{ "Event": { "analysis": "1", "date": "2026-06-09", "extends_uuid": "", "info": "[Threat Intel] Technical Analysis of MLTBackdoor", "protected": false, "publish_timestamp": "1781559727", "published": true, "threat_level_id": "3", "timestamp": "1781559727", "uuid": "1e7ef089-c72a-4013-a7ea-a5b3e9c56c8c", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#6dbaba", "local": false, "name": "misp-galaxy:producer=\"Zscaler\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#f4b62b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#08b028", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#8bde06", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"NTFS File Attributes - T1564.004\"", "relationship_type": "" }, { "colour": "#cb2c9b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781089209", "to_ids": false, "type": "link", "uuid": "6759be25-8a41-48e2-a6df-7a9fca7e068d", "value": "https://www.zscaler.com/blogs/security-research/technical-analysis-mltbackdoor" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781089209", "to_ids": false, "type": "text", "uuid": "41be96e4-9840-47d7-9708-f440ba49385d", "value": "In May 2026, a new malware family named MLTBackdoor was identified, likely leveraged by ransomware-related threat actors to establish footholds for lateral movement. Delivered through multi-stage ClickFix infection chains targeting automotive-related web pages, this backdoor employs sophisticated obfuscation techniques including Mixed Boolean-Arithmetic and Control Flow Flattening. MLTBackdoor features indirect system calls, API hashing, and extensive anti-analysis checks that detect debuggers and sandboxed environments. Its capabilities include filesystem operations and a powerful Beacon Object File loader that dynamically expands functionality. The malware uses custom encrypted binary protocols over TLS with Elliptic-Curve Diffie-Hellman key exchange for command-and-control communications. Additionally, it implements a deterministic date-based Domain Generation Algorithm to maintain persistence when hardcoded C2 domains become unreachable, demonstrating advanced resilience against takedown attempts." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781089209", "to_ids": false, "type": "text", "uuid": "2cda8b4e-492c-4e79-899e-59bec8f7e539", "value": "Name: Technical Analysis of MLTBackdoor\nAuthor: AlienVault\nAdversary: \nTags: [\"ransomware\", \"obfuscation\", \"bof loader\", \"mltbackdoor\", \"clickfix\"]\nTgtd countries: []\nMlwr families: [\"MLTBackdoor\"]\nAttack_ids: [\"T1497.001\", \"T1082\", \"T1106\", \"T1005\", \"T1140\", \"T1055\", \"T1497.003\", \"T1090\", \"T1083\", \"T1041\", \"T1027\", \"T1573.002\", \"T1518.001\", \"T1059.003\", \"T1027.002\", \"T1071.001\", \"T1105\", \"T1564.004\", \"T1055.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "MLTBackdoor C2.", "deleted": false, "disable_correlation": false, "timestamp": "1781434574", "to_ids": true, "type": "domain", "uuid": "b44393dd-cf3e-45a9-987e-9442447d4c77", "value": "thomphon.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "MLTBackdoor C2.", "deleted": false, "disable_correlation": false, "timestamp": "1781434595", "to_ids": true, "type": "domain", "uuid": "4671b2f6-6945-440a-9b1f-ec7852428578", "value": "cwrtwright.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "MLTBackdoor C2.", "deleted": false, "disable_correlation": false, "timestamp": "1781434616", "to_ids": true, "type": "domain", "uuid": "475753da-da38-45fe-a2f4-f1f8411c08ff", "value": "carrolc.