{ "Event": { "analysis": "1", "date": "2026-07-16", "extends_uuid": "", "info": "[Threat Intel] The TTF Trap: A Global Campaign of a Low-Detection Lua Loader", "protected": false, "publish_timestamp": "1784588111", "published": true, "threat_level_id": "3", "timestamp": "1784588111", "uuid": "2809d91c-2f45-4670-92fa-a848d1683500", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#7223eb", "local": false, "name": "misp-galaxy:producer=\"Fortinet\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#d3f567", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#4bc785", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#d82db7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#cb2c9b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Agent Tesla\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Formbook\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Snake\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"VIP Keylogger\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784257220", "to_ids": false, "type": "link", "uuid": "24d0ab5a-150a-404f-9e4b-a066d8aba640", "value": "https://www.fortinet.com/blog/threat-research/the-ttf-trap-a-global-campaign-of-a-low-detection-lua-loader" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784257220", "to_ids": false, "type": "text", "uuid": "cc331edf-b824-43e7-81cf-826b8ff39bf8", "value": "Since late March 2026, a large-scale phishing campaign has been deploying malware including Agent Tesla, Remcos, XWorm, and Best Private LOGGER through fileless techniques and low-detection Lua-based loaders. Attackers impersonate well-known companies using business cooperation lures to distribute malicious archives containing obfuscated JavaScript files. These scripts deploy either AutoIt or LuaJIT interpreters alongside disguised scripts masquerading as TrueType Font (.ttf) files. The Lua loaders employ sophisticated anti-analysis techniques including custom ROT ciphers, decoy memory allocation, and Donut shellcode generation for reflective in-memory payload execution. The campaign evolved from simpler implementations in October 2025 to highly complex versions by June 2026, incorporating API unhooking and advanced debugging countermeasures. Victims are ultimately infected with Remote Access Trojans and infostealers that enable full system control and extensive data exfiltration." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784257220", "to_ids": false, "type": "text", "uuid": "13e6deb4-5dd2-41cc-8317-f010ecf5f90e", "value": "Name: The TTF Trap: A Global Campaign of a Low-Detection Lua Loader\nAuthor: AlienVault\nAdversary: \nTags: [\"rat deployment\", \"phishing campaign\", \"donut shellcode\", \"agent tesla\", \"xworm\", \"obfuscation\", \"autoit\", \"best private logger\", \"lua loader\", \"snake keylogger\", \"remcos\", \"ttf disguise\", \"infostealer\", \"fileless execution\"]\nTgtd countries: []\nMlwr families: [\"Agent Tesla - S0331\", \"Remcos\", \"XWorm\", \"Best Private LOGGER\", \"Snake Keylogger\"]\nAttack_ids: [\"T1053.005\", \"T1056.001\", \"T1059.007\", \"T1204.002\", \"T1497.001\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1106\", \"T1140\", \"T1055\", \"T1112\", \"T1562.001\", \"T1055.012\", \"T1027\", \"T1573\", \"T1012\", \"T1071.001\", \"T1055.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784585509", "to_ids": true, "type": "hostname", "uuid": "03aebb17-181a-44ef-a54e-770d2ed0d5c1", "value": "mail.taikei-rmc-co.biz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784585530", "to_ids": true, "type": "hostname", "uuid": "4250e2b0-5f04-4abc-b375-393f56bf2c6b", "value": "mail.allportcargoservice.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784585551", "to_ids": true, "type": "hostname", "uuid": "0d2bb8b8-1a97-479c-9635-e8a508c329cf", "value": "newremupdate.duckdns.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784585572", "to_ids": true, "type": "ip-dst", "uuid": "039f293f-adad-4c10-828f-909c421e95b3", "value": "104.239.66.86", "Tag": [ { "colour": "#8e8779", "local": false, "name": "asn:asn=\"199959\"", "relationship_type": "" }, { "colour": "#d781fd", "local": false, "name": "asn:as-owner=\"CROWNCLOUD\"", "relationship_type": "" }, { "colour": "#7f61db", "local": false, "name": "asn:as-country=\"AU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"australia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784585593", "to_ids": true, "type": "hostname", "uuid": "e987b4e6-2c32-4fde-b6dc-6ffcdcda4b55", "value": "mail.trimnt.