{
  "Event": {
    "analysis": "1",
    "date": "2026-06-17",
    "extends_uuid": "",
    "info": "[Threat Intel] Crypto Clipper uses Tor and worm-like propagation for persistence and control",
    "protected": false,
    "publish_timestamp": "1782443579",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1782443579",
    "uuid": "19e880b4-5098-448b-a723-c74cc0872b88",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#96f4f6",
        "local": false,
        "name": "misp-galaxy:producer=\"Microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-original-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#705cef",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#8ee8d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dc839",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"",
        "relationship_type": ""
      },
      {
        "colour": "#3e2e74",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Replication Through Removable Media - T1091\"",
        "relationship_type": ""
      },
      {
        "colour": "#adf1b0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol - T1048.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#62f4c1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#110041",
        "local": false,
        "name": "rectifyq:sub-category=\"malware-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1a0065",
        "local": false,
        "name": "rectifyq:topic=\"crypto-related\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838036",
        "to_ids": false,
        "type": "link",
        "uuid": "ed225a0d-babc-4993-9b45-19027012e7e6",
        "value": "https://www.microsoft.com/en-us/security/blog/2026/06/17/crypto-clipper-uses-tor-worm-like-propagation-for-persistence-control/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838036",
        "to_ids": false,
        "type": "text",
        "uuid": "50ede887-fd6f-4ca3-b0e1-30c30dd6c33e",
        "value": "A Windows-based cryptocurrency clipper has been actively targeting users since February 2026, employing sophisticated techniques to steal digital assets. The malware propagates through malicious shortcut files on USB devices, creating a worm-like infection chain. Once deployed, it utilizes Windows Script Host and ActiveX to launch a bundled Tor proxy client, enabling anonymous communication with hidden-service command and control servers. The clipper performs high-frequency clipboard monitoring to intercept cryptocurrency wallet addresses, seed phrases, and private keys, replacing them with attacker-controlled alternatives. Additionally, it captures screenshots for context and maintains persistent access through scheduled tasks. The threat demonstrates advanced capabilities including remote code execution, making it more than a simple stealer by functioning as a lightweight backdoor. The malware employs multiple defense evasion techniques including multi-layer obfuscation, anti-analysis checks, and local S..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1781838036",
        "to_ids": false,
        "type": "text",
        "uuid": "eab65ce1-c299-42dc-be85-f86a3edc9776",
        "value": "Name: Crypto Clipper uses Tor and worm-like propagation for persistence and control\nAuthor: AlienVault\nAdversary: \nTags: [\"screenshot exfiltration\", \"seed phrase stealing\", \"cryptocurrency clipper\", \"cryptobandits\", \"clipboard hijacking\", \"remote code execution\", \"tor proxy\", \"contebrew\", \"wallet theft\", \"usb worm\"]\nTgtd countries: []\nMlwr families: [\"CryptoBandits\", \"Contebrew\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1115\", \"T1091\", \"T1090\", \"T1059\", \"T1048.002\", \"T1057\", \"T1027\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367530",
        "to_ids": true,
        "type": "domain",
        "uuid": "3db53bc8-8b09-4afa-b33f-cd0cd20fcf6b",
        "value": "facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367551",
        "to_ids": true,
        "type": "domain",
        "uuid": "73126f90-9c6b-440a-ab74-a5ba85198d24",
        "value": "ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367572",
        "to_ids": true,
        "type": "domain",
        "uuid": "de90da71-18c6-4533-a294-5676fc4609de",
        "value": "cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367594",
        "to_ids": true,
        "type": "domain",
        "uuid": "d30ab592-34c3-4a48-bdfb-029554d2357c",
        "value": "he5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367615",
        "to_ids": true,
        "type": "domain",
        "uuid": "d5f9dfa0-275a-49e6-9d24-d1708271bb05",
        "value": "shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367137",
        "to_ids": true,
        "type": "sha256",