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434278", "to_ids": true, "type": "sha256", "uuid": "ad527595-0a95-4fa1-a585-9a8c52a1a44d", "value": "0ca2edf9982f58e63cc49ba69fb9a88762d1f220ed9482810b512d4add0f8f0b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434279", "to_ids": true, "type": "sha256", "uuid": "25e36046-039e-41ae-8568-a5f56041cc3d", "value": "0f7463aecc3920f9e2b32ab9d77861a9e69a3e8aa28d06b4602195623312331d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434280", "to_ids": true, "type": "sha256", "uuid": "3de16176-b8d5-45cc-9da8-0c9f427d663f", "value": "4c357a29b202b77e7db190d359ead2dfd3f8869c6808b96bfa8bee82525bb2a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434281", "to_ids": true, "type": "sha256", "uuid": "4d825bb0-47d9-47d6-a6b5-ae4689c1071a", "value": "57cfa4cbf3d6cbd13973bbf0625bfa6d20677abb0a6e6bec9a6bf587799b56fa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434282", "to_ids": true, "type": "sha256", "uuid": "65a44bd9-6b18-4895-bc23-1f9b7588eb79", "value": "6870e3bbf2447c96d21682caf943cf31c2e8c21c8cfb91a5092eab1c9e5f19ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434283", "to_ids": true, "type": "sha256", "uuid": "27bde695-2e21-4e50-9b7e-2f3cf603efd4", "value": "687968b820fd7a6bedb03d644410c663b1720ad76519e2dcf98d61df498470df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434285", "to_ids": true, "type": "sha256", "uuid": "d5ea1ac7-137d-4524-a720-2714f802a582", "value": "75635009a00cb26d2f532ad974ede59785a18e4b30132a1f585108589394ba5a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434286", "to_ids": true, "type": "sha256", "uuid": "d2478ceb-8d4a-4ce7-804d-5d5b87030a5c", "value": "9c8384f93b9d347a716ea3e55b9a01250473f667b95d467126c048256b0049e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434286", "to_ids": true, "type": "sha256", "uuid": "3d0ec6b6-31db-4221-b1ea-62770ebe35bc", "value": "9e8777661a1ad9c983f03060f0a04a3244daac8c3639b3eb1bbce29355bc6c10", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434287", "to_ids": true, "type": "sha256", "uuid": "9aa3b1a3-4cb2-498e-af82-50ce07ee6a4f", "value": "ab0541672b57cd3b7e8c973fb9fcbecd18b7fe14c1c2f571e7a2f2921919b500", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434289", "to_ids": true, "type": "sha256", "uuid": "d16a6823-b600-4fa6-bcf1-fc874dae26d4", "value": "ac66c2d47cdefb221822b9074c9810434e8da702a0694139aa9177557e6b292b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434290", "to_ids": true, "type": "sha256", "uuid": "6ea19807-251a-41b1-9750-adbc0ae4cceb", "value": "b2e1f5aedb049092135e90c153f5bd386aa81cd2df355d90912dcba33c3176e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434291", "to_ids": true, "type": "sha256", "uuid": "a1c0d215-819f-47d4-be38-0583edad10e2", "value": "b32461077b2e04145b87e9b5177a331dfd2248b81570aa96b9a302dffe643f70", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434292", "to_ids": true, "type": "sha256", "uuid": "edf25ead-f142-4512-927e-471200cb887a", "value": "d8f291a459c1acc53f9c8dccb1049bfe2d3b00c7a86d50542dc7fd7b0628ea6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434293", "to_ids": true, "type": "sha256", "uuid": "925c0af7-7991-48d0-ab5e-eaa3adc75390", "value": "e063358d88290c5d05d58594da341690024cf7fa57408a3874899f10e56d8bc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434294", "to_ids": true, "type": "sha256", "uuid": "4ea10c73-47c9-4a82-a34c-cd7b983772bf", "value": "ed80408eb9092301e628791e7a9a2e86c6f496a9afd7b56d7c1a1684b1b87251", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:14/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781434295", "to_ids": true, "type": "sha256", "uuid": "8546f7ef-d95b-4e45-b5bb-46d7833ba885", "value": "fe8557d454adc7a91162495628d269738b92b4b5d7e5d620fc3f38c27a9a41a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "MLTBackdoor update URL.", "deleted": false, "disable_correlation": false, "timestamp": "1781434637", "to_ids": true, "type": "url", "uuid": "bc448c96-6d68-4c56-b80d-f6343e4b3cf3", "value": "http://powwowski.com/payloads/update.zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781434658", "to_ids": true, "type": "url", "uuid": "88773288-f479-44c8-963f-96a8b70c36c7", "value": "https://hrs2y15sungu.com/d&pushd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "DGA domain also used in the distribution campaign.", "deleted": false, "disable_correlation": false, "timestamp": "1781434679", "to_ids": true, "type": "domain", "uuid": "84661b14-29ee-4660-9817-c9c70245ea43", "value": "hrs2y15sungu.