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585052", "to_ids": true, "type": "sha256", "uuid": "4f65738e-4a44-45e8-abc0-6e029f2a79e7", "value": "16f9692debe0d4e35d76b48312979e5a90a85ce066e7375269ce78f43da52769", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585053", "to_ids": true, "type": "sha256", "uuid": "7ae3e769-0755-4b85-9b9a-37646a5909b0", "value": "3ace400380bd1fc51e83d008dbbe9ceb70b2572da95264be09d85979a6276a37", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585054", "to_ids": true, "type": "sha256", "uuid": "566538a1-3059-4c83-ab6b-639116a80c05", "value": "5409b3fa21dcc2f854697ec731f9574603dd0b6bdfd892e968a2b412ed85f52c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585055", "to_ids": true, "type": "sha256", "uuid": "6b4ffcf4-f354-46d7-bc38-8b6393e110b8", "value": "5b271a1b1ffe2716ae420f8e9d40dbc8e9e682f6e4125d4f174a335bf070ac29", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585056", "to_ids": true, "type": "sha256", "uuid": "b901b275-158d-49b2-b05e-f8417b49f194", "value": "775ae9a8c7363e2368cbb559f9c2d26a6c479d4e7998fe71d45830885ccde429", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585057", "to_ids": true, "type": "sha256", "uuid": "69cc3957-5a21-4a9f-9326-59603a607831", "value": "7df42fc54f053d1bb65f43d4386a75be02770f7923b66e713fb04631582e864e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585058", "to_ids": true, "type": "sha256", "uuid": "77f7bd5a-a160-42c1-a2f2-713643d89d0f", "value": "986d1d5270822af7d7744762ecd8fc4e9b2886c85b3660e9fdf0b5906d6c4117", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585059", "to_ids": true, "type": "sha256", "uuid": "17997baf-b663-485c-a6ec-f76320932c2f", "value": "b12b743d4ecc0fe7320b6c1533e2a60bb89f94ca39a5be37143e7af27daacf04", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585061", "to_ids": true, "type": "sha256", "uuid": "6a4e2b53-56e6-49b8-afca-9288e61f697e", "value": "c92740b6b90582a4bf73fef979ca047b9e6ae432e892a97f71e70b45c09e478e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585061", "to_ids": true, "type": "sha256", "uuid": "3a339283-41ca-418d-9357-10aff2c7468f", "value": "ca9639f7db6c3d1b37a004493f44aaa4e1282ea9333bc8ca5eac5d263d899e6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585062", "to_ids": true, "type": "sha256", "uuid": "a053a0de-7a11-4d6f-a5e2-08e5fc2ab2b1", "value": "cc041def6013da331f025e12f21f43677cea08073018d6be037f15a343a9cc24", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585063", "to_ids": true, "type": "sha256", "uuid": "949c2fe1-84d0-4716-9015-9917654f40ab", "value": "e2a95dd038a153dfb463c94554912f992cd04cf0f420552a95f4aea3d6f31e18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585065", "to_ids": true, "type": "sha256", "uuid": "4d57e8e7-4643-4b24-910f-af70fc3dc09c", "value": "fbf9a87d351ef702d87e0cd9e0148baa44c6d619f50fbf91d79a1c5e37719a77", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784585614", "to_ids": true, "type": "hostname", "uuid": "24db88ea-20b7-4258-b39b-0e213c7e3cdd", "value": "mail.teamengineersgroup.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 7004", "deleted": false, "disable_correlation": false, "timestamp": "1784472248", "to_ids": true, "type": "ip-dst|port", "uuid": "969034a7-8816-475d-9ebd-a1f1288c56cc", "value": "104.239.66.86|7004" }, { "category": "Network activity", "comment": "On port 2404", "deleted": false, "disable_correlation": false, "timestamp": "1784472248", "to_ids": true, "type": "ip-dst|port", "uuid": "283ff37b-2e7f-49b6-aaa3-344d80b39141", "value": "46.183.223.21|2404" }, { "category": "Network activity", "comment": "On port 443", "deleted": false, "disable_correlation": false, "timestamp": "1784472248", "to_ids": true, "type": "ip-dst|port", "uuid": "6fcdf5ca-e018-4c98-88b1-af4b0fd919f3", "value": "107.174.34.137|443" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784585636", "to_ids": true, "type": "url", "uuid": "0060ca9a-f7ba-4e8c-94c4-ed718d4051a9", "value": "https://cdn.discordapp.com/attachments/1499192125093449759/1511147377979818074/F10097782_Request-9200090_0990.PDF.JS", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585657", "uuid": "2c746737-88c0-45e6-b0a2-6131f0db0738", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "md5", "timestamp": "1784585657", "to_ids": true, "type": "md5", "uuid": "e43a7184-7333-477e-9f72-6867c634194b", "value": "511ba918e1781ff38310530801b8cec5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "sha1", "timestamp": "1784585027", "to_ids": true, "type": "sha1", "uuid": "16cb058b-ca7a-479a-85d7-87e7e3901b86", "value": "c029ceede8f8f8c8a4f58687e6681536fe4cc97b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "sha256", "timestamp": "1784585027", "to_ids": true, "type": "sha256", "uuid": "90486df0-8948-4af3-9632-ef4f760ab6be", "value": "41ad1f28134f4b4a443b53af04aeb3fa57a2f72a3cc58a6466e84fc3225f38be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "text", "timestamp": "1784582860", "to_ids": false, "type": "text", "uuid": "1becb95c-9106-4453-93f6-81ff75d2c615", "value": "Type Description: Win32 EXE\nOriginal name: e8ae4cc3-dac5-429a-ad46-d51bb0595a38.exe\nMicrosoft: Trojan:MSIL/AgentTesla.KKAA!MTB\nClamAV: Win.Packed.Generic-10003641-0\nVT Total Detection: 60/74\nFirst Seen In The Wild: 2025-11-13T12:55:14+00:00\nFirst Submission: 2025-11-13T09:54:30+00:00\nLast Submission: 