{ "Event": { "analysis": "1", "date": "2026-06-04", "extends_uuid": "", "info": "[Threat Intel] ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery", "protected": false, "publish_timestamp": "1781219601", "published": true, "threat_level_id": "3", "timestamp": "1781219601", "uuid": "2689cbd4-aef6-4117-9665-c230f96efc17", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#177fb7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#5884a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780657218", "to_ids": false, "type": "link", "uuid": "63a8018c-7d46-4bbd-985c-424a6e6a16c2", "value": "https://www.levelblue.com/blogs/spiderlabs-blog/clickfix-is-now-hiring-from-job-platform-impersonation-to-python-based-rat-delivery" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780657218", "to_ids": false, "type": "text", "uuid": "a06fd5f3-dd53-42ca-8c6f-71b00f70ba68", "value": "A multi-stage phishing campaign emerged in early May 2026, impersonating LinkedIn and Indeed through typosquatted domains to deliver malicious payloads. The attack chain begins with fake CAPTCHA pages distributed via Google Ads, leveraging the legacy Finger protocol and native Windows utilities. Victims are tricked into executing commands that deploy portable Python runtimes (CPython or IronPython), which then execute in-memory shellcode. The campaign delivers CastleLoader, a Malware-as-a-Service framework using ChaCha20 and RC4 encryption for C2 communications, followed by a Python-based remote access trojan. The RAT provides interactive shell control, in-memory payload execution, and persistence mechanisms. The campaign represents an evolution of browser-based social engineering, combining Living-off-the-Land binaries with Python-based delivery to maintain a fileless footprint and evade detection through legitimate system utilities." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780657218", "to_ids": false, "type": "text", "uuid": "1357ba6c-4bbf-422a-8a4a-51eecaa6521c", "value": "Name: ClickFix Is Now Hiring: From Job Platform Impersonation to Python-Based RAT Delivery\nAuthor: AlienVault\nAdversary: \nTags: [\"lolbin\", \"social engineering\", \"phishing\", \"clickfix\", \"python rat\", \"castleloader\", \"typosquatting\", \"fileless execution\"]\nTgtd countries: []\nMlwr families: [\"CastleLoader\"]\nAttack_ids: [\"T1033\", \"T1218.011\", \"T1036.005\", \"T1573.001\", \"T1497.001\", \"T1566.002\", \"T1082\", \"T1106\", \"T1140\", \"T1055\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1027\", \"T1059.003\", \"T1071.001\", \"T1105\", \"T1204.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216765", "to_ids": true, "type": "domain", "uuid": "dc298f8a-1d80-4a46-9e2f-44713fe5f5d6", "value": "teamsvoicehub.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216786", "to_ids": true, "type": "domain", "uuid": "36b03d0e-b91a-4c70-8abd-3e777a195403", "value": "dapala.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216807", "to_ids": true, "type": "domain", "uuid": "4e114891-eb3e-44c3-8518-27c367df5bb2", "value": "staruxaproruha.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216828", "to_ids": true, "type": "domain", "uuid": "66c16f4e-e8ef-4d0a-b791-2192138c83f7", "value": "ai-like.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216850", "to_ids": true, "type": "domain", "uuid": "f263579f-7578-4343-b25a-ae5b39077569", "value": "mtg-life.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216871", "to_ids": true, "type": "domain", "uuid": "41ccafb3-c13a-4fce-81c5-aef4d72458cc", "value": "novayastaruxa.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216893", "to_ids": true, "type": "domain", "uuid": "4faebb55-91de-4f75-9daa-e555011ca818", "value": "kevinnotanother.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216914", "to_ids": true, "type": "domain", "uuid": "6c79a437-ce72-440a-ba68-62fcd976e612", "value": "candipoker.