706-44f3-42d6-aaa4-a2d9e4d63417", "value": "24576:dMUfb/obKrEldWOtqaJm/SpF1FOEwRTGUqbmdSm:6gou4cfSpF1F/w9Gpq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319064", "to_ids": false, "type": "size-in-bytes", "uuid": "b86103a0-4a11-412c-88a2-058ebd73368d", "value": "874688" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319064", "to_ids": false, "type": "text", "uuid": "18981a98-1fe2-4f25-b2a4-7e76d11e4e13", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:31/64\nFirst Submission:2026-03-05T13:28:13.000000+00:00\nLast Submission:2026-03-05T13:28:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781324993", "uuid": "a3f4b2b7-cee2-40a6-8480-fa646b70ac89", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781324993", "to_ids": true, "type": "md5", "uuid": "4efbf01c-e736-4375-8940-c2f9a7bc298b", "value": "4082096ec0b8f723a79a224a6b6d37cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323421", "to_ids": true, "type": "sha1", "uuid": "8086a4f9-0f55-451c-a47c-2a0570491ed3", "value": "02462fa8f816b2ff21898612552d7845abcb9070", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323421", "to_ids": true, "type": "sha256", "uuid": "0bb12e93-740c-4a09-a434-79ebe4eb4157", "value": "f668bd551859007cf2cc2a62bf0bf5414870a04e9782590c9bf85c849ddb308b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319086", "to_ids": true, "type": "ssdeep", "uuid": "f118df76-5c88-442f-9485-e88f9062e12e", "value": "24:8xYQWJeMid9M4ACe+/5+nX4pmHAWq9nYg/izm:8xY+dIfq+X4pmHAjY6k" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319086", "to_ids": false, "type": "size-in-bytes", "uuid": "7e1248ee-129a-4a22-9b56-f5798525181c", "value": "1203" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319086", "to_ids": true, "type": "vhash", "uuid": "862566b5-6c7f-4680-b20a-7345c7424155", "value": "c7a10c5a7b2a8b203eaca2239715ccf5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319086", "to_ids": true, "type": "filename", "uuid": "faeac00f-7800-4a79-9759-b56636331d1c", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260409-7496423-1.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_ojMP31J28ohEDxT.lnk" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319086", "to_ids": false, "type": "text", "uuid": "f5b01977-f2fa-436f-9f35-f62f13b8a2b8", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:35/62\nFirst Submission:2026-04-09T09:20:26.000000+00:00\nLast Submission:2026-04-10T06:23:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781325014", "uuid": "270283fe-2a1c-4c11-9b7a-3f240e1b8997", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781325014", "to_ids": true, "type": "md5", "uuid": "9f216b2d-56bc-45e7-8f9e-b04e3baadbc6", "value": "ea610ea6a8d69cb1e93fb79d4a8fa26f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323423", "to_ids": true, "type": "sha1", "uuid": "9dc59203-0fd4-41e0-8e5f-a6fe198862cf", "value": "42428f21b0114e390c6129f1fb24b42e97a8f7f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323423", "to_ids": true, "type": "sha256", "uuid": "c907ec38-c8ee-4106-bd32-e5e6ae8e3300", "value": "f9d2907d6b1de3078a0f111cc98764a92baf5ebd06cc8ab02637a65eff3b7f3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319108", "to_ids": true, "type": "ssdeep", "uuid": "318d8977-e859-4e03-b1d7-9d73c2cc0534", "value": "24:8iQWJml1Ul9XACe+/5+nX4X0huqkq9nYg/izm:8iGl1fq+X4khdpY6k" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319108", "to_ids": false, "type": "size-in-bytes", "uuid": "b825a38a-acf9-4478-b6db-063468489b2a", "value": "1203" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319108", "to_ids": true, "type": "vhash", "uuid": "a367d68c-b98d-4be9-bbb1-0a2027e461dd", "value": "c7a10c5a7b2a8b203eaca2239715ccf5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319108", "to_ids": true, "type": "filename", "uuid": "29f854e5-40bc-46b8-8089-0b38ffed8598", "value": "2523_18618309.pdf:.._.._.._.._.._Roaming_Microsoft_Windows_Start Menu_Programs_Startup_QhVES3g47D9.lnk" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319108", "to_ids": false, "type": "text", "uuid": "9c04fd92-03ae-4fa3-9041-6715e671d4e1", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:30/62\nFirst Submission:2026-02-03T08:58:18.000000+00:00\nLast Submission:2026-02-03T08:58:18.