2025-11-13T09:54:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "creation-time", "timestamp": "1784582860", "to_ids": false, "type": "datetime", "uuid": "a56bd3d0-e3da-446f-bc03-392e4b5b3d24", "value": "2024-01-22T08:55:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "ssdeep", "timestamp": "1784582860", "to_ids": true, "type": "ssdeep", "uuid": "4c85ed6f-053a-4a21-9c7d-6f9c3ac49f1d", "value": "3072:ERRc4R1Zlxme1oaYTdbB1VudhBEe5TyCStSS:ERRVR1Zlxme1oaibB1wSVCu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1784582860", "to_ids": false, "type": "size-in-bytes", "uuid": "776b4c02-137a-47ed-8f6d-d128d7221a42", "value": "240128" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "vhash", "timestamp": "1784582860", "to_ids": true, "type": "vhash", "uuid": "cfdc5c84-5d2d-4eb0-a51d-8a79e6be9187", "value": "22503655151210123704043621" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-13T09:54:30+00:00", "last_seen": "2025-11-13T09:54:30+00:00", "object_relation": "filename", "timestamp": "1784582860", "to_ids": true, "type": "filename", "uuid": "25710e8a-7d6e-4551-835c-2a1991442006", "value": "e8ae4cc3-dac5-429a-ad46-d51bb0595a38.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585678", "uuid": "f475a314-22a3-4c3a-ac5e-3c8f01116ad7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "md5", "timestamp": "1784585678", "to_ids": true, "type": "md5", "uuid": "f652e8b0-8960-4f80-a4af-2e08654e10ff", "value": "427653f81fda10bc2fd1ff739ddb5684", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "sha1", "timestamp": "1784585028", "to_ids": true, "type": "sha1", "uuid": "841f316f-22c4-469f-b424-a3d1d8f582b1", "value": "dc3e1a17bf4f55fe44ec28c977d82f7917a88f28", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "sha256", "timestamp": "1784585028", "to_ids": true, "type": "sha256", "uuid": "ad818809-2ef4-43ce-ad10-0790fc5fabab", "value": "2b1248d89fd9a7c716816f9688402942827fc1bfa89d5dccd741521725104279", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "text", "timestamp": "1784582881", "to_ids": false, "type": "text", "uuid": "ce52f9c3-9982-4bad-819e-87bf23be4371", "value": "Type Description: Win32 EXE\nOriginal name: CloudServices.exe\nMicrosoft: PWS:MSIL/Mintluks.A\nClamAV: Win.Malware.Generic-10008460-0\nVT Total Detection: 62/74\nFirst Seen In The Wild: 2025-11-19T01:33:27+00:00\nFirst Submission: 2025-11-19T00:30:20+00:00\nLast Submission: 2025-11-19T01:37:08+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "creation-time", "timestamp": "1784582882", "to_ids": false, "type": "datetime", "uuid": "fdb7fa73-f79d-490a-a1ef-cca7073cb0c9", "value": "2064-04-01T22:23:13+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "ssdeep", "timestamp": "1784582881", "to_ids": true, "type": "ssdeep", "uuid": "9ae3530d-4a78-4034-8958-1b2f764c5a70", "value": "1536:8GD4j6XrzF3hcEMKjnEcoUQK+AfbJWaCqUMR7popFFsN:H4j6bzF3hxzjnTS6J5CxMDopF8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1784582881", "to_ids": false, "type": "size-in-bytes", "uuid": "e4ebcc37-52ef-4b57-a7fb-f93da4407e69", "value": "96768" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "vhash", "timestamp": "1784582881", "to_ids": true, "type": "vhash", "uuid": "f11f354d-a4de-4ab1-8acb-42aa8c10489b", "value": "294036551512207c54303350" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-19T00:30:20+00:00", "last_seen": "2025-11-19T01:37:08+00:00", "object_relation": "filename", "timestamp": "1784582882", "to_ids": true, "type": "filename", "uuid": "eed2e3b2-f8ce-49ab-8452-0fc5893fb3cc", "value": "CloudServices.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-04T01:00:41+00:00", "last_seen": "2026-05-04T05:35:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585699", "uuid": "0ee5c987-7284-4037-be2b-f01f024ebf9f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-04T01:00:41+00:00", "last_seen": "2026-05-04T05:35:43+00:00", "object_relation": "md5", "timestamp": "1784585699", "to_ids": true, "type": "md5", "uuid": "127c03fa-8fdc-4773-8012-c4f65eda05eb", "value": "a253bf7664278fdf7b41866c300c500a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-04T01:00:41+00:00", "last_seen": "2026-05-04T05:35:43+00:00", "object_relation": "sha1", "timestamp": "1784585029", "to_ids": true, "type": "sha1", "uuid": "216ed1ee-00c9-4d43-9d28-eaed8f9076c6", "value": "8416063b828d2d0182878f63a1d72680a0e63e4e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-04T01:00:41+00:00", "last_seen": "2026-05-04T05:35:43+00:00", "object_relation": "sha256", "timestamp": "1784585029", "to_ids": true, "type": "sha256", "uuid": "5bccd093-3694-4c2d-a10f-6aace9f63ef8", "value": "417fc4d6119dac40f276b563498a0ad3f9bf42262ec650a4463cbdbe78da388b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-04T01:00:41+00:00", "last_seen": "2026-05-04T05:35:43+00:00", "object_relation": "text", "timestamp": "1784582904", "to_ids": false, "type": "text", "uuid": "98d13fe1-0c63-4717-a097-3e2b1c3e3b6b", "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 12/74\nFirst Submission: 2026-05-04T01:00:41+00:00\nLast Submission: 