{ "Event": { "analysis": "1", "date": "2026-06-19", "extends_uuid": "", "info": "[Threat Intel] Operation FlutterBridge: The FlutterShell macOS Backdoor", "protected": false, "publish_timestamp": "1782443588", "published": true, "threat_level_id": "2", "timestamp": "1782443588", "uuid": "1dabd23d-c747-4390-8884-cc3d8e81d2ee", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#3bc6ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Code Signing - T1553.002\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#029dd6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Extensions - T1176\"", "relationship_type": "" }, { "colour": "#62e1b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"", "relationship_type": "" }, { "colour": "#9e0269", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#7628f7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#15723e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"", "relationship_type": "" }, { "colour": "#680082", "local": false, "name": "ms-caro-malware:malware-platform=\"MacOS\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781866812", "to_ids": false, "type": "link", "uuid": "14c96018-dd53-4281-8c3d-21a5f67a967a", "value": "https://www.levelblue.com/blogs/spiderlabs-blog/operation-flutterbridge-the-fluttershell-macos-backdoor" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781866812", "to_ids": false, "type": "text", "uuid": "a5016fdb-9e2c-4556-8e33-bc6bf94271d7", "value": "FlutterShell is a macOS backdoor campaign active from December 2025 to March 2026, identified as cluster CL-CRI-1089 under Operation FlutterBridge. The threat actors deliberately misused the Flutter framework to deliver malware through malvertising campaigns on Google and YouTube. The malware employs a two-component architecture: a thin Mach-O launcher and a large Flutter payload dylib. Across three generations, the operators rotated Apple Developer certificates, implemented progressive Dart obfuscation, and renamed bridge commands to evade detection. The backdoor uses a WKWebView to load attacker-controlled JavaScript from C2 servers, implementing a conditional execution model where commands are delivered at runtime via a JavaScript-to-native bridge called flutterInvoke. The primary impact includes Chrome browser hijacking to inject sinterfumesco[.]com as the default search provider and persistent infection through silent Sparkle framework updates." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781866812", "to_ids": false, "type": "text", "uuid": "bc09a9ae-6ac0-43b3-bb5a-5b20a262106e", "value": "Name: Operation FlutterBridge: The FlutterShell macOS Backdoor\nAuthor: AlienVault\nAdversary: \nTags: [\"browser hijacking\", \"operation flutterbridge\", \"certificate rotation\", \"dart obfuscation\", \"macos backdoor\", \"flutter framework abuse\", \"fluttershell\", \"c2-conditional payload\"]\nTgtd countries: []\nMlwr families: [\"FlutterShell\"]\nAttack_ids: [\"T1204.002\", \"T1553.002\", \"T1082\", \"T1176\", \"T1185\", \"T1102\", \"T1041\", \"T1566\", \"T1059.004\", \"T1027\", \"T1543.001\", \"T1071.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441279", "to_ids": true, "type": "domain", "uuid": "fe684999-f54f-4269-8708-cc37ce88265b", "value": "atsheisdomestic.org", "Tag": [ { "colour": "#81bddc", "local": false, "name": "QuotaExceededError", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441300", "to_ids": true, "type": "domain", "uuid": "79e3ee2c-30e7-4dcf-a78f-c1c83cb1be49", "value": "etoftheappyrince.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441324", "to_ids": true, "type": "domain", "uuid": "34ccca54-2cfb-4aa3-9649-a5f593a02d0a", "value": "healightejustb.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441345", "to_ids": true, "type": "domain", "uuid": "e4d9b1ad-aa5c-4592-bdb2-2aded114f927", "value": "sinterfumesco.