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781434700", "to_ids": true, "type": "domain", "uuid": "31a06381-9b80-4575-add7-fdf7a67a3214", "value": "powwowski.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781434721", "to_ids": true, "type": "url", "uuid": "ecd8febb-1418-4998-b136-6513c533a4e0", "value": "powwowski.com/payloads/update.zip", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434742", "uuid": "01cf7f5f-87cf-4639-a434-a6dd4a2efbf3", "Attribute": [ { "category": "Payload delivery", "comment": "MLTBackdoor DGA only.", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434742", "to_ids": true, "type": "md5", "uuid": "a1ca1c44-d63b-4e1d-84ee-17866213ccb5", "value": "01b43dad62e56164771db696827a30ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor DGA only.", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434266", "to_ids": true, "type": "sha1", "uuid": "8f0fa4a0-ecdf-4b77-a757-df06606159fc", "value": "b14e1f931f602b1e1985d1362db0e17dd2d2131f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor DGA only.", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434266", "to_ids": true, "type": "sha256", "uuid": "130d9036-9f6c-442a-92be-47b9b0750078", "value": "1d09357b6a096fdc35cd5c873eed15665d6b3c879d20c8cf01e6bca0005512cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433185", "to_ids": true, "type": "ssdeep", "uuid": "66101732-7a89-4fce-ad91-f53fc29f954f", "value": "24576:DN+47oyrLhUM0VYroHgQHHpbCw+sYA/AnQM:DNoOeeusmYA/J" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433185", "to_ids": false, "type": "size-in-bytes", "uuid": "9368d07f-4c04-4973-8534-89544b671fd2", "value": "1205760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781433185", "to_ids": true, "type": "vhash", "uuid": "10547a51-fa0f-45cf-a544-fa1278ded2b0", "value": "116066655d6555151038z1c7z2dz2eze" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433185", "to_ids": true, "type": "filename", "uuid": "bbba45c2-9ede-4939-8aa4-e684a6e8a72d", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 13/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433185", "to_ids": false, "type": "text", "uuid": "6e8718ff-7ac9-4b2a-be71-6bc7ffb82dfc", "value": "MLTBackdoor DGA only.\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:46/71\nFirst Submission:2026-04-29T08:57:54.000000+00:00\nLast Submission:2026-04-29T08:57:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434763", "uuid": "bcd77e6c-e5c1-49fc-9bc9-cefb6e3bd078", "Attribute": [ { "category": "Payload delivery", "comment": "MLTBackdoor domains only.", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434763", "to_ids": true, "type": "md5", "uuid": "26e35852-d7d6-46b9-a683-093cd7c81055", "value": "08060143ea9b55b480746b415af22e3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor domains only.", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434267", "to_ids": true, "type": "sha1", "uuid": "1441008b-c4a8-450c-86fc-cd0fd81e0e84", "value": "4b7dbb7d5bc8938747b39faf602d85c3587ae261", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor domains only.", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434267", "to_ids": true, "type": "sha256", "uuid": "10920c67-5525-4baf-b740-003c4eb1c933", "value": "2cd88d5280a61714836f5f07a16df190911c5b952af2998dbbcda910b3b1c494", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433207", "to_ids": true, "type": "ssdeep", "uuid": "8be59f02-5e2c-434e-8254-7d474892b83c", "value": "24576:+yUQiaFkWiqFYJGy1FDZYBr3IdjAg9Ogj1/:+yzHKdbl7HN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433207", "to_ids": false, "type": "size-in-bytes", "uuid": "539bf382-2801-4e72-a45a-7456b28a1101", "value": "1527296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781433207", "to_ids": true, "type": "vhash", "uuid": "6b2366cb-b4f5-4680-8c9b-9361a154bfc0", "value": "116066655d6555151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433207", "to_ids": true, "type": "filename", "uuid": "9ee4a18c-cf7c-41fd-95e2-728ad649102e", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 13/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433207", "to_ids": false, "type": "text", "uuid": "34e8f92e-44c0-4844-93dd-042dcd9d97d8", "value": "MLTBackdoor domains only.