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216939", "to_ids": true, "type": "domain", "uuid": "8719b417-e681-4277-9724-5b3a91e37a44", "value": "linkedwith.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216960", "to_ids": true, "type": "domain", "uuid": "df372a26-b2e3-4d5f-8d78-1ba9a496ee7e", "value": "linked-on.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781216981", "to_ids": true, "type": "domain", "uuid": "5c9e2e78-e37d-47d1-90eb-d6e778183875", "value": "linkedall.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217006", "to_ids": true, "type": "domain", "uuid": "9e592304-bfc8-44fc-a254-b2059adf0b6e", "value": "uslinked.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217027", "to_ids": true, "type": "domain", "uuid": "cd6cac27-cc06-41da-bc0b-f8ea75f4155b", "value": "linked-people.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217048", "to_ids": true, "type": "domain", "uuid": "a10511e3-9f15-4c8c-bce6-13b71790dd9f", "value": "linkedplus.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217070", "to_ids": true, "type": "domain", "uuid": "13e99733-e432-4be4-b6d5-bf6c227f01c3", "value": "linked-hr.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217091", "to_ids": true, "type": "domain", "uuid": "f0eb2826-5129-4be2-b431-2f356844cfad", "value": "indeed-jobs.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217112", "to_ids": true, "type": "domain", "uuid": "5c21009d-e873-4b7f-99ee-1bc3f4b4640f", "value": "indeedhiring.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217133", "to_ids": true, "type": "url", "uuid": "f77c45f3-6237-4b89-b538-c5c638d170d8", "value": "http://linked-hr.com/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217154", "to_ids": true, "type": "url", "uuid": "86a51178-6d82-4ad2-adf9-c502b40d5dfc", "value": "http://teamsvoicehub.com/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217175", "to_ids": true, "type": "domain", "uuid": "0adb60ee-14eb-4b1e-99cf-82e7f4b66b5c", "value": "crewlworkinew.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217197", "to_ids": true, "type": "url", "uuid": "7219dafc-8321-4bcd-b026-fc5ca72ed87b", "value": "http://ai-like.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217218", "to_ids": true, "type": "url", "uuid": "fea3ff6b-7ea1-47eb-8224-2e8d429f8d82", "value": "http://candipoker.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217239", "to_ids": true, "type": "url", "uuid": "aaebae1a-1688-4ff8-8734-8ab24b35a76b", "value": "http://catalyst-ltd.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217260", "to_ids": true, "type": "url", "uuid": "c7739c3d-3abf-416b-890b-b02a1fdc497b", "value": "http://dapala.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217282", "to_ids": true, "type": "url", "uuid": "61ac67e9-6b9b-452e-8ecb-b8c0882eeaac", "value": "http://dmtn-tv.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217303", "to_ids": true, "type": "url", "uuid": "bcd321d4-8e89-4b4e-9e10-c55a62a8e095", "value": "http://domawe.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217324", "to_ids": true, "type": "url", "uuid": "fd671ef2-9173-4e05-897f-c63f9e5b1eab", "value": "http://idrci.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217345", "to_ids": true, "type": "url", "uuid": "c38661c1-a78d-4423-aaae-33ce873c607b", "value": "http://indeed-jobs.net/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217366", "to_ids": true, "type": "url", "uuid": "c3945d75-f14f-42c5-8e01-4ca8d1d35399", "value": "http://indeedhiring.com/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217388", "to_ids": true, "type": "url", "uuid": "8111cca6-1dec-4320-8c3b-fa7097642a3d", "value": "http://linked-on.com/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217409", "to_ids": true, "type": "url", "uuid": "ead6ee34-55e4-4c8b-a3bb-a5a21666c935", "value": "http://linked-people.com/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217430", "to_ids": true, "type": "url", "uuid": "10bbc271-98f0-4c71-872b-506b5334a663", "value": "http://linkedall.org/infos.