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441366", "to_ids": true, "type": "url", "uuid": "4f1e9f6a-b1e6-41b1-b8c9-f51066c300e8", "value": "https://atsheisdomestic.org/update-thanks.html", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782367199", "to_ids": true, "type": "md5", "uuid": "efa3bb97-2cca-4cf2-9ff2-2f78a30d5a46", "value": "605169623267c4eb73693b22b811dc7a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782367201", "to_ids": true, "type": "md5", "uuid": "a3e69f0b-aa08-4a28-aa5d-4c35de309725", "value": "b4aa7255af4b016586090a5b451300fa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782367202", "to_ids": true, "type": "md5", "uuid": "0540be69-4732-400d-ae0b-1ea11cc4fd9b", "value": "ffd773f157df70291f0910a45a1d8d9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441387", "to_ids": true, "type": "url", "uuid": "142dff04-5c4d-4c53-ac1d-72dd5f99d399", "value": "https://atsheisdomestic.org/api/podcasts", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441408", "to_ids": true, "type": "url", "uuid": "1db87647-41be-46ee-abb3-73f209da03fd", "value": "https://atsheisdomestic.org/api/subscribe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441429", "to_ids": true, "type": "url", "uuid": "00de6548-839c-4a1b-9f3a-f215c7d7ed0b", "value": "https://atsheisdomestic.org/api/update-delay", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441450", "to_ids": true, "type": "url", "uuid": "8e97be14-363a-4278-91e0-fb98f68e3868", "value": "https://etoftheappyrince.org", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441471", "to_ids": true, "type": "url", "uuid": "a3f73d47-dd30-4818-9b37-a646a12eb841", "value": "https://etoftheappyrince.org/...", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441492", "to_ids": true, "type": "url", "uuid": "d7cffb90-da4a-49ab-b23b-e937e4f0a743", "value": "https://etoftheappyrince.org/api/pdfs", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441513", "to_ids": true, "type": "url", "uuid": "402c0acb-7b34-44b2-938a-cbefb39f7193", "value": "https://etoftheappyrince.org/api/update-delay", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441534", "to_ids": true, "type": "url", "uuid": "2e2d9c5f-dbc9-4395-82a2-53e5489e30c5", "value": "https://etoftheappyrince.org/summarize-text", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441555", "to_ids": true, "type": "url", "uuid": "b4b3cca3-b6e0-4e69-b230-09390627846a", "value": "https://etoftheappyrince.org/update-thanks.html", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441576", "to_ids": true, "type": "url", "uuid": "cf55849a-9e05-4551-bb18-88b9b5f9481d", "value": "https://healightejustb.org/api/central-config", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441598", "to_ids": true, "type": "url", "uuid": "e49e3e9f-aeaf-4ab6-a8d4-779a5abec210", "value": "https://healightejustb.org/checkForNewVersion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441619", "to_ids": true, "type": "url", "uuid": "cd0416aa-200e-43c5-95f0-217e0deeca52", "value": "https://healightejustb.org/summarize-text", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441640", "to_ids": true, "type": "url", "uuid": "06b80498-444d-401a-b3a5-c3925e2707dd", "value": "https://healightejustb.org/welcome_page.html", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441661", "to_ids": true, "type": "url", "uuid": "28c8b6c6-d384-4768-8ef7-2fdd35b4d460", "value": "https://healightejustb.org/welcome_page.js", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782367203", "to_ids": true, "type": "sha1", "uuid": "66ed80af-d236-4da3-b626-4ca7c048bd31", "value": "a247a63644c3475f436d076f55523ea39afd8c41", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782367204", "to_ids": true, "type": "sha1", "uuid": "b8881a32-5b2f-4e6e-88e6-ff9a800cf642", "value": "bb1e6e2650d3d77d732c5eb5176011f914dd87df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441682", "to_ids": true, "type": "hostname", "uuid": "8ad4236d-f309-491e-9407-20e9ff3b0e7c", "value": "event.process.name", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782441703", "to_ids": true, "type": "hostname", "uuid": "bbcd7a01-0611-44cf-9a00-a8e7fba5f66b", "value": "event.process.parent.name", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346227", "to_ids": false, "type": "threat-actor", "uuid": "8d5f86ed-67af-45c4-94cd-9fda1659ecbd", "value": "CL-CRI-1089" } ], "Object": [ { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782346288", "uuid": "8f6492e8-502b-4d28-9e3f-def96757e138", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782346288", "to_ids": false, "type": "text", "uuid": "d43d30d8-a25a-42da-a6ac-5c56f23b9bb4", "value": "MAL_FlutterShell_CL_CRI_1089_Dylib_Cluster" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782346288", "to_ids": false, "type": "comment", "uuid": "4508a6df-ca5b-4912-90cb-f4278da77569", "value": "FlutterShell payload dylib , all generations , symhash cluster" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782346288", "to_ids": true, "type": "yara", "uuid": "dfc44f56-947f-4247-94fa-4a2da34a6e1b", "value": "rule MAL_FlutterShell_CL_CRI_1089_Dylib_Cluster {\r\n meta:\r\n description = \"FlutterShell payload dylib , all generations , symhash cluster\"\r\n cluster = \"CL-CRI-1089\"\r\n symhash = \"605169623267c4eb73693b22b811dc7a\"\r\n evidence_basis= \"Observed: identical symhash across 6/6 dylibs\"\r\n gen1_x86 = \"134517796178a150a1585672be134169d6877082b598d840baa3f37b0222be26\"\r\n gen2_x86 = \"bf90fb31e6024d7e6616f5acd0e8aa28738a9095a508c1a986e1e974cb9e79a0\"\r\n gen3_x86 = \"2c5bc9e95e1e9b73e3ba8870a008802899866a2c0e2e10112aefddf7a96af04e\"\r\n condition:\r\n /* Mach-O thin dylib, 64-bit */\r\nuint32(0) == 0xFEEDFACF and uint32(12) == 6 and\r\n /* Size range spans all known generations */\r\nfilesize >= 6MB and filesize <= 12MB and\r\n /* LC_ID_DYLIB self-identifier */\r\n\"io.flutter.flutter.app\" in (0..500) and\r\n /* Single external dependency */\r\n\"/usr/lib/libSystem.B.dylib\" in (0..1000)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782346306", "uuid": "f4648707-2418-4059-b8f4-b684e7ecc47d", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782346306", "to_ids": false, "type": "text", "uuid": "5d0c1743-881e-4941-8300-c12fe0967a76", "value": "Network_And_Hijack_Domains" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782346306", "to_ids": false, "type": "comment", "uuid": "2ac0ef3f-51e9-4ceb-96cc-1b6b5bf55617", "value": "Network_And_Hijack_Domains" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782346306", "to_ids": true, "type": "yara", "uuid": "59aa78da-ce06-47f3-9f06-29621f895414", "value": "rule Network_And_Hijack_Domains {\r\n meta:\r\n retire_date = \"2026-09\"\r\n cluster = \"CL-CRI-1089\"\r\n strings:\r\n $g1 = \"atsheisdomestic.org\" nocase ascii wide\r\n $g2 = \"etoftheappyrince.org\" nocase ascii wide\r\n $g3 = \"healightejustb.org\" nocase ascii wide\r\n $hijack = \"sinterfumesco.com\" nocase ascii wide\r\n condition:\r\n uint32(0) == 0xFEEDFACF and 1 of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782346328", "uuid": "4cd61a15-07ea-4d87-bfa6-11e291cc2ea3", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782346328", "to_ids": false, "type": "text", "uuid": "d60ac762-f991-4198-a077-01caa2b0cc6f", "value": "MAL_FlutterShell_CL_CRI_1089_Plugin_Typo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782346328", "to_ids": false, "type": "comment", "uuid": "57d9dd6e-a94f-4064-a63e-daaad27070eb", "value": "Detects FlutterShell via persistent plugin name typo , durable across generations" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782346328", "to_ids": true, "type": "yara", "uuid": "f15df8c8-90eb-4a4d-a58a-184eaf0a76ff", "value": "rule MAL_FlutterShell_CL_CRI_1089_Plugin_Typo {\r\n meta:\r\n description = \"Detects FlutterShell via persistent plugin name typo , durable across generations\"\r\n cluster = \"CL-CRI-1089\"\r\n strings:\r\n $typo = \"plugins.flutter.io/path_providerr\" ascii wide // double 'r' , confirmed in Gen 1 + Gen 3\r\n $wv = \"plugins.flutter.io/webview\" ascii wide\r\n $sp = \"plugins.flutter.io/shared_preferences\" ascii wide\r\ncondition:\r\n $typo and 1 of ($wv, $sp)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441724", "uuid": "1ad81922-d00c-4ee3-bee7-7b8d536c6e6c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441724", "to_ids": true, "type": "md5", "uuid": "f73594ac-ac37-4311-982c-4aef98be6e2e", "value": "638b0a77a6d686849a78b500adf5e565", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367188", "to_ids": true, "type": "sha1", "uuid": "6a66e730-1588-4b60-a013-9044804e16d6", "value": "c40126fea6ed24652a3e4e19205075cb02cca3e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367188", "to_ids": true, "type": "sha256", "uuid": "2e6ccdcd-f156-4f59-8cf3-b0a9029d2b59", "value": "363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc34", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366159", "to_ids": true, "type": "ssdeep", "uuid": "03426e94-1239-4859-8dc4-301add15a184", "value": "6144:bvcRBH2Vx1reuvmPzEva3Z3Vx1YV1pb4fm:gjb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366159", "to_ids": false, "type": "size-in-bytes", "uuid": "4cf2438e-3ef8-477c-ab80-039096e8dc73", "value": "338832" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366159", "to_ids": true, "type": "vhash", "uuid": "0550cbc1-55ff-44cd-a906-abc04ffea63e", "value": "74b5e6e00fa0cd43a188d178bda07e46" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366159", "to_ids": true, "type": "filename", "uuid": "4498fe21-85cb-4888-91dc-9847dd5596e6", "value": "com.app.podcastsLounge" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366159", "to_ids": false, "type": "text", "uuid": "6a8ce15f-14e4-4851-bb09-90ba0ac6bc88", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/SAgent!MSR\nVT Total Detection:23/63\nFirst Submission:2025-12-02T15:45:51.000000+00:00\nLast Submission:2025-12-02T15:45:51.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441745", "uuid": "0ad2db53-b56a-4e76-a026-2cff99f4c89a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441745", "to_ids": true, "type": "md5", "uuid": "0b017372-74a2-4444-8d87-d982177da583", "value": "17fb3a1244407e66c45880be97af06cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367189", "to_ids": true, "type": "sha1", "uuid": "8e1b3b8f-6c1b-4680-8b8c-50f5917fec8c", "value": "7ba354524437534270c01cc91433cb4c870304a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367189", "to_ids": true, "type": "sha256", "uuid": "e85ca302-40a1-41be-b6cf-9f01d594ac5f", "value": "134517796178a150a1585672be134169d6877082b598d840baa3f37b0222be26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366244", "to_ids": true, "type": "ssdeep", "uuid": "6d914cf6-78d0-4e79-9c4d-35c029aa9d91", "value": "98304:TaKkqt9yBXvInfllRUCZjYl9eJhnVWpQwc4Nz:TaKkqt9yBXvInflAeJhnk3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366244", "to_ids": false, "type": "size-in-bytes", "uuid": "89980141-ef35-4cbc-ada4-ad84d6d5c5bc", "value": "7077984" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366244", "to_ids": true, "type": "vhash", "uuid": "3a7e2c38-487c-4486-8be3-022930117850", "value": "ffd773f157df70291f0910a45a1d8d9a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366244", "to_ids": true, "type": "filename", "uuid": "2b020011-adc1-44e4-8341-c6e99379b4cd", "value": "io.flutter.flutter.app" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366244", "to_ids": false, "type": "text", "uuid": "f7da3296-9a4d-4f9e-ad88-fa74bb1d3e60", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:23/63\nFirst Submission:2025-12-12T18:43:44.000000+00:00\nLast