        "uuid": "1f67f605-8faf-4dcc-9db7-4a52fef35016",
        "value": "0020d23b0f9c5e6851a7f737af73fd143175ee47054931166369edd93338538a",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367138",
        "to_ids": true,
        "type": "sha256",
        "uuid": "d3969d80-c8fe-4d0d-8aa9-683b0ab45322",
        "value": "100407796028bf3649752d9d2a67a0e4394d752eb8de86daa42920e814f3fae8",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367139",
        "to_ids": true,
        "type": "sha256",
        "uuid": "aa92d397-72cc-4a8e-8e35-4c5ec9623d32",
        "value": "23c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b43",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367140",
        "to_ids": true,
        "type": "sha256",
        "uuid": "3f2e7dfc-90f2-440b-a6a5-06ca5f62c25c",
        "value": "35a6bc44b176a050fd6824904b7604f0f45b0fdfa26bf9500b9e05973b387cfd",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367142",
        "to_ids": true,
        "type": "sha256",
        "uuid": "f2ca5332-f947-4e2f-b080-71dff1e3458b",
        "value": "67fc5cf395e28294bbb91ed0e954fdf2e80ebd9119022a115a42c286dc8bacf5",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367142",
        "to_ids": true,
        "type": "sha256",
        "uuid": "de9f3ac1-dd69-4fbc-ac5a-ce14aac0abe6",
        "value": "7630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367143",
        "to_ids": true,
        "type": "sha256",
        "uuid": "6409e29d-b0cb-4eb3-8bd2-f85e91cdd55a",
        "value": "7787a9a7d8ae393aa32f257d083903c4dc9b97a1e5b0458c4cd480d4f3cb5b05",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367144",
        "to_ids": true,
        "type": "sha256",
        "uuid": "41ad2104-7798-41dd-9582-1c7e29e837bb",
        "value": "9d90f54ae36c6c5435d5b8bed40faf54cc91f6db28574a6310b5ffaeb0362e96",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367145",
        "to_ids": true,
        "type": "sha256",
        "uuid": "4f3be853-0680-4ee2-971d-811038b40014",
        "value": "a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367146",
        "to_ids": true,
        "type": "sha256",
        "uuid": "06e6bc1b-35b8-41d9-860e-46bbc9b75ce3",
        "value": "b2777b73a4c33ac6a409d475057843be6b5d32262ef28a1f1ff5bb52e3834c5f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367147",
        "to_ids": true,
        "type": "sha256",
        "uuid": "e0a9c932-6067-4277-8657-f4b7df6b79d8",
        "value": "cf9fc891ea5ca5ecd8113ef3e69f6f52ff538b6cccbdaa9559106fc72bc6da30",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367148",
        "to_ids": true,
        "type": "sha256",
        "uuid": "ae89094c-3ead-4404-98b9-28657dd06c25",
        "value": "d14b80cbd1a19d4ad0473a0661297f8fdf598e81ff6c4ab24e212dcad2e54b3f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367149",
        "to_ids": true,
        "type": "sha256",
        "uuid": "11a4f854-974f-4606-bf7e-479fde0c8827",
        "value": "d43bf94f0cb0ab97c88113b7e07d1a4024d1610617b5ad05882b1dbab89e15ba",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "Crypto Clipper Worm No sample in VT\r\nLast check:25/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367150",
        "to_ids": true,
        "type": "sha256",
        "uuid": "762c0789-ca2f-4e62-9153-0edb78e9da9e",
        "value": "f3b54984caca95fd496bcfe5d7db1611b08d2f5b7d250b43b430e5d76393f9e0",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367636",
        "to_ids": true,
        "type": "domain",
        "uuid": "7c214993-2020-4e75-8f21-21ac0f27e150",
        "value": "7goms4byw26kkbaanz5a5u5234gusot7rp5imzc3ozh66wwcvmcudjid.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367657",
        "to_ids": true,
        "type": "domain",
        "uuid": "54082d48-5835-4033-9c56-d7b7a5755b35",
        "value": "gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367678",
        "to_ids": true,
        "type": "domain",
        "uuid": "bd3186c5-4adf-4246-a566-c85bab4a89a1",
        "value": "j3bv7g27oramhbxxuv6gl3dcyfmf44qnvju3offdyrap7hurfprq74qd.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367699",
        "to_ids": true,
        "type": "domain",
        "uuid": "6c1052c0-b17c-4c0e-ab0a-ae50512eadc9",
        "value": "lyhizqy2js2eh6ufngkbzntouiikdek5zsdj3qwa22b4z6knpqorgiad.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1782367720",
        "to_ids": true,
        "type": "domain",
        "uuid": "4efe4d6f-127c-4d92-9016-bdccfa6a66b8",
        "value": "wt26llpl5k6gok3vnaxmucwgzv2wk3l7nuibbh25clghrtus3p5ctsid.onion",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782367742",
        "uuid": "8398fd2f-4fb4-40e9-9fad-565f8bce2b60",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Crypto Clipper Worm",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782367742",