2026-05-04T05:35:43+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-04T01:00:41+00:00", "last_seen": "2026-05-04T05:35:43+00:00", "object_relation": "ssdeep", "timestamp": "1784582904", "to_ids": true, "type": "ssdeep", "uuid": "8ad09995-ca79-49c6-ad1d-f77031b548e7", "value": "98304:AdIgNB1Hy9MnVsYESVEIUdBHaz3ec1s/hixgykZLz7k7m+eHo4Bn2akf/rdsHDSf:A29qsqVzUb67h+/wxlkZLzom+6nBnQrj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-04T01:00:41+00:00", "last_seen": "2026-05-04T05:35:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784582904", "to_ids": false, "type": "size-in-bytes", "uuid": "42b8a31c-6aa6-43cc-8f78-b87bd2b430f5", "value": "4357224" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-04T01:00:41+00:00", "last_seen": "2026-05-04T05:35:43+00:00", "object_relation": "filename", "timestamp": "1784582904", "to_ids": true, "type": "filename", "uuid": "6bedd84d-dec0-491a-9404-f66c3034919d", "value": "Order-Drawing.JS" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-18T07:37:01+00:00", "last_seen": "2026-05-18T07:37:01+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585720", "uuid": "a8afdfd2-ebc7-4e74-92bc-ecd0a97c7b2d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T07:37:01+00:00", "last_seen": "2026-05-18T07:37:01+00:00", "object_relation": "md5", "timestamp": "1784585720", "to_ids": true, "type": "md5", "uuid": "70a81e2e-4a72-43a2-bc20-acf6c7ada197", "value": "ff3db8cc2d38ca5878a32fe40d7a8ba5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T07:37:01+00:00", "last_seen": "2026-05-18T07:37:01+00:00", "object_relation": "sha1", "timestamp": "1784585030", "to_ids": true, "type": "sha1", "uuid": "481a6519-5830-46a1-addb-3c13018bd4b2", "value": "f17ee43fda3735a0eea7330774ed6c10c0749fa5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T07:37:01+00:00", "last_seen": "2026-05-18T07:37:01+00:00", "object_relation": "sha256", "timestamp": "1784585030", "to_ids": true, "type": "sha256", "uuid": "c994f797-a7f3-411e-af7d-d184af3138b3", "value": "619d2628dcf0c8e15a6febb0e562609556ca57f9f8216800ee77a39e336b8bf4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T07:37:01+00:00", "last_seen": "2026-05-18T07:37:01+00:00", "object_relation": "text", "timestamp": "1784582925", "to_ids": false, "type": "text", "uuid": "17597323-66ff-4cc5-b0ca-337d31628b48", "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 28/74\nFirst Seen In The Wild: 2026-05-18T16:01:01+00:00\nFirst Submission: 2026-05-18T07:37:01+00:00\nLast Submission: 2026-05-18T07:37:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T07:37:01+00:00", "last_seen": "2026-05-18T07:37:01+00:00", "object_relation": "ssdeep", "timestamp": "1784582925", "to_ids": true, "type": "ssdeep", "uuid": "c47c340f-f4d9-4aff-91b1-d661802e89a7", "value": "98304:OwdOH9870mZjh1G3bSfAvP0gBDvtfzXGlk2mUgBUWOIHo5ihuLv6P:Owkmjh1G3WzgBDvtbWl5RdWOII5kuLvU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T07:37:01+00:00", "last_seen": "2026-05-18T07:37:01+00:00", "object_relation": "size-in-bytes", "timestamp": "1784582925", "to_ids": false, "type": "size-in-bytes", "uuid": "fe956e00-e010-4c6a-9da3-bd7d77cce6ff", "value": "4079011" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T07:37:01+00:00", "last_seen": "2026-05-18T07:37:01+00:00", "object_relation": "filename", "timestamp": "1784582925", "to_ids": true, "type": "filename", "uuid": "5cdc7518-e88a-4ed6-bb4e-a30895e8d2ce", "value": "PO0012321.JS" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T20:48:31+00:00", "last_seen": "2026-07-03T19:02:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585742", "uuid": "8231d1cb-5bf5-4c20-a150-b8ea5f50dfd1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:48:31+00:00", "last_seen": "2026-07-03T19:02:34+00:00", "object_relation": "md5", "timestamp": "1784585742", "to_ids": true, "type": "md5", "uuid": "af2f26ee-7e3c-46de-a3a8-9dab4be3b0c0", "value": "efd92efb0321bf811e74717974b14897", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:48:31+00:00", "last_seen": "2026-07-03T19:02:34+00:00", "object_relation": "sha1", "timestamp": "1784585031", "to_ids": true, "type": "sha1", "uuid": "31e7f2e3-3e70-41fa-bdc2-eee05efc1da7", "value": "425ba7d4138a0e72e0e32db5438ee4bd88aa2982", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:48:31+00:00", "last_seen": "2026-07-03T19:02:34+00:00", "object_relation": "sha256", "timestamp": "1784585031", "to_ids": true, "type": "sha256", "uuid": "d768c448-6e2b-40de-8477-8f0aebf910b6", "value": "96e22da4d5c0ea4b0efde0ad3eaa8fdedc60228f84fb3c56899afbb9338da2a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:48:31+00:00", "last_seen": "2026-07-03T19:02:34+00:00", "object_relation": "text", "timestamp": "1784582946", "to_ids": false, "type": "text", "uuid": "91af852c-afdf-4afc-b218-d0d96f99d984", "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 32/74\nFirst Seen In The Wild: 2026-06-15T08:00:37+00:00\nFirst Submission: 2026-06-15T20:48:31+00:00\nLast Submission: 