Submission:2025-12-12T18:43:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441768", "uuid": "49514256-5a26-4d00-95d0-13ba9cda8166", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441768", "to_ids": true, "type": "md5", "uuid": "75cf0f19-b69b-46d3-9f95-a3d2fc7774a0", "value": "e41b8c7affb44faeab36703139ab2013", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367190", "to_ids": true, "type": "sha1", "uuid": "62b98dac-69b2-4c92-b05e-524a8afd9192", "value": "4e28cfa9629b14595073a6adcb64dc13e803d2e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367190", "to_ids": true, "type": "sha256", "uuid": "4e061b3e-d457-440a-8bfe-8b3afa409c1a", "value": "2c5bc9e95e1e9b73e3ba8870a008802899866a2c0e2e10112aefddf7a96af04e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366266", "to_ids": true, "type": "ssdeep", "uuid": "c00b2e8f-6012-4b6c-93d3-bb446e3eae0b", "value": "98304:ZU1z4jVTyTffKSPRrFqPbzw8aMdfmUL0Eo2D7n3HcwvGcw7:ZU1z4jVEffKSPJFqPbUJUL0EVA9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366266", "to_ids": false, "type": "size-in-bytes", "uuid": "1d992bc1-c6b6-4979-af7c-7c5bca8c3f34", "value": "8569680" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366266", "to_ids": true, "type": "vhash", "uuid": "04e00dc6-3a2f-47e1-8816-d386f5967a31", "value": "ffd773f157df70291f0910a45a1d8d9a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366266", "to_ids": true, "type": "filename", "uuid": "06e28e1f-8eb3-4d41-9785-7c204e3b8df1", "value": "io.flutter.flutter.app" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366266", "to_ids": false, "type": "text", "uuid": "170ba7d9-d025-4c2b-9b73-1ceea1954e70", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:13/63\nFirst Submission:2026-03-10T17:50:31.000000+00:00\nLast Submission:2026-03-10T17:50:31.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441789", "uuid": "329490b5-71ab-4b6e-b3d5-de0417dc13ee", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441789", "to_ids": true, "type": "md5", "uuid": "c6f2faa3-e527-43ff-ae18-77138b641380", "value": "6521c0c1a27ba17fbf2da367eaddfa0c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367192", "to_ids": true, "type": "sha1", "uuid": "fa0585aa-30e2-45a4-b016-80fcef4366c1", "value": "a4f32293c112f5c729c6c57cad7ea4e2b185411d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367192", "to_ids": true, "type": "sha256", "uuid": "64a28253-d783-4f7f-8cb6-ba90f421c3b2", "value": "32da1437a2734224406c7e5e8d756f0c0cd58c0c959478571cbfc0cd564d018a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366288", "to_ids": true, "type": "ssdeep", "uuid": "c9a8691d-975b-49a3-bb9f-78d2def84ea2", "value": "98304:r1hhxMlUS1u/84tBMfL1bxvOBCTouteGrpDRcGj:ThxlSVuMfL1bgBCXtBy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366288", "to_ids": false, "type": "size-in-bytes", "uuid": "485be5c8-e70d-4308-bfa0-4f7ab1def83d", "value": "10204560" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366288", "to_ids": true, "type": "vhash", "uuid": "03ee7bf7-ce00-425f-b7e7-36ff59a20301", "value": "b4aa7255af4b016586090a5b451300fa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366288", "to_ids": true, "type": "filename", "uuid": "1d866d46-169e-45ea-9bc2-eefec2429c42", "value": "io.flutter.flutter.app" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366288", "to_ids": false, "type": "text", "uuid": "6e07bf01-c950-4673-ae2c-7acb073c7c0a", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:30/63\nFirst Submission:2026-01-12T06:59:39.000000+00:00\nLast Submission:2026-01-12T06:59:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441811", "uuid": "4398f837-af10-423d-9e2d-4b32ee842aa4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441811", "to_ids": true, "type": "md5", "uuid": "a6c7218f-94fe-4b30-adff-1162542a5bce", "value": "7b803fe9c33f61653cb3c5e964921394", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367192", "to_ids": true, "type": "sha1", "uuid": "62a4deeb-d240-4d76-9a7c-47652c22b6b5", "value": "0cd300b21f82522ad7c074647458cb399a842374", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367193", "to_ids": true, "type": "sha256", "uuid": "edab7e81-0e4c-492e-a66d-f19e78f31c4c", "value": "6c3f61d46d4de26b9cb16808bf17c33ae69f651a4b879e7b5612ff7f548e2a82", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366310", "to_ids": true, "type": "ssdeep", "uuid": "b2a24dc8-61ca-4cd1-9c28-0dd4f303c787", "value": "3072:tCjLgCi1027HUCmx1Vnllkd9LTbu+62Qq:tw+7HUCmx