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217452", "to_ids": true, "type": "url", "uuid": "b9d91d87-271e-4848-80b6-d9c7a0eb756d", "value": "http://linkedplus.org/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217473", "to_ids": true, "type": "url", "uuid": "538cb1b7-bc52-4866-9e73-edd882b696b0", "value": "http://linkedwith.org/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217494", "to_ids": true, "type": "url", "uuid": "18accf65-aafb-4802-a9f5-ca36f3417423", "value": "http://mtg-life.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217515", "to_ids": true, "type": "url", "uuid": "835562c3-88d5-4874-990f-02401ec7fccb", "value": "http://sedaliarealty.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217537", "to_ids": true, "type": "url", "uuid": "62c01371-6f37-482a-9d40-150066fbbe21", "value": "http://sinjim.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217558", "to_ids": true, "type": "url", "uuid": "4726e034-84ec-415f-b9e0-41c8f81926eb", "value": "http://tronscaner.net/infos.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217579", "to_ids": true, "type": "url", "uuid": "ec663bbc-5d7a-4379-a60e-61fd6ef9e257", "value": "http://uslinked.org/infos.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217600", "to_ids": true, "type": "domain", "uuid": "d964acda-43c4-4e7b-ad19-d534879af808", "value": "1006326830900030409.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217621", "to_ids": true, "type": "domain", "uuid": "7166fe76-3d18-4668-8903-97691eb0e511", "value": "catalyst-ltd.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217643", "to_ids": true, "type": "domain", "uuid": "0db2a50c-c65b-45c5-a3da-35bdd65d13c9", "value": "dmtn-tv.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217664", "to_ids": true, "type": "domain", "uuid": "fbea6c20-4899-4e32-98dc-eec5265d0773", "value": "domawe.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217685", "to_ids": true, "type": "domain", "uuid": "78eca174-f40d-4a14-82a1-c8301110695f", "value": "golinked.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217706", "to_ids": true, "type": "domain", "uuid": "7e0f5bfd-34f1-4270-aede-8928860c01d0", "value": "idrci.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217727", "to_ids": true, "type": "domain", "uuid": "abf5f4d6-ac0c-4736-a3de-0e033a9508d5", "value": "sedaliarealty.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217748", "to_ids": true, "type": "domain", "uuid": "191a48d6-2a4c-460c-9f49-49a33bd98091", "value": "sinjim.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217770", "to_ids": true, "type": "domain", "uuid": "c5c62bbe-8d34-4993-94ee-97bbe9426c2a", "value": "tronscaner.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781212356", "to_ids": true, "type": "filename", "uuid": "8502c5e7-fd37-4117-a98a-3aa70921fd48", "value": "finger.exe" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217791", "to_ids": true, "type": "url", "uuid": "3a777e56-3cf6-4957-ac5a-e479c052ed1b", "value": "https://linkedall.org/infos.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217812", "to_ids": true, "type": "url", "uuid": "84fbc8bf-e247-43fd-a343-5da4065fb8d7", "value": "https://uslinked.org/infos.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217833", "to_ids": true, "type": "url", "uuid": "ec248822-0bb5-4f82-aa0c-1aa477599faa", "value": "https://tronscaner.net/infos.