2026-07-03T19:02:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:48:31+00:00", "last_seen": "2026-07-03T19:02:34+00:00", "object_relation": "ssdeep", "timestamp": "1784582946", "to_ids": true, "type": "ssdeep", "uuid": "58c9570b-dc72-492b-9534-141490559f51", "value": "98304:HCyUnDTa91GGb65Xjqp8GXr2mhih9jGdBQ/O03zAqCtLUb0g3WrG58QFssno4Dkk:HCyUDaKljOrp6yQGIxbzWrG+QFssno0t" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:48:31+00:00", "last_seen": "2026-07-03T19:02:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784582946", "to_ids": false, "type": "size-in-bytes", "uuid": "a1d2870a-5a04-4a3b-b13d-f8f6f572dd8f", "value": "3642968" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:48:31+00:00", "last_seen": "2026-07-03T19:02:34+00:00", "object_relation": "filename", "timestamp": "1784582946", "to_ids": true, "type": "filename", "uuid": "17282fca-882c-4a42-b9fd-520deb6f692e", "value": "Inquiry-05201569.JS" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-31T21:56:12+00:00", "last_seen": "2026-06-12T17:28:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585763", "uuid": "88c28838-20af-4007-9a97-0741e4683010", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-31T21:56:12+00:00", "last_seen": "2026-06-12T17:28:09+00:00", "object_relation": "md5", "timestamp": "1784585763", "to_ids": true, "type": "md5", "uuid": "41263558-50bc-4364-bbd4-c852aae0b257", "value": "ba2793c45a12e96683a8b1b7cb5a5c3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-31T21:56:12+00:00", "last_seen": "2026-06-12T17:28:09+00:00", "object_relation": "sha1", "timestamp": "1784585032", "to_ids": true, "type": "sha1", "uuid": "8ad154f6-c11c-4aef-887f-c47894ca1481", "value": "9d8a4d41058d5d7934d55f2c97d032124a0d74e3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-31T21:56:12+00:00", "last_seen": "2026-06-12T17:28:09+00:00", "object_relation": "sha256", "timestamp": "1784585032", "to_ids": true, "type": "sha256", "uuid": "ff3f33f8-2deb-4002-9815-351b2eba1c2b", "value": "1d9dd914cf623dcae4b88834744a005e5e3eae827ded1aafd23ed1d7be57b90a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-31T21:56:12+00:00", "last_seen": "2026-06-12T17:28:09+00:00", "object_relation": "text", "timestamp": "1784582968", "to_ids": false, "type": "text", "uuid": "b5ff444b-18cd-4a41-8895-687e8b748855", "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-05-31T21:56:12+00:00\nLast Submission: 2026-06-12T17:28:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-31T21:56:12+00:00", "last_seen": "2026-06-12T17:28:09+00:00", "object_relation": "ssdeep", "timestamp": "1784582968", "to_ids": true, "type": "ssdeep", "uuid": "73259461-6369-4fd2-a27a-f903c51a6124", "value": "98304:Y9CihFVaPtgwZZvOx1R7U4GNk07dfHavC9ITZWdK4F5TbIXM9kh5dH8FIwb:YNhFVa1gAWx1R7KNkaS44+hz85dG7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-31T21:56:12+00:00", "last_seen": "2026-06-12T17:28:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784582968", "to_ids": false, "type": "size-in-bytes", "uuid": "1def4024-4a9c-4a44-9646-5519f12732aa", "value": "5309137" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-31T21:56:12+00:00", "last_seen": "2026-06-12T17:28:09+00:00", "object_relation": "filename", "timestamp": "1784582968", "to_ids": true, "type": "filename", "uuid": "5194e074-b0e1-4adb-ad00-d518875f2241", "value": "RIETER REQUEST FOR QUOTATION NO. 101553787 DT..JS" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-02T01:04:33+00:00", "last_seen": "2026-06-02T01:04:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585784", "uuid": "e72f7849-29bf-4f86-a4b8-4cc434ac9aa1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T01:04:33+00:00", "last_seen": "2026-06-02T01:04:33+00:00", "object_relation": "md5", "timestamp": "1784585784", "to_ids": true, "type": "md5", "uuid": "c6773b91-e7de-4789-bb19-84f6db9b9c47", "value": "c5724b86aae0e637b8b0b6f3c8d31168", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T01:04:33+00:00", "last_seen": "2026-06-02T01:04:33+00:00", "object_relation": "sha1", "timestamp": "1784585033", "to_ids": true, "type": "sha1", "uuid": "383dfe21-17c5-417e-bf09-1e2f83059eee", "value": "409f57557a91d2a7a424d122aef4e73f2b533b18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T01:04:33+00:00", "last_seen": "2026-06-02T01:04:33+00:00", "object_relation": "sha256", "timestamp": "1784585034", "to_ids": true, "type": "sha256", "uuid": "a00adedd-418c-4f41-b4d0-8a8c593dc867", "value": "8c28bc87eb4f2613117d41a716e78f62d55c19edaeea573c2c96e787da055167", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T01:04:33+00:00", "last_seen": "2026-06-02T01:04:33+00:00", "object_relation": "text", "timestamp": "1784582989", "to_ids": false, "type": "text", "uuid": "a2bc2d8c-9df0-401a-a0ea-7b65370967ef", "value": "Type Description: Text\nMicrosoft: Trojan:Script/Cryxos.HAB!MTB\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-06-02T01:04:33+00:00\nLast Submission: 