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781325035", "uuid": "500cf13f-e4fa-4431-878a-85aa833277d7", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:invalid_trailer_structure\nIOC-description:MD5 of 5d164b6d74dae9fe3022bc3cf453cd8b846e9cdc0cd616246fe620be88e3f1e5", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781325035", "to_ids": true, "type": "md5", "uuid": "ff6483e7-e16a-429a-947f-01d77c20a73f", "value": "6a48fbe91482b2f14ed977c110a3685c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:invalid_trailer_structure\nIOC-description:MD5 of 5d164b6d74dae9fe3022bc3cf453cd8b846e9cdc0cd616246fe620be88e3f1e5", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323424", "to_ids": true, "type": "sha1", "uuid": "4eb40bb3-0409-4aa8-9567-6d176d802579", "value": "f8817d46652594d745f28cb985b0000cf2669352", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:invalid_trailer_structure\nIOC-description:MD5 of 5d164b6d74dae9fe3022bc3cf453cd8b846e9cdc0cd616246fe620be88e3f1e5", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323424", "to_ids": true, "type": "sha256", "uuid": "bf04e10f-8aa0-4848-a0bf-8db456c16671", "value": "5d164b6d74dae9fe3022bc3cf453cd8b846e9cdc0cd616246fe620be88e3f1e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319129", "to_ids": true, "type": "ssdeep", "uuid": "81fff3f5-cd0f-442c-b704-e9104ec3642b", "value": "1536:V5Uns9i1cknOOMQ5MMv/wJR3uYQS+QkDTC+5MJey4+hY0vfDJ4zUJbRmyU62YlT+:V5UGC38Jl4zT4Je9W17BM1LcTzBJ6i8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319129", "to_ids": false, "type": "size-in-bytes", "uuid": "21e3cf32-7b12-4169-b1c4-3b656efab77f", "value": "103841" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319129", "to_ids": true, "type": "vhash", "uuid": "576ec451-61b5-44a4-95df-972fed7a0e90", "value": "97ae65c834d50d075ca30b1f2f05150a5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319129", "to_ids": true, "type": "filename", "uuid": "5cced930-661b-48c5-9159-47251c75dd46", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260409-7496423-1.pdf" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319129", "to_ids": false, "type": "text", "uuid": "5b7d7949-f829-4402-b9b9-7b0af9178228", "value": "IOC-title:invalid_trailer_structure\nIOC-description:MD5 of 5d164b6d74dae9fe3022bc3cf453cd8b846e9cdc0cd616246fe620be88e3f1e5\r\nType Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-04-09T09:17:17.000000+00:00\nLast Submission:2026-04-10T06:10:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781325056", "uuid": "88a81c37-b570-4235-9ddc-4bbc5514ba84", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781325056", "to_ids": true, "type": "md5", "uuid": "57aff354-efa2-4af5-9a1b-d627d6eacd16", "value": "c07f91e052bcb508353ad74c54bc1c96", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323425", "to_ids": true, "type": "sha1", "uuid": "c1cd02ec-9020-4188-8886-0f6f9fa01a62", "value": "af887ea8f04d68ba545acca5ee08841ce2340ba7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323425", "to_ids": true, "type": "sha256", "uuid": "5ef3ac63-2243-4da2-abbd-fb70e7667d55", "value": "023c8f8e2a71da2044e3f04ac74c8b3616f417436476cea85222f01119615979", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319151", "to_ids": true, "type": "ssdeep", "uuid": "7868e592-da43-4b63-bd79-4effefcbe565", "value": "1536:lNw6u8k1ZycBBW00vVLyDqDmBz93u8rdP/3/P6nAjj973c9EJqVjkJ5:lPlUBVuLIz9eot3/CnAjhI9EJV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319151", "to_ids": false, "type": "size-in-bytes", "uuid": "d510e62b-5500-4328-b2cf-f68f2868ab76", "value": "100224" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319151", "to_ids": true, "type": "vhash", "uuid": "36c36f5b-361c-4be3-9d11-1d8c00bdead5", "value": "94adb85f7fbad0f80c33baa7b4b5a5ed6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319151", "to_ids": true, "type": "filename", "uuid": "b209ce29-c55f-4f22-98de-93abb142836e", "value": "2523_20535670.pdf" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319151", "to_ids": false, "type": "text", "uuid": "1d183e39-ee50-4366-b756-574648fc8fe2", "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-02-03T13:04:18.000000+00:00\nLast Submission:2026-02-03T13:04:18.