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217854", "to_ids": true, "type": "url", "uuid": "9b970769-44b6-482b-a71d-8d232604b9bb", "value": "https://linked-on.com/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217876", "to_ids": true, "type": "url", "uuid": "f41aec3f-9706-4c26-8d30-f96255fbceeb", "value": "https://linked-people.com/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217897", "to_ids": true, "type": "url", "uuid": "d3e902cc-861c-4bc7-8efa-0fa7131d1417", "value": "https://linkedwith.org/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217919", "to_ids": true, "type": "url", "uuid": "e40295f1-ecfb-4157-87e0-caaff4041e94", "value": "https://linkedplus.org/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217940", "to_ids": true, "type": "url", "uuid": "bb241c7a-a0a0-4622-9356-fda1a8df20ce", "value": "https://indeed-jobs.net/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217961", "to_ids": true, "type": "url", "uuid": "09fb9f29-8d33-4b84-bbcf-001c0d9e8ae7", "value": "https://indeedhiring.com/leyts.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781217982", "to_ids": true, "type": "url", "uuid": "9d72dc86-c54c-4e04-83da-d8d4359f5c7d", "value": "https://catalyst-ltd.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218003", "to_ids": true, "type": "url", "uuid": "c7727b2d-14bc-4e42-b6d3-0019d37a4ad1", "value": "https://mtg-life.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218025", "to_ids": true, "type": "url", "uuid": "31b2607a-b383-4cb4-8ef5-8efb112a48ca", "value": "https://dmtn-tv.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218046", "to_ids": true, "type": "url", "uuid": "8caa6b10-b83a-4b28-b0c6-fa351e32c863", "value": "https://ai-like.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218068", "to_ids": true, "type": "url", "uuid": "bf7b4d4d-bcc7-4aa2-ad6f-794f36978cd0", "value": "https://dapala.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218089", "to_ids": true, "type": "url", "uuid": "a602cb53-7ec1-4d8d-9480-bc4f665cb7a4", "value": "https://sinjim.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218110", "to_ids": true, "type": "url", "uuid": "c1ff6f7e-8768-4497-bf8f-af62631ce78f", "value": "https://idrci.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218131", "to_ids": true, "type": "url", "uuid": "f045f623-093d-4533-b68c-4c0db1f16046", "value": "https://domawe.net/95126aeb-4120-56b1-8c9e-63fdf0c0b6f9", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218152", "to_ids": true, "type": "url", "uuid": "2f91ff3b-cad0-4a8a-9e79-680d50cc759f", "value": "https://sedaliarealty.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218173", "to_ids": true, "type": "url", "uuid": "053e5544-cfdd-48ef-9953-2bd1a9e00317", "value": "https://candipoker.net/ebd417db-979c-51f8-aedf-88a2bf8aa6c3", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781218194", "to_ids": true, "type": "domain", "uuid": "2c40287f-5da6-43f8-9d6b-db569678522e", "value": "crewlcrewlcrewl.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218216", "uuid": "d700a549-b400-4e87-89b4-d6f3a44bacf1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218216", "to_ids": true, "type": "md5", "uuid": "a73d92b6-d669-4060-8654-60a124b7b4cc", "value": "ad1d9f012c97ae746b185dd3a4feccf3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215088", "to_ids": true, "type": "sha1", "uuid": "118e2d3a-36d5-4dc8-ab56-71c6c0e89336", "value": "9fde1f90b6c3825ccb49e1d4e9a2dcae1709e812", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215088", "to_ids": true, "type": "sha256", "uuid": "45bd3320-09db-4092-b623-7c8b2ac4514f", "value": "08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213971", "to_ids": true, "type": "ssdeep", "uuid": "e37a668b-9e37-492c-9d59-e68ff6b4febc", "value": "384:6m6yPNg7VWrDHw8RER/Vmos3iwWriizkyjchL7poVfRvZwC:6m6KQ8Ry/sosiwWriig0chWVfRx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213971", "to_ids": false, "type": "size-in-bytes", "uuid": "2268bc42-0499-4167-adb7-7f8b4d513ccb", "value": "18415" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213971", "to_ids": true, "type": "filename", "uuid": "72715d8f-6c94-4097-b19a-eaca111cec50", "value": "scr7" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 08/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213971", "to_ids": false, "type": "text", "uuid": "8861534d-8335-4fb9-b6a7-45a875a66268", "value": "Type Description: Text\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:25/60\nFirst Submission:2026-04-27T13:39:28.000000+00:00\nLast Submission:2026-04-27T13:39:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218237", "uuid": "c0ecfd06-6e3a-4851-882b-6e0286914f6a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218237", "to_ids": true, "type": "md5", "uuid": "b61177fd-2055-41d6-a063-32e0a9397153", "value": "2a350525ba72ffc9fe45a05a423833d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215089", "to_ids": true, "type": "sha1", "uuid": "6040e19f-69e6-4ff5-b2f1-11a3779789c0", "value": "ba1740688cf1236ef29516be83593ba548944df6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215089", "to_ids": true, "type": "sha256", "uuid": "23b15723-4f81-477b-9d8c-f05e0501aa7e", "value": "7c54bcf3aea8348e8902cac80eb0df31b43a71601a62e2514087fef40a416bfd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213993", "to_ids": true, "type": "ssdeep", "uuid": "ceb14b95-8a7a-44eb-b5c1-8ecf2950e272", "value": "768:NnixkFFc4e40arPBm+Cx4nvY5Ekcnlkj580x3AEoGSG3:5T0aTBm+Cx4nvY5Ek+eV80u/GSG3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213993", "to_ids": false, "type": "size-in-bytes", "uuid": "319088e8-712e-4cb7-8b3c-f5748c5d0285", "value": "51684" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213993", "to_ids": true, "type": "filename", "uuid": "7b5fafbb-64cc-4a85-8505-b633269689be", "value": "main.pyc" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213993", "to_ids": false, "type": "text", "uuid": "36ef8f68-e03e-4dec-bf46-2413a97c8a67", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nVT Total Detection:26/61\nFirst Submission:2026-04-30T17:30:47.000000+00:00\nLast Submission:2026-05-07T15:08:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218258", "uuid": "dd5c06fd-d7b3-4633-a459-9861785fe684", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218258", "to_ids": true, "type": "md5", "uuid": "585f3c9b-fe00-4c21-a6bf-eb6e266f3017", "value": "e4a1549ba4c71d9d51de847a3931f7b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215090", "to_ids": true, "type": "sha1", "uuid": "553640a9-4588-424b-8635-850fd873ce71", "value": "42b715bcfb7e429e22972f9d1d603126be1b5ece", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215090", "to_ids": true, "type": "sha256", "uuid": "9ca7e3e0-3614-4e56-abb3-4ce03f37caae", "value": "cd4a51037bf58733c0cb24b273951dd3fcea45a2aaeb8b30a3c625e183c4c0c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214015", "to_ids": true, "type": "ssdeep", "uuid": "3d93a651-d4fa-4866-bb7f-e89647941e25", "value": "384:cvLM3CzZJTgpARSkcz2SEXZvGTw55tFeTRCAgUdto0K6zGIgENI8TyuqBTD:cvLM3OZCQ82XNGM5iExUPo0K66iBTi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214015", "to_ids": false, "type": "size-in-bytes", "uuid": "4d535512-6b61-4207-9cc7-ae71d36ade52", "value": "19377" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 09/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214015", "to_ids": false, "type": "text", "uuid": "c14f2c1e-da3b-4009-9fef-d87b91743dd6", "value": "Type Description: Text\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:6/61\nFirst Submission:2026-05-10T06:47:35.000000+00:00\nLast Submission:2026-05-14T18:02:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218280", "uuid": "0d2849e5-f6bd-422e-aa59-3fff95190ee0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218280", "to_ids": true, "type": "md5", "uuid": "c0b616a7-988f-4b73-9466-8c0eb71f8f6f", "value": "e25fba1882786678c2cb18b033f88f82", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215091", "to_ids": true, "type": "sha1", "uuid": "e579983d-2d33-4885-bef3-8cfe4c266726", "value": "f1dd76cfcbf607b26be577342d102ce5c2489053", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215091", "to_ids": true, "type": "sha256", "uuid": "01318397-ae6b-4953-b246-34adef40c2c6", "value": "d56b810dfacaa1630bf562ccdefd46835349710d9516334e1a182619335ddea7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214037", "to_ids": true, "type": "ssdeep", "uuid": "f05a3efe-c0cc-49bd-8672-3f58b4550564", "value": "384:kRYFLGS5w4HI4nMcTxjg6DSG/piCS0vjMTL4hAw5aUb5yko:oYFLGwTI8BDt/IHIUEhv5aU1yko" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214037", "to_ids": false, "type": "size-in-bytes", "uuid": "63271917-8405-49fd-bb25-c8c3a64e20cd", "value": "19074" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 