2026-06-02T01:04:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T01:04:33+00:00", "last_seen": "2026-06-02T01:04:33+00:00", "object_relation": "ssdeep", "timestamp": "1784582989", "to_ids": true, "type": "ssdeep", "uuid": "5edf5f57-aff5-4019-921c-7f69636b9c94", "value": "6144:KO/l0PfU1yZ9FJhWpsVdlLzG/wJ/EwqlLHHLRqLlpWWvNYdf:z0PfCyZT/CsVdlLz8E/EwqlLHHLRqLle" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T01:04:33+00:00", "last_seen": "2026-06-02T01:04:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1784582989", "to_ids": false, "type": "size-in-bytes", "uuid": "34d83e8b-2818-457d-88fb-8d08de947235", "value": "390039" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T01:04:33+00:00", "last_seen": "2026-06-02T01:04:33+00:00", "object_relation": "filename", "timestamp": "1784582990", "to_ids": true, "type": "filename", "uuid": "9b5a2c46-8807-40af-a14a-1409946064c1", "value": "RWRVUIXAHFRTHKAJ.ttf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-10-30T08:33:12+00:00", "last_seen": "2025-10-30T08:33:12+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585806", "uuid": "08162ff0-d514-47fe-92d0-168ec9cf62e1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-30T08:33:12+00:00", "last_seen": "2025-10-30T08:33:12+00:00", "object_relation": "md5", "timestamp": "1784585806", "to_ids": true, "type": "md5", "uuid": "40dbeec6-605e-48a1-8336-7c844538f95f", "value": "380dd190925c43f660db2ed6a7bb2ee3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-30T08:33:12+00:00", "last_seen": "2025-10-30T08:33:12+00:00", "object_relation": "sha1", "timestamp": "1784585035", "to_ids": true, "type": "sha1", "uuid": "74b22c17-e7ec-4682-b0e7-690467fc9fd4", "value": "0479e55be6bac3bd64107de94c17d2cd645dfd65", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-30T08:33:12+00:00", "last_seen": "2025-10-30T08:33:12+00:00", "object_relation": "sha256", "timestamp": "1784585035", "to_ids": true, "type": "sha256", "uuid": "01b9527c-2a75-419c-8479-4092d40e0e4b", "value": "05390dd0d2c84f77475c0c6aa082638e23977da591302e911cbcb071c42a9451", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-30T08:33:12+00:00", "last_seen": "2025-10-30T08:33:12+00:00", "object_relation": "text", "timestamp": "1784583011", "to_ids": false, "type": "text", "uuid": "f3e8971d-48ee-4e82-9d84-ed41d8409222", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/Remcos.CT!MTB\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2025-10-30T08:33:12+00:00\nLast Submission: 2025-10-30T08:33:12+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-30T08:33:12+00:00", "last_seen": "2025-10-30T08:33:12+00:00", "object_relation": "ssdeep", "timestamp": "1784583011", "to_ids": true, "type": "ssdeep", "uuid": "fbe74fbc-912a-48bd-bedc-b71dad64c1c8", "value": "12288:+UNl33ffuR7kWhtVE5plZ+d5l7b0/S50D91F7K3tx3zg9yK8JtE1pZo:+gluR7pED7+pgTDHGbU9yK8Jqo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-30T08:33:12+00:00", "last_seen": "2025-10-30T08:33:12+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583011", "to_ids": false, "type": "size-in-bytes", "uuid": "f8cc2ebf-d1e5-4462-a53d-6a4601aca207", "value": "695414" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-30T08:33:12+00:00", "last_seen": "2025-10-30T08:33:12+00:00", "object_relation": "filename", "timestamp": "1784583011", "to_ids": true, "type": "filename", "uuid": "3d05d5b4-5a53-48eb-bce4-0af9a2bc2cca", "value": "payload_1.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-18T10:18:39+00:00", "last_seen": "2026-05-18T10:18:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585828", "uuid": "b56383e5-6487-4045-b46a-1c9170fbdd6b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T10:18:39+00:00", "last_seen": "2026-05-18T10:18:39+00:00", "object_relation": "md5", "timestamp": "1784585828", "to_ids": true, "type": "md5", "uuid": "1f99fdb1-3fc2-48bf-91da-d160a24b9c3d", "value": "03f8d903c1b02fad85ec800db4003e15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T10:18:39+00:00", "last_seen": "2026-05-18T10:18:39+00:00", "object_relation": "sha1", "timestamp": "1784585036", "to_ids": true, "type": "sha1", "uuid": "906a7076-f2ed-4e18-9ab0-a387c3db5898", "value": "d84b8ab3df67b7a2b77c295f269bfd83bcd4216f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T10:18:39+00:00", "last_seen": "2026-05-18T10:18:39+00:00", "object_relation": "sha256", "timestamp": "1784585036", "to_ids": true, "type": "sha256", "uuid": "ee270ee6-fa12-4c57-beb8-3a9bc1fe502d", "value": "1539468a21a439dd4f8d72a6c34ce503f0585281fc2e88535c3c33727bfdc717", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T10:18:39+00:00", "last_seen": "2026-05-18T10:18:39+00:00", "object_relation": "text", "timestamp": "1784583032", "to_ids": false, "type": "text", "uuid": "35e2b1be-cf82-4656-8c9e-0231d89aad28", "value": "Type Description: Text\nMicrosoft: Trojan:AutoIt/FormBook.VD!MTB\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-05-18T10:18:39+00:00\nLast Submission: 2026-05-18T10:18:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T10:18:39+00:00", "last_seen": "2026-05-18T10:18:39+00:00", "object_relation": "ssdeep", "timestamp": "1784583032", "to_ids": true, "type": "ssdeep", "uuid": "44faa3a4-273d-45ba-9335-e56c5c8e67a1", "value": "768:Vt8+uVE3k5tTZ/Z0ZZremWGFOinrNQMrN3srN/W0UzUk5rW0J80gy/upW0JZzTTR:A+gJTZ/Z0ZZCZGFOinrNQMrN8rNO0Uzk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T10:18:39+00:00", "last_seen": "2026-05-18T10:18:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583032", "to_ids": false, "type": "size-in-bytes", "uuid": "57b12ef0-9aef-4ffa-821a-f9f637aa5a89", "value": "26828" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T10:18:39+00:00", "last_seen": "2026-05-18T10:18:39+00:00", "object_relation": "filename", "timestamp": "1784583032", "to_ids": true, "type": "filename", "uuid": "74b2edac-8f69-43ca-ae6c-1b6cb9ca220b", "value": "kqudhntwhmskdnycflvdtgzfv.ttf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-20T06:49:51+00:00", "last_seen": "2026-07-20T06:49:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585849", "uuid": "55ad1114-53dd-4af1-9ab0-e1c10144e272", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-20T06:49:51+00:00", "last_seen": "2026-07-20T06:49:51+00:00", "object_relation": "md5", "timestamp": "1784585849", "to_ids": true, "type": "md5", "uuid": "99323011-2cae-4af0-a060-a07df1dabf00", "value": "96e44ebf5b90f11a4d8eb65beeccb9bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-20T06:49:51+00:00", "last_seen": "2026-07-20T06:49:51+00:00", "object_relation": "sha1", "timestamp": "1784585037", "to_ids": true, "type": "sha1", "uuid": "96c91784-f757-4bb9-a9a3-1035b6c54d3b", "value": "6c1dcaf2fb4c4385ff0f9783dbf5df8e7cc59228", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-20T06:49:51+00:00", "last_seen": "2026-07-20T06:49:51+00:00", "object_relation": "sha256", "timestamp": "1784585038", "to_ids": true, "type": "sha256", "uuid": "9c23aa1a-8dfa-4c96-99ee-bdd60a4f21d6", "value": "16516e3298278719123068bf0ed808ea4e00f73c970a8a83377066b4e3c3c950", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-20T06:49:51+00:00", "last_seen": "2026-07-20T06:49:51+00:00", "object_relation": "text", "timestamp": "1784583054", "to_ids": false, "type": "text", "uuid": "256832b4-8ae6-4d61-9d22-47c68a5a4dda", "value": "Type Description: Text\nMicrosoft: Trojan:AutoIt/FormBook.VD!MTB\nClamAV: None\nVT Total Detection: 11/74\nFirst Submission: 2026-07-20T06:49:51+00:00\nLast Submission: 2026-07-20T06:49:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-20T06:49:51+00:00", "last_seen": "2026-07-20T06:49:51+00:00", "object_relation": "ssdeep", "timestamp": "1784583054", "to_ids": true, "type": "ssdeep", "uuid": "bd7523db-06d2-49b3-88f3-d3d9a3f52bb2", "value": "384:SoUA8QLXUi3cfmCigeiwcibLiLbAxRCcYi6R/Ra:jb8QLXZDghwnbuwxRv76R/Ra" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-20T06:49:51+00:00", "last_seen": "2026-07-20T06:49:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583054", "to_ids": false, "type": "size-in-bytes", "uuid": "41cd5a61-14d1-4ccb-a994-ed64500da909", "value": "26574" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-20T06:49:51+00:00", "last_seen": "2026-07-20T06:49:51+00:00", "object_relation": "filename", "timestamp": "1784583054", "to_ids": true, "type": "filename", "uuid": "fa2de203-40c0-4cd4-af55-306406d660fd", "value": "HGADFQPGOSLWLSOOA.ttf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-12T10:53:15+00:00", "last_seen": "2026-05-12T10:53:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585870", "uuid": "f1b85e54-93c4-408d-a215-4d8904b5d65a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T10:53:15+00:00", "last_seen": "2026-05-12T10:53:15+00:00", "object_relation": "md5", "timestamp": "1784585870", "to_ids": true, "type": "md5", "uuid": "a885b41f-6b7d-4f8b-81eb-e4c91264040d", "value": "f98fe470957dd20886980ab75d32a923", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T10:53:15+00:00", "last_seen": "2026-05-12T10:53:15+00:00", "object_relation": "sha1", "timestamp": "1784585039", "to_ids": true, "type": "sha1", "uuid": "c1c957b6-1abd-4a19-bb05-ee250c2be057", "value": "2d5c5cff48e5273cd2ffc7cfd5a64a57819d8ffd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T10:53:15+00:00", "last_seen": "2026-05-12T10:53:15+00:00", "object_relation": "sha256", "timestamp": "1784585039", "to_ids": true, "type": "sha256", "uuid": "42ba637f-5a13-4f40-9803-b742e3b1bac3", "value": "1c4419d687bf45bdc5474b6347e41e89459fc0f5115f0d012c46c57280b242bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T10:53:15+00:00", "last_seen": "2026-05-12T10:53:15+00:00", "object_relation": "text", "timestamp": "1784583096", "to_ids": false, "type": "text", "uuid": "c9eed842-957e-4c63-bb4b-2c78a51a8ad6", "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 19/74\nFirst Submission: 2026-05-12T10:53:15+00:00\nLast Submission: 2026-05-12T10:53:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T10:53:15+00:00", "last_seen": "2026-05-12T10:53:15+00:00", "object_relation": "ssdeep", "timestamp": "1784583096", "to_ids": true, "type": "ssdeep", "uuid": "66fe3c04-3083-4d2e-9056-f5f413556c6b", "value": "98304:XHzWnSxx4/GX6QSI1jF7pAxEseWj2IG3+wPn/nDBUNddNADAw9IwVFbo919haz6c:XzBfXYI1jz2Ei2xr0ddNBT91LTVuRwl8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T10:53:15+00:00", "last_seen": "2026-05-12T10:53:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583096", "to_ids": false, "type": "size-in-bytes", "uuid": "8a7768dd-4ab1-49e2-9f76-4d53f5242c55", "value": "4472390" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T10:53:15+00:00", "last_seen": "2026-05-12T10:53:15+00:00", "object_relation": "filename", "timestamp": "1784583096", "to_ids": true, "type": "filename", "uuid": "969fa0a2-440d-46bd-81d1-1e7b4c0b64e0", "value": "Swift_bestellung00039889499849484999387933.JS" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585892