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781325077", "uuid": "bb144dcf-4c49-4896-9b70-675f0169b3ef", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781325077", "to_ids": true, "type": "md5", "uuid": "538ee3a2-8da9-4399-a3ae-069ecf8b240d", "value": "3699542ba04458e84dc9148a2234fe61", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323427", "to_ids": true, "type": "sha1", "uuid": "541aa42f-db90-42c4-bdb1-3ac34149367a", "value": "ea8a726f48431e06044c9d996e907c1db80691c9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323427", "to_ids": true, "type": "sha256", "uuid": "d2d435bb-baac-4fee-a9d0-0421d8473a45", "value": "22b07d2af98bb180474c33d93861124bbdf9b5dd7e42a8bddc654310469a9a2c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319178", "to_ids": true, "type": "ssdeep", "uuid": "79695924-2447-40e5-9583-07ae3edab007", "value": "6144:Dly5oDh+nPrV2y/zKFP3CELmEGVBatjj7eh/xl78iyxn38Q:DqoDh+njV2y/zm3CELmE+U57c4iq38Q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319178", "to_ids": false, "type": "size-in-bytes", "uuid": "1794de24-69e9-454f-b233-73fe0878414a", "value": "240411" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319178", "to_ids": true, "type": "vhash", "uuid": "417bef49-b6f3-43d4-9c80-2d298fb712c2", "value": "9904d649ffbbb482283141ca3f0f26a6a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319178", "to_ids": true, "type": "filename", "uuid": "cfa97be1-3b25-4c3d-9549-f96f6dc1d96e", "value": "\u0420\u043e\u0442\u0430 \u0437\u0430\u0431\u0435\u0437\u043f\u0435\u0447\u0435\u043d\u043d\u044f.pdf" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319178", "to_ids": false, "type": "text", "uuid": "7f6bdc29-8786-4242-ad6d-7b789bdb6e86", "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-03-05T13:29:00.000000+00:00\nLast Submission:2026-03-05T13:29:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781325098", "uuid": "a4c67974-0bad-4b4c-afea-5c26a95453a8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781325098", "to_ids": true, "type": "md5", "uuid": "d69993cc-bbd1-4d81-9d4a-3b4efbed55fd", "value": "b3c86e81b330157519b9e188a1f9fbf3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323428", "to_ids": true, "type": "sha1", "uuid": "3d428a25-00e9-43df-8db8-31b05ea067e3", "value": "42baa6835f934dd4dd723cfa147cc761fe9c8010", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323428", "to_ids": true, "type": "sha256", "uuid": "11baa914-52cb-4576-8adf-9f95e6356ead", "value": "276789b3b946753e9be482219bc4526da2da8772701f3b9d00c74038e2604ece", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319200", "to_ids": true, "type": "ssdeep", "uuid": "3ddc48dc-022b-4648-84c7-6f9e9dcf13cd", "value": "1536:lNw6u8k1ZycBBW00vVLyDqDmBz93u8re+OgAmNI2AbBoF8p1GVDhVqQ:lPlUBVuLIz9eoBro3Bfp1GAQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319200", "to_ids": false, "type": "size-in-bytes", "uuid": "7c0ac190-ec7f-49cf-8480-82c2486c0d74", "value": "100454" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319200", "to_ids": true, "type": "vhash", "uuid": "35f8111c-1c33-4c02-bcd3-e70cb3c9cf71", "value": "94adb85f7fbad0f80c33baa7b4b5a5ed6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319200", "to_ids": true, "type": "filename", "uuid": "d9e4e545-0064-4c01-8b5e-96de322add2e", "value": "2523_18618309.pdf" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319200", "to_ids": false, "type": "text", "uuid": "b9bfdaa3-1096-40ac-8805-60ab7eb623d5", "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-02-03T08:58:18.000000+00:00\nLast Submission:2026-02-03T08:58:18.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781325120", "uuid": "af3e12bf-d209-4cbf-8729-6eb2e9c6a3e8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781325120", "to_ids": true, "type": "md5", "uuid": "12f86393-f098-4144-9085-726b29f4652b", "value": "ab7121d9dfa5d075498eb5a5904f1a0b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323429", "to_ids": true, "type": "sha1", "uuid": "45d6c930-9dfb-4280-b503-eab479e08d15", "value": "d8760cc8c5db1ed802a6cb50720afbc355623c17", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323430", "to_ids": true, "type": "sha256", "uuid": "3e3de7aa-e36a-4631-807f-e20b66ff663c", "value": "2a6ce2445c096fc5e577a0af513ba6f4fb8a8097764c7df81824a782e07e7f65", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319222", "to_ids": true, "type": "ssdeep", "uuid": "c1a5d612-3ff0-4cf0-89c1-3b818b9541a9", "value": "1536:lNw6u8k1ZycBBW00vVLyDqDmBz93u8r5QDQmcSA8l/CNcV9sxmni4ye:lPlUBVuLIz9eomDQmcX8l0cbcEIe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319222", "to_ids": false, "type": "size-in-bytes", "uuid": "becad1a4-1fdf-4159-ab4e-9ec899ece4c9", "value": "100205" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319222", "to_ids": true, "type": "vhash", "uuid": "6e532ed3-0903-434c-b269-4c180b8db5f9", "value": "94adb85f7fbad0f80c33baa7b4b5a5ed6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319222", "to_ids": true, "type": "filename", "uuid": "00ac8d91-9954-4382-ac90-d28e35448c0f", "value": "2523_20535887.pdf" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319222", "to_ids": false, "type": "text", "uuid": "2b5e7389-d78e-4a63-baa4-573c085b68e4", "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-02-03T13:05:00.000000+00:00\nLast Submission:2026-02-03T13:05:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781325141", "uuid": "7544459f-bbaa-40c8-8d16-b2b0b0b68ec1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781325141", "to_ids": true, "type": "md5", "uuid": "67e7e796-9d8b-424e-9ddd-fdcde6e4bb01", "value": "f68943c9f94af947e5bef95fa889de6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323431", "to_ids": true, "type": "sha1", "uuid": "642b0b0f-9a35-4288-a6c9-85711e1d6b52", "value": "98cda2572b49f9d984cb50c01a7fcd24a99d4ff4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323431", "to_ids": true, "type": "sha256", "uuid": "70e3a52b-6875-4006-9006-33371442a0f6", "value": "68bafc624a4c0d11ef7a949c0077c704aa5ba0a3205fe5b62d29b727b46ccfe4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319245", "to_ids": true, "type": "ssdeep", "uuid": "14b9ed46-ea28-4cbd-a67f-deef247a564c", "value": "6144:GylOULenPrFr9U2lD1uxF4FoJPX8hWfJQIW6DRcpw8k:Gyvenjx9fD1uTlmhcc6qpc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319245", "to_ids": false, "type": "size-in-bytes", "uuid": "cceff676-7a88-42f5-803a-4facc4b844e5", "value": "215218" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319245", "to_ids": true, "type": "vhash", "uuid": "b4b57148-0093-4ad6-9125-6798ed52bcad", "value": "97ae65c834d50d075ca30b1f2f05150a5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319245", "to_ids": true, "type": "filename", "uuid": "90eda872-b868-4d86-913a-6e46fd4174d0", "value": "\u0406\u043d\u0436\u0435\u043d\u0435\u0440\u043d\u0430 \u0440\u043e\u0442\u0430.pdf" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319245", "to_ids": false, "type": "text", "uuid": "50d61591-a85f-40ad-a841-26684af53b2d", "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-03-05T13:29:28.000000+00:00\nLast Submission:2026-03-05T13:29:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781325162", "uuid": "4acf048c-832b-4d11-a1d2-318115a8859e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781325162", "to_ids": true, "type": "md5", "uuid": "586868ca-62e9-41ff-9b58-34d9997df7f0", "value": "c06ef1a6be8b92cbc3eb710a7cfe83d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781323432", "to_ids": true, "type": "sha1", "uuid": "d82814cf-38bb-4616-9d7c-3a34fd0dc025", "value": "020b681541d12a8f316f626e6fb3e8c5b1b0cff0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781323432", "to_ids": true, "type": "sha256", "uuid": "fd6ef717-e298-4c1f-a73d-419a0236a21a", "value": "c2527a907b209bc4ce911e36b79781ec260f0851eeb466dbeb386d67fec11467", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781319267", "to_ids": true, "type": "ssdeep", "uuid": "9ca22057-2481-4ec1-b2ae-5358f86c7922", "value": "3072:V5HGl3wWcmn91g5iwpw2idYQbOuPN7Vxm04T0C0s/m:V5HM3wPmnngbw2idYQb7/L4TAQm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781319267", "to_ids": false, "type": "size-in-bytes", "uuid": "234527ab-6db8-4f2f-a8d6-03bf204df027", "value": "103785" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781319267", "to_ids": true, "type": "vhash", "uuid": "a2230467-e14c-4b35-9cfb-351afc2dfdfe", "value": "97ae65c834d50d075ca30b1f2f05150a5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781319267", "to_ids": true, "type": "filename", "uuid": "856453c6-f2b2-4c8b-ada8-fe9623031007", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260316-9055897-1.pdf" }, { "category": "Other", "comment": "Checked: 13/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781319267", "to_ids": false, "type": "text", "uuid": "493d7b52-ff15-4062-bfd7-dc1361cb0a98", "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-03-17T05:49:39.000000+00:00\nLast Submission:2026-03-18T07:33:50.000000+00:00" } ] } ] } }