06/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214037", "to_ids": false, "type": "text", "uuid": "dd1984e3-3c86-4589-819c-cecbab3e41e2", "value": "Type Description: Text\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:5/61\nFirst Submission:2026-05-03T14:56:28.000000+00:00\nLast Submission:2026-05-14T09:27:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218301", "uuid": "ba737215-557e-4fd4-95f6-365ee9a13655", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218301", "to_ids": true, "type": "md5", "uuid": "bae128f9-aeaf-4054-bda0-5cdc1508b612", "value": "9fde6eda2d4b6effb095d233f1540285", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215092", "to_ids": true, "type": "sha1", "uuid": "b9283bbf-aa1b-4d4b-a847-70aedcabf1c6", "value": "14cd76a8bd035cacd55ad566eeb36312e4c71dac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215092", "to_ids": true, "type": "sha256", "uuid": "a9f27303-00e2-4827-8eb9-1265847362c3", "value": "d3e936fa36289fd1210047d8f25257bab0608825ed92908dc98c00e33bdb3db2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214059", "to_ids": true, "type": "ssdeep", "uuid": "fe9478cd-86f8-4618-852c-e43b6b7313d4", "value": "384:WeUaGG0yFwIgdzBToiR8qYSxuDtgd7Z/fE6N1Uizz3do5iXXhjk961U8pyIIdTK:WezFsdtEiF2gd7FfVNZHdkqUg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214059", "to_ids": false, "type": "size-in-bytes", "uuid": "4c03c678-4fe4-4d9e-b43e-ba53789e113e", "value": "19917" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214059", "to_ids": true, "type": "filename", "uuid": "29b84c81-61e1-48c2-b928-ce9dc77d4ad1", "value": "scr11" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 09/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214059", "to_ids": false, "type": "text", "uuid": "ebac5aff-f1c6-4488-94f0-833e4d4b360b", "value": "Type Description: Text\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:6/61\nFirst Submission:2026-05-15T04:35:15.000000+00:00\nLast Submission:2026-05-15T04:35:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218322", "uuid": "7057823f-3477-4a9c-9abb-d21a02c3ea5e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218322", "to_ids": true, "type": "md5", "uuid": "23682ba5-57c8-4a18-b07f-c27e6454ac13", "value": "9a1fa4741f6275a915199d66d34630c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215093", "to_ids": true, "type": "sha1", "uuid": "9f5f7cfd-f06e-48ba-a5a9-aca072ac6ca3", "value": "f8e58285f50ff6dd9db969c9fb286f51202e2985", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215094", "to_ids": true, "type": "sha256", "uuid": "d5c6afcf-d218-42fd-986b-410fef7fc6dc", "value": "d04ae4d214531d70c634d29763a9c0b84d601cf94aaca4720363f7512995393c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214081", "to_ids": true, "type": "ssdeep", "uuid": "43f6acf9-a88c-42b9-802f-8ccd5356f8d6", "value": "6144:mbvEmvyxgNonacdJ2JFVB8xU/CWpQKlqWSbTHVqYYTh:4QgN8agoB5/1yynIVMTh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214081", "to_ids": false, "type": "size-in-bytes", "uuid": "33f34c26-8566-4073-af15-8f258ce0807f", "value": "297615" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214081", "to_ids": true, "type": "filename", "uuid": "5389d649-ec73-465e-a935-e5122b09d435", "value": "v6[1]" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 06/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214081", "to_ids": false, "type": "text", "uuid": "2f89add0-755b-4e67-9c46-fd71ddaeba2d", "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2026-05-14T14:16:19.000000+00:00\nLast Submission:2026-05-27T18:31:32.