\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/Havoc.MX!MTB\nVT Total Detection:42/71\nFirst Submission:2026-04-13T20:14:52.000000+00:00\nLast Submission:2026-04-13T20:14:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434784", "uuid": "75fddab0-bb97-425d-bc05-65a432eacd97", "Attribute": [ { "category": "Payload delivery", "comment": "Stage one loader.", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434784", "to_ids": true, "type": "md5", "uuid": "26580035-ce59-400d-8892-cb1cd66f0f40", "value": "b148626849c11dd5b3230632a38a6302", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Stage one loader.", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434269", "to_ids": true, "type": "sha1", "uuid": "7039dc29-0a3c-45cd-ab8c-2057aebb09c8", "value": "e5c4e634b2f443f783cae1b5e8247a1069df0c9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Stage one loader.", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434269", "to_ids": true, "type": "sha256", "uuid": "e21da37c-aa29-45e1-a330-8aba9cecfae3", "value": "1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433271", "to_ids": true, "type": "ssdeep", "uuid": "78de2606-9510-432d-879c-dba6a10d97ee", "value": "1536:P0+2AGtCUy8rGThQxoF03RtMpfeRypyt6Yex:P0+2AGtQ8Pxoi2pxpqQx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433271", "to_ids": false, "type": "size-in-bytes", "uuid": "b46edb95-9612-4aab-adf0-98012b0033fe", "value": "54272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781433271", "to_ids": true, "type": "vhash", "uuid": "544e339d-de3e-41ca-be1e-e54a6065dc06", "value": "154066655d150d051bze?z8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433271", "to_ids": true, "type": "filename", "uuid": "c56d8273-29d6-4359-bb56-e56bf1bc26ed", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 12/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433271", "to_ids": false, "type": "text", "uuid": "07a9f83a-9a72-49cd-bb53-bf712d50ca72", "value": "Stage one loader.\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:42/71\nFirst Submission:2026-04-24T16:55:01.000000+00:00\nLast Submission:2026-05-01T06:13:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434806", "uuid": "a1ec651a-22be-4adb-b87e-1a422a251296", "Attribute": [ { "category": "Payload delivery", "comment": "Archive with stage one loader and encrypted MLTBackdoor.", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434806", "to_ids": true, "type": "md5", "uuid": "f71b1d88-e9f2-4aa7-950c-613bbc468d9a", "value": "52e5b1bb9c2097c0a7bcdcc12ee20cdf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Archive with stage one loader and encrypted MLTBackdoor.", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434270", "to_ids": true, "type": "sha1", "uuid": "afec981d-2cf1-4e42-a7cb-c07e745c0445", "value": "6203eba07431bee32511851b42af7ec2d99961a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Archive with stage one loader and encrypted MLTBackdoor.", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434270", "to_ids": true, "type": "sha256", "uuid": "28ea325f-87d7-4e2f-84f9-f96b653f5036", "value": "46b2155c1e71b840d4b7a2e94410b89a61e2446523e6f497206d402eb02e0e93", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433293", "to_ids": true, "type": "ssdeep", "uuid": "4277d3ab-68f2-4df7-8ca1-f07558ba7ca1", "value": "24576:UlMTys7oYcbD5291OACm7njzauYBRzt/cgSxEutSavUqHMB7eSQKJE:UlMAB1291Olm7jzaXBRzt/c2QvUnJ1G" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433293", "to_ids": false, "type": "size-in-bytes", "uuid": "f203c79b-ed02-477a-9d1d-8d5ff8412e25", "value": "1266176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781433293", "to_ids": true, "type": "vhash", "uuid": "713ec791-8b69-419d-a6be-4ce51e621834", "value": "ad48d7750921ab06b999e8564035f19c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433293", "to_ids": true, "type": "filename", "uuid": "5af131ec-6bff-47e9-94a7-6165e203fda8", "value": "46b2155c1e71b840d4b7a2e94410b89a61e2446523e6f497206d402eb02e0e93.tar" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 