1Vll43NB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366310", "to_ids": false, "type": "size-in-bytes", "uuid": "5e0bc19d-0bcc-4f7e-8e14-455d12864625", "value": "152112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366310", "to_ids": true, "type": "vhash", "uuid": "a741a0b5-f245-4845-b2a0-53a779dbd5d4", "value": "ffd9890f38689ac884f59a1ae30c6502" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366310", "to_ids": true, "type": "filename", "uuid": "019c78ef-722d-4a08-b25e-97812ce78f5b", "value": "com.app.podcastsLounge" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366310", "to_ids": false, "type": "text", "uuid": "b2eef67e-f83a-476c-ae48-df7293cceae6", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:13/63\nFirst Submission:2025-12-12T18:44:37.000000+00:00\nLast Submission:2025-12-12T18:44:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441832", "uuid": "e99090a2-9ffc-48e0-8bf0-3449e2fef13f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441832", "to_ids": true, "type": "md5", "uuid": "690790cc-ad0d-4a65-9cac-373359226e87", "value": "bbd91ec6d87e7555897364ffa20a2ad9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367194", "to_ids": true, "type": "sha1", "uuid": "d8c1e87a-dfbc-4f12-a22d-4273857dd52d", "value": "c6fe3acf6abc281dec4401eaeae8f10d1d29073e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367194", "to_ids": true, "type": "sha256", "uuid": "d08c2091-b2ae-4aa8-ada5-c9836ed89ff2", "value": "bf90fb31e6024d7e6616f5acd0e8aa28738a9095a508c1a986e1e974cb9e79a0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366332", "to_ids": true, "type": "ssdeep", "uuid": "86df8f40-0b08-4c6b-8532-d0478662e245", "value": "196608:dYx8LU/QUPbpz7ePlh8ouypT68gQ4DKON2D:huypiOON2D" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366332", "to_ids": false, "type": "size-in-bytes", "uuid": "4b584cc5-0f27-4366-88ce-99fcfe498c92", "value": "10526512" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366332", "to_ids": true, "type": "vhash", "uuid": "1edf3449-b498-49ca-be31-ad1ad06766be", "value": "ffd773f157df70291f0910a45a1d8d9a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366332", "to_ids": true, "type": "filename", "uuid": "16a48f99-3d4c-459f-8366-a878cd20dcee", "value": "io.flutter.flutter.app" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366332", "to_ids": false, "type": "text", "uuid": "8a069995-6d79-48f6-bb0f-13c212cd9562", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:30/63\nFirst Submission:2026-01-12T06:59:40.000000+00:00\nLast Submission:2026-01-12T06:59:40.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441853", "uuid": "aef64d65-2543-4c1b-a301-356f0e413fe1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441853", "to_ids": true, "type": "md5", "uuid": "c72571c4-9474-4b18-80ee-f09c0f43a3ba", "value": "2524b931c8af0236d553390e759bbe15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367195", "to_ids": true, "type": "sha1", "uuid": "7480a8f4-106f-4390-8cb9-9f26819471f9", "value": "e7802a5c6f76aa34cf619b15598e579418c25f39", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367195", "to_ids": true, "type": "sha256", "uuid": "24ff2d79-7c29-42b5-90a1-7e45ff333362", "value": "cc4f048e66c5ab3c0f1d767bb8fc464d082641f4888ea3cd14ea3775077c4bf2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366353", "to_ids": true, "type": "ssdeep", "uuid": "519df42d-5a71-4411-b5a2-d7c9abca683d", "value": "49152:TnXCGYW6WbjsEFch4WCL3vK+gnaYiKVofn/G16KP0hW7qVO2GDU8gRFp34KSx3Oz:TF/KP0hY434KSB9qxVZYj9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366353", "to_ids": false, "type": "size-in-bytes", "uuid": "371570de-eaab-44c1-8294-46de02e669a1", "value": "6823504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366353", "to_ids": true, "type": "vhash", "uuid": "4e5dd2d0-f072-462c-ba88-1e6d5dced854", "value": "b4aa7255af4b016586090a5b451300fa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366353", "to_ids": true, "type": "filename", "uuid": "484d14f1-9356-4b22-bf43-1a129330db0a", "value": "io.flutter.flutter.app" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366353", "to_ids": false, "type": "text", "uuid": "0f613978-0b54-4f3a-90eb-70e3d71be9b1", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:22/63\nFirst