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218344", "uuid": "36313701-d3ab-42ab-b539-b72c1b9e44eb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218344", "to_ids": true, "type": "md5", "uuid": "108be40c-f39c-4f01-bf9a-02ec6320c635", "value": "17dcbc2e1ebcf0c02d529dfba934989f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215095", "to_ids": true, "type": "sha1", "uuid": "636d8a39-894e-4e0f-9021-58297d52b99d", "value": "cb8bd903ec61f73e2ccc42af310cc244fd3498df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215095", "to_ids": true, "type": "sha256", "uuid": "592422b6-9923-41ca-813d-132e2a6cff8f", "value": "c024a3d852b73fef5bfca7ec5c80df3d59ff9ec858e0adad80c588fe22c39dfc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214103", "to_ids": true, "type": "ssdeep", "uuid": "5472fd8f-9f02-4f13-b7f2-ee410c22526b", "value": "6144:Ra8qNuiSpehfWFgrfshKWjknh5Oyz+9xNwlAHVoU84Xq5sA8w:RaBuiSpeheFgrfkKWQnhf+ZwlA1oLOun" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214103", "to_ids": false, "type": "size-in-bytes", "uuid": "c4981473-d468-4f9c-b09b-badb12d1ea4e", "value": "297615" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 09/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214103", "to_ids": false, "type": "text", "uuid": "cbcb14f4-b8a2-4cf7-93d0-f04bf554e304", "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2026-05-06T16:41:01.000000+00:00\nLast Submission:2026-05-06T16:41:01.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218365", "uuid": "4622e23a-fbb9-43c6-bd56-a4e60a1af98a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218365", "to_ids": true, "type": "md5", "uuid": "424ffcd3-14c5-4d56-bb5d-4c754d6d7016", "value": "202f3c8cf41a627db403295874220ddd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215096", "to_ids": true, "type": "sha1", "uuid": "b6457b6c-5fdf-4b4e-aa4f-9eda3dc46630", "value": "9d740bcb290c0c70596180f05a117f594411bbdd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215097", "to_ids": true, "type": "sha256", "uuid": "71be4c1e-0edb-4952-84d9-f81549e903e8", "value": "e5e43b0830369c39fab45363486da4d21a98c5097ea262c9816997f11c73c1c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214125", "to_ids": true, "type": "ssdeep", "uuid": "8a25c16c-aae9-42ca-9e02-4658d40b6ac4", "value": "393216:G1z6sQUi5Sap8ap944GeRaC0AwK3NqLLu:GzEPUap8aX44VYC043cLi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214125", "to_ids": false, "type": "size-in-bytes", "uuid": "4628c50e-ee4f-4cd8-9bd3-0e0f1e82b490", "value": "16089431" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214125", "to_ids": true, "type": "filename", "uuid": "c9c2d4cb-d4ac-4f61-b340-ff0ff6485035", "value": "CrewlPiton" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 09/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214125", "to_ids": false, "type": "text", "uuid": "225a2b95-3db4-4f2b-803a-0f295ceffe65", "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2026-03-25T23:38:14.000000+00:00\nLast Submission:2026-03-25T23:40:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218386", "uuid": "9b2dd783-3a3f-4b35-b5bd-4502135ce4c7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218386", "to_ids": true, "type": "md5", "uuid": "7a288abf-1ee5-461d-a1ee-12cd3ccd85e8", "value": "5ae35eed4fb0bee25594c042ef4bfc44", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215098", "to_ids": true, "type": "sha1", "uuid": "e56de1d7-627a-466c-9cc0-e6ee097be24a", "value": "a24cf3d1b487d02ada06e5099d8916764fb1b7e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215098", "to_ids": true, "type": "sha256", "uuid": "52885bbd-f25f-4945-9e21-ddb4e56d2c06", "value": "ee2d34ac98eaf1451d19fdc99f0bb52db1db60f71933a91f5655af0703ff2464", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214147", "to_ids": true, "type": "ssdeep", "uuid": "fec121da-f2f4-4af5-9341-695adc92f148", "value": "768:NnixxFFc4e40arPBm+Cx4nvY5Ekcnlkj580x3AEoG0G3:sT0aTBm+Cx4nvY5Ek+eV80u/G0G3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214147", "to_ids": false, "type": "size-in-bytes", "uuid": "1565456e-647d-4319-a0d8-d3695fb54924", "value": "51688" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214147", "to_ids": true, "type": "filename", "uuid": "ba0feb4d-c280-4c27-91db-52523906b726", "value": "main.pyc" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 