13/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433293", "to_ids": false, "type": "text", "uuid": "adea8ade-a6de-4c5a-b553-459b6c532f9a", "value": "Archive with stage one loader and encrypted MLTBackdoor.\r\nType Description: TAR\nMicrosoft: None\nVT Total Detection:35/63\nFirst Submission:2026-04-27T13:29:44.000000+00:00\nLast Submission:2026-04-27T13:30:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434827", "uuid": "98b587a0-d72b-45b2-ba51-74c095280496", "Attribute": [ { "category": "Payload delivery", "comment": "MLTBackdoor with domains and DGA.", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434827", "to_ids": true, "type": "md5", "uuid": "45b619b6-adac-4174-8978-28c4ebbe0c2f", "value": "ddd151435513861b89a69bccb69c5fc5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor with domains and DGA.", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434271", "to_ids": true, "type": "sha1", "uuid": "5c689e7d-61bd-492b-8323-7c01bd6da7aa", "value": "15d1002d9935fbfc9dfc65eb70fe4ecc0943c784", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor with domains and DGA.", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434271", "to_ids": true, "type": "sha256", "uuid": "865e4f8a-a924-432a-9528-1a8ae4531848", "value": "9e52cc90cff150abe21f0a6440e86e0a99ff383b81061b96def8948e21d0ac66", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433441", "to_ids": true, "type": "ssdeep", "uuid": "47a02fa9-5d6c-4d26-aab8-d820fc4331c9", "value": "24576:6F306lXn8nIERqBfhPzCAPYRitgviTR/b3IrJRwHdK5:mk6lX8nKflcQCiT5ZHd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433441", "to_ids": false, "type": "size-in-bytes", "uuid": "d7584880-4658-48f3-afd3-f5a886b1afea", "value": "1517056" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781433441", "to_ids": true, "type": "vhash", "uuid": "4f1318a5-0e50-4583-89ea-321e09c44d80", "value": "116066655d6555151038z1c7z2dz2eze" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433441", "to_ids": true, "type": "filename", "uuid": "79630604-79ca-4d79-8b5e-c5f190ebcff6", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 12/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433441", "to_ids": false, "type": "text", "uuid": "f2ed55fc-6328-482e-a021-69bc34ab22ca", "value": "MLTBackdoor with domains and DGA.\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:42/71\nFirst Submission:2026-04-22T07:01:26.000000+00:00\nLast Submission:2026-04-24T19:13:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434848", "uuid": "b0ae6e80-3839-4687-a369-51ef5a06769e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434848", "to_ids": true, "type": "md5", "uuid": "9c85c586-8c2e-47f0-b877-2d2fa1b0cb9b", "value": "ba376c627ebaac190156d40655de5fce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434272", "to_ids": true, "type": "sha1", "uuid": "fc8aa4f1-4c09-442d-85e2-65f71d22ff4b", "value": "19f1e403e36c397a39e9a2cabbbe7af8f116d1fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434272", "to_ids": true, "type": "sha256", "uuid": "2e355089-ff60-4f16-a590-5661daabc512", "value": "a5a5b6257304eefe5212edfd8c0ad27f77357c5046a7acb8eb7ba72ed4bad9e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433483", "to_ids": true, "type": "ssdeep", "uuid": "19ecc060-c336-41d6-a57b-36e4e02befa8", "value": "3:orN:op" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433483", "to_ids": false, "type": "size-in-bytes", "uuid": "71b110c8-7eac-4959-922b-eaadec7989eb", "value": "11" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433483", "to_ids": true, "type": "filename", "uuid": "38f99c2a-e7bd-4020-a82b-269fe377cbe6", "value": "name.txt" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 10/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433483", "to_ids": false, "type": "text", "uuid": "37cc9d27-3946-41b5-8bd9-c179121cc2a1", "value": "Type Description: Text\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2009-09-26T06:18:41.000000+00:00\nLast Submission:2009-09-26T16:19:23.