            "to_ids": true,
            "type": "md5",
            "uuid": "80b6f2a1-7261-483d-a3b2-5312bb025e41",
            "value": "03b51af0a04467cebfa235199db4c02e",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Crypto Clipper Worm",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367134",
            "to_ids": true,
            "type": "sha1",
            "uuid": "d30428dd-1791-467b-9ae9-63988e198bda",
            "value": "bbe05d2f2487ed09e1062111fd448822364a44a7",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Crypto Clipper Worm",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367134",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c6a65c1a-2790-4ba4-9430-ed084b24529a",
            "value": "c824630154ac4fdfce94ded01f037c305eab51e9bef3f493c60ff3184a640502",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782365272",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "7a09d868-6548-48d9-a34b-479c2e63f887",
            "value": "393216:IMk62WmF2JDEwXMCHWUjXacuI3/PGTAI:IMkL92XMb8XXH/O7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782365272",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "f2476e64-685c-450a-9d70-6bda4ad44adb",
            "value": "12620981"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782365272",
            "to_ids": true,
            "type": "vhash",
            "uuid": "8c015772-ebad-4b08-adf3-0bf4d718ab5f",
            "value": "0170a66d1565151c051d004013z300344ekz1cfz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782365272",
            "to_ids": true,
            "type": "filename",
            "uuid": "887a2672-f087-4a1d-9632-142a3cdd5735",
            "value": "fjgn9.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782365272",
            "to_ids": false,
            "type": "text",
            "uuid": "dc8e582e-d62c-42eb-9d5d-030db6a8f1b0",
            "value": "Crypto Clipper Worm\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/Tedy.BAK!MTB\nVT Total Detection:44/69\nFirst Submission:2026-05-24T07:16:36.000000+00:00\nLast Submission:2026-05-25T00:14:17.000000+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1782367763",
        "uuid": "912442bb-8e0d-470e-818a-2398ee011e28",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "Crypto Clipper Worm",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1782367763",
            "to_ids": true,
            "type": "md5",
            "uuid": "812fe8cd-35fa-42bc-9b8e-9db376c418fb",
            "value": "2886862dc3b6e6fd6a4167582edac9f9",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Crypto Clipper Worm",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1782367136",
            "to_ids": true,
            "type": "sha1",
            "uuid": "0c3826a9-9a3d-40ab-9890-6b9bb8b307c5",
            "value": "090957fd122dd6a9debe8c41b035f9c471430b81",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "Crypto Clipper Worm",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1782367136",
            "to_ids": true,
            "type": "sha256",
            "uuid": "2cb3d24e-cb41-4dd5-8e68-8883568ff6fa",
            "value": "20db98af3037b197c8a846dbf17b87fc6f049c3e0d9a188f9b9a74d3916dd5e1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1782365336",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "af75cd92-4625-43d9-b450-9c21789100b5",
            "value": "393216:Loh1Dn+c9w/dsLvYj8z6XMCHWUjXCcuI3/PGTAI:LwZ1i/dsRz6XMb8X/H/O7"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1782365336",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "0345cedb-caa9-475c-aacf-84298750ad2d",
            "value": "13850391"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1782365336",
            "to_ids": true,
            "type": "vhash",
            "uuid": "41934ffe-0b86-439c-ad24-5cb46073c74f",
            "value": "0170a66d1565151c051d004013z300344ekz1cfz"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1782365336",
            "to_ids": true,
            "type": "filename",
            "uuid": "796a5d38-8ae3-4a38-8136-af0fb6e52453",
            "value": "treesize_treesize_x3.exe"
          },
          {
            "category": "Other",
            "comment": "Checked: 25/06/2026\nLast-scan\t:  24/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1782365336",
            "to_ids": false,
            "type": "text",
            "uuid": "c958cd33-d8f9-4f83-ae2b-3b96d398f7a1",
            "value": "Crypto Clipper Worm\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/Tedy.BAK!MTB\nVT Total Detection:44/69\nFirst Submission:2026-05-15T10:06:44.000000+00:00\nLast Submission:2026-05-15T10:52:47.000000+00:00"
          }
        ]
      }
    ]
  }
}