Submission:2025-12-12T18:43:43.000000+00:00\nLast Submission:2025-12-12T18:43:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441874", "uuid": "c8655a8a-5793-46de-8242-556adc1c7d69", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441874", "to_ids": true, "type": "md5", "uuid": "8a86f061-47f5-4a6c-a187-4cbdfc53643a", "value": "132989f60867a9b7f0b916194e4f86a0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367197", "to_ids": true, "type": "sha1", "uuid": "27bc157d-6a58-44b0-bc78-e6198d51a720", "value": "99709c3440fa28fe182efc343debc15bbc233f4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367197", "to_ids": true, "type": "sha256", "uuid": "953da139-fbc1-420f-85f7-688b0263ab98", "value": "f544bfab72d380cc20692d8ec9d31ea666785fe225dccd55beab29a3c0fdfad2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366375", "to_ids": true, "type": "ssdeep", "uuid": "26e50fbc-9fc6-4239-9081-2efc6e88c0f7", "value": "98304:KUyM6RqcshEQ5ZG24n7cY1Uoom0jeOPM8jf:nV87fom0G0f" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366375", "to_ids": false, "type": "size-in-bytes", "uuid": "71658aea-3f4a-4829-83f8-380f0e9eb790", "value": "8256000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366375", "to_ids": true, "type": "vhash", "uuid": "883bd331-0a26-4b8c-b99d-84f24c812ea2", "value": "b4aa7255af4b016586090a5b451300fa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366375", "to_ids": true, "type": "filename", "uuid": "2b5277e3-f6ad-47df-93ff-353072d99b32", "value": "io.flutter.flutter.app" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366375", "to_ids": false, "type": "text", "uuid": "1551d2ef-de8b-44c9-8840-8aa5e4ecf512", "value": "Type Description: Mach-O\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:13/63\nFirst Submission:2026-03-10T17:50:31.000000+00:00\nLast Submission:2026-03-10T17:50:31.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782441895", "uuid": "4c93686f-2a42-4dba-a6c3-c06237fb4813", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782441895", "to_ids": true, "type": "md5", "uuid": "48a29907-73ac-4d66-833a-fe3db4fee37e", "value": "7e36eb398dc931f82be8ebe452e47e6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782367198", "to_ids": true, "type": "sha1", "uuid": "78dd2012-12a7-4d19-bc17-e1bea61c02d2", "value": "f8ba579e7572e9cde68d6690fddf13194be1f16e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782367198", "to_ids": true, "type": "sha256", "uuid": "a5eb1c5c-3225-4a0d-b02e-ce35bf447bd5", "value": "fc091ddb4d845280aeb7745cfdb6b7cb0013abc35db9e634f055b8e8fb0b5b1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782366397", "to_ids": true, "type": "ssdeep", "uuid": "d9f81c8f-6d63-457f-af6a-da2559ea2fc3", "value": "1536:hVk/wMJNXBL0Kjt9X1Cxl6qCvCmx1BKbzVnnvWPOMd17hPfJukswD4czGNIfTX9s:pmbkl6/vCmx1invXMd1lmu7VWKV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782366397", "to_ids": false, "type": "size-in-bytes", "uuid": "5f9227bb-3534-487c-bd35-0e4afd5bb659", "value": "158464" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782366397", "to_ids": true, "type": "vhash", "uuid": "a33de8d2-24da-4f85-aa34-dc776b22eb47", "value": "9003b99050b662739b29f5a5c6662ba4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782366397", "to_ids": true, "type": "filename", "uuid": "f7711438-766a-46b7-b7c3-0c9aafc0e25b", "value": "com.app.podcastsLounge" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 25/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782366397", "to_ids": false, "type": "text", "uuid": "1c8a67bb-1023-4b95-918e-e0a3e931e14d", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:15/63\nFirst Submission:2025-12-12T18:44:36.000000+00:00\nLast Submission:2025-12-12T18:44:36.000000+00:00" } ] } ] } }