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434869", "uuid": "e30cdc17-3e90-4190-b79e-562f01a84ca3", "Attribute": [ { "category": "Payload delivery", "comment": "MLTBackdoor DGA only.", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434869", "to_ids": true, "type": "md5", "uuid": "de0b175f-244e-4a06-8e7a-93b7e28bf08b", "value": "93d7d2ebd1d30bc28bea7d4635593a22", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor DGA only.", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434273", "to_ids": true, "type": "sha1", "uuid": "3deffaf9-17f4-4577-a239-478c70ab099a", "value": "2220101b5547ed17d4c453aa039bd5716cddde8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor DGA only.", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434274", "to_ids": true, "type": "sha256", "uuid": "583a9fbc-a653-4f7f-8fcc-90fee6e65060", "value": "ced6b0f44410f6133ad63b61e04613a8b56cc3338d7b34497540e9541163e7ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433590", "to_ids": true, "type": "ssdeep", "uuid": "4807258d-e815-48cf-9587-96eab0425604", "value": "24576:nJUvrfvYHXqVIG8K+8T/nPCOzJH2RUfcq:nOrnfk2H2RU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433590", "to_ids": false, "type": "size-in-bytes", "uuid": "1ed78ad6-c426-46c1-bb01-01a56b047daf", "value": "1203200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781433590", "to_ids": true, "type": "vhash", "uuid": "551ef49c-6ad4-4d9b-8bde-6d9f565e4c12", "value": "116066655d6555151038z1c7z2dz2eze" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433590", "to_ids": true, "type": "filename", "uuid": "e12f7514-e819-4918-ac38-cc3806815c98", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 12/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433590", "to_ids": false, "type": "text", "uuid": "26615966-06ca-436b-9502-e58555185042", "value": "MLTBackdoor DGA only.\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:42/71\nFirst Submission:2026-04-24T08:36:03.000000+00:00\nLast Submission:2026-04-24T08:36:03.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434890", "uuid": "0d5cdab4-97a4-41e1-a45d-82dbfe6e354d", "Attribute": [ { "category": "Payload delivery", "comment": "MLTBackdoor update sideload archive.", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434890", "to_ids": true, "type": "md5", "uuid": "2afba745-33cf-4308-acd2-0d9f22f306c0", "value": "0dfe9d56066fd9005f210a903645ed90", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor update sideload archive.", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434274", "to_ids": true, "type": "sha1", "uuid": "b0372c9e-791d-4584-b520-0e2c5b0b8838", "value": "8788c242a19de47af76dfbea59f938ded51e8147", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MLTBackdoor update sideload archive.", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434274", "to_ids": true, "type": "sha256", "uuid": "1d02d1b7-fe81-488f-a050-64d1727b8852", "value": "d34e4038c5c80728f9648ba84833f69bc1ccea82e2e8e748b7b7f02fb687b92b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433611", "to_ids": true, "type": "ssdeep", "uuid": "44d503f4-d1be-4370-9d30-5e604767e55f", "value": "24576:0LGc3PQIcjLZDLfUfP9/Wu0/5HpEw/GxHIzvYXroTH+Jkqk5ANUP:0Ld8pm9/WuUEUzzvc0qJkqk5Yy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433611", "to_ids": false, "type": "size-in-bytes", "uuid": "ed48045a-766c-4455-b29b-86ce28c8f765", "value": "1296080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781433611", "to_ids": true, "type": "vhash", "uuid": "69062225-673d-440a-9eb8-06352b3c89aa", "value": "b44ee154bddf7fcd14dac706bb772e14" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433611", "to_ids": true, "type": "filename", "uuid": "86a97423-e42d-4f53-9083-93374b00b324", "value": "update.zip" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 13/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433611", "to_ids": false, "type": "text", "uuid": "d82a6a85-db11-4b3a-bee7-b655d51f1566", "value": "MLTBackdoor update sideload archive.