08/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214147", "to_ids": false, "type": "text", "uuid": "89e0ea58-e8d3-4c44-b592-652358c0a9ef", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nVT Total Detection:24/60\nFirst Submission:2026-05-12T08:16:29.000000+00:00\nLast Submission:2026-05-20T16:57:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218407", "uuid": "fab7fc09-1a9e-4039-94d6-480f1caa5912", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218407", "to_ids": true, "type": "md5", "uuid": "f500f211-2d82-4cf2-817c-9b15b821a32d", "value": "dbcd1b56e0f73f09399b2255195166e4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215099", "to_ids": true, "type": "sha1", "uuid": "a57c7f82-abdf-4cdf-91ca-66fcd0a37c96", "value": "dcfdc280e7c5a65e197b9b0e5be3a116c6b4b41a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215099", "to_ids": true, "type": "sha256", "uuid": "dc236f73-5a52-41b9-a37e-aa04bcb92d8a", "value": "0e346fb46176ffce4c7dbe40a8682bc1f4a2fc70b7389be427568d97a47bd149", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214169", "to_ids": true, "type": "ssdeep", "uuid": "df265bf0-cf74-4f12-8373-ed5fd9960ebd", "value": "1536:uu5q30bi/UBme1Cl4n2Y5EfImUz80bBGQGs:9m0/Bm+CK2Y5Eds" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214169", "to_ids": false, "type": "size-in-bytes", "uuid": "4fb8d448-f3b2-48fa-b520-953b6789ec0a", "value": "51681" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214169", "to_ids": true, "type": "filename", "uuid": "8cbf7354-0ae5-4fc3-945f-edd24bc983e1", "value": "main.pyc" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 09/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214169", "to_ids": false, "type": "text", "uuid": "4a3e3174-ece5-4ba7-a34e-e60ae328c3bd", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nVT Total Detection:8/61\nFirst Submission:2026-04-26T06:16:51.000000+00:00\nLast Submission:2026-04-26T06:16:51.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781218429", "uuid": "e1f1c2b3-3c86-4c24-97ea-c9a4e4926f36", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781218429", "to_ids": true, "type": "md5", "uuid": "a2626dd3-6f18-43b8-af2f-791037d13f3d", "value": "5e9bd59bc69735a371444750d09bea92", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215100", "to_ids": true, "type": "sha1", "uuid": "45cb6a37-bf71-4f42-88a0-8ab4ecbedcd6", "value": "de638481d6ba5d5b8f4cacc281a36e8b13e931b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215100", "to_ids": true, "type": "sha256", "uuid": "55510d00-8b41-415e-af5b-24e9785f8ecd", "value": "eca03a7a2af5d410d65efb095cca22ccd94cf17a04caf41d808ec5bcecfde0b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781214191", "to_ids": true, "type": "ssdeep", "uuid": "a1648570-a234-4538-a1c1-c591c8213ee1", "value": "393216:eAoEG0g1CZyESMXVTor303PSt+8MriFDQ:zoEG01DS5rGWVLQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781214191", "to_ids": false, "type": "size-in-bytes", "uuid": "bac0f49c-f86e-4284-9606-914535dc9cf2", "value": "20211835" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781214191", "to_ids": true, "type": "filename", "uuid": "c73bd1ce-d084-42de-b6cb-2e9dd56d2999", "value": "kevin" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 06/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781214191", "to_ids": false, "type": "text", "uuid": "ea3d261e-f65a-4d5f-8045-7e8ab82f6085", "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2026-05-14T14:22:33.000000+00:00\nLast Submission:2026-05-14T18:07:23.000000+00:00" } ] } ] } }