\r\nType Description: ZIP\nMicrosoft: None\nVT Total Detection:40/68\nFirst Submission:2026-04-22T07:00:44.000000+00:00\nLast Submission:2026-04-22T07:00:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434911", "uuid": "c50a15fa-2d25-4c76-9dbc-9abb5b1a434a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434911", "to_ids": true, "type": "md5", "uuid": "4d97f78a-9909-4b03-926d-eb5cf4286890", "value": "f9b6602cfcc862179cb4ceb8f7828b23", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434276", "to_ids": true, "type": "sha1", "uuid": "e281fe4b-2547-4369-9ea2-58b81c9e1566", "value": "3eb54568cd8c48a06aa21f8304ffef9a2a166ed7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434276", "to_ids": true, "type": "sha256", "uuid": "292a0f02-cc2c-4ce9-a3ea-276c67efa3e1", "value": "d51ce268a585657226510586e47c58a47cee2f2bf2049008760c58dc4e6ba650", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433633", "to_ids": true, "type": "ssdeep", "uuid": "ffd945ba-de98-4808-b804-1c3265eb88e3", "value": "3:ookA:oi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433633", "to_ids": false, "type": "size-in-bytes", "uuid": "4cd23ea4-4aea-417b-8bac-e8bb477ffa7a", "value": "11" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 10/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433633", "to_ids": false, "type": "text", "uuid": "81f6f387-0c6d-40b5-b393-518b3e792e14", "value": "Type Description: Text\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2009-07-26T17:37:38.000000+00:00\nLast Submission:2009-07-26T17:37:38.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781434932", "uuid": "bc051158-6095-4fec-a675-6c84b6081083", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781434932", "to_ids": true, "type": "md5", "uuid": "ba61c2d1-40a0-4bee-80fe-0659a39ae22c", "value": "2a56eb70a038ee544396de36396f83e3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781434277", "to_ids": true, "type": "sha1", "uuid": "2831ca1a-8e7e-46a4-9b36-f985ebf2a020", "value": "635009e6422814d49bf7ff92d38b4625802caf8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781434277", "to_ids": true, "type": "sha256", "uuid": "eb2c913c-2536-4e17-b7a7-cece8c745a1c", "value": "fc8649547ad0ece93ad82de75cb6b875be0873774de89b78546c9a66d2043087", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781433718", "to_ids": true, "type": "ssdeep", "uuid": "e882d36a-ae31-4f91-994d-e5e10b735997", "value": "3:4vWBL4A:4vW94A" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781433718", "to_ids": false, "type": "size-in-bytes", "uuid": "1e64ecc8-479c-4229-a489-b4778aefb29a", "value": "12" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781433718", "to_ids": true, "type": "vhash", "uuid": "8b5abfd1-5a62-412f-8a1c-5134130a8441", "value": "9eecb7db59d16c80417c72d1e1f4fbf1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781433718", "to_ids": true, "type": "filename", "uuid": "03d68bbe-f5e5-4c9f-8323-9777e387020c", "value": "mal today.txt" }, { "category": "Other", "comment": "Checked: 14/06/2026\nLast-scan\t: 10/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781433718", "to_ids": false, "type": "text", "uuid": "788f567a-63e6-4626-9bd4-543ee903cd52", "value": "Type Description: Text\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2022-02-20T11:46:49.000000+00:00\nLast Submission:2022-02-20T11:46:49.000000+00:00" } ] } ] } }