", "uuid": "9dd49e2b-122f-4e88-8baf-9bb6b498f385", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "md5", "timestamp": "1784585892", "to_ids": true, "type": "md5", "uuid": "237c6ff6-abaf-4448-af60-7f0ac4aea4a6", "value": "127aa24592a4c7aa3bdda66c2159f61e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "sha1", "timestamp": "1784585040", "to_ids": true, "type": "sha1", "uuid": "f4e1fc6e-e65d-4cf5-b4b9-baef7ebf4c87", "value": "705d2382562561487cb24184859f94159160dee4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "sha256", "timestamp": "1784585040", "to_ids": true, "type": "sha256", "uuid": "0eb1a020-a17c-4ef1-ab6c-3a2731d64065", "value": "2fe30eccd36f4346cb117af0cf626c2bca84b50c658b0c9af09110b9f86a53f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "text", "timestamp": "1784583117", "to_ids": false, "type": "text", "uuid": "c3bb350c-b4f9-4723-ba4e-d8739926dcd5", "value": "Type Description: Win32 EXE\nOriginal name: CloudServices.exe\nMicrosoft: PWS:MSIL/Mintluks.A\nClamAV: Win.Malware.Generic-10008460-0\nVT Total Detection: 60/74\nFirst Seen In The Wild: 2026-05-29T15:24:21+00:00\nFirst Submission: 2026-05-29T14:24:15+00:00\nLast Submission: 2026-06-04T12:40:39+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "creation-time", "timestamp": "1784583117", "to_ids": false, "type": "datetime", "uuid": "05a6560c-f021-40f8-985a-feffc6f58776", "value": "2064-04-01T22:23:13+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "ssdeep", "timestamp": "1784583117", "to_ids": true, "type": "ssdeep", "uuid": "48f3772e-7886-46b9-8c0c-b3c8c4db36d9", "value": "1536:6GD4jhEVgPVRjbgKjnEcoUJK8AfbJWaCqUMR7pApFF8l:94jhEVgPVp3jnTTMJ5CxMDApFE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583117", "to_ids": false, "type": "size-in-bytes", "uuid": "d20e3e7a-e3d5-4e9d-9092-1da550cc1afa", "value": "96256" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "vhash", "timestamp": "1784583117", "to_ids": true, "type": "vhash", "uuid": "b97cdee9-a1a9-44c7-b2c0-e83166e39da9", "value": "294036551512207c54303350" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T14:24:15+00:00", "last_seen": "2026-06-04T12:40:39+00:00", "object_relation": "filename", "timestamp": "1784583117", "to_ids": true, "type": "filename", "uuid": "28603338-b601-4d9c-8bc0-6e0b00a5e941", "value": "CloudServices.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-25T10:40:08+00:00", "last_seen": "2026-05-25T10:40:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585913", "uuid": "b169062f-bd38-40d9-8b71-8e3ea82e92c0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T10:40:08+00:00", "last_seen": "2026-05-25T10:40:08+00:00", "object_relation": "md5", "timestamp": "1784585913", "to_ids": true, "type": "md5", "uuid": "615b9732-2003-4297-8e20-ab681b2e05b6", "value": "02ec1679fdf3300b451360bfdbc5eb39", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T10:40:08+00:00", "last_seen": "2026-05-25T10:40:08+00:00", "object_relation": "sha1", "timestamp": "1784585042", "to_ids": true, "type": "sha1", "uuid": "72d02830-e734-43b4-8c9f-fd0712bffada", "value": "e1b36d5ba813b50c9d4bf9f8899399c33294f9df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T10:40:08+00:00", "last_seen": "2026-05-25T10:40:08+00:00", "object_relation": "sha256", "timestamp": "1784585042", "to_ids": true, "type": "sha256", "uuid": "c1749860-02a8-4af8-b232-0cd9220d3454", "value": "4c001e107a42d65c1b1e6092e4aa6932dbd1544d097d1a432ba27e3b4bddfcc1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T10:40:08+00:00", "last_seen": "2026-05-25T10:40:08+00:00", "object_relation": "text", "timestamp": "1784583160", "to_ids": false, "type": "text", "uuid": "2b31b1e4-426d-4f89-a981-60fa3d075ae5", "value": "Type Description: Text\nMicrosoft: Trojan:AutoIt/FormBook.VD!MTB\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2026-05-25T10:40:08+00:00\nLast Submission: 2026-05-25T10:40:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T10:40:08+00:00", "last_seen": "2026-05-25T10:40:08+00:00", "object_relation": "ssdeep", "timestamp": "1784583160", "to_ids": true, "type": "ssdeep", "uuid": "3a463c10-a28b-4bcc-a2cd-426c1858b595", "value": "768:2qPqjq8qWqXqvqbqmqmqjqsqIqjqjqSq3qjqjq6qtqbqbqmqOqpqVhqRq+qIqbql:slhF+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T10:40:08+00:00", "last_seen": "2026-05-25T10:40:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583160", "to_ids": false, "type": "size-in-bytes", "uuid": "3331c12d-df3d-42a0-9f5f-e87e058a2341", "value": "26828" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T10:40:08+00:00", "last_seen": "2026-05-25T10:40:08+00:00", "object_relation": "filename", "timestamp": "1784583160", "to_ids": true, "type": "filename", "uuid": "df3a5813-9d2b-4a93-998c-95318af31eef", "value": "WLUBKRHSWZKTZBWLMFJMKOTLF.ttf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-02T05:17:12+00:00", "last_seen": "2026-06-02T11:34:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585934", "uuid": "45e1f3d7-ebd5-4242-8b47-9447dd60d82a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:17:12+00:00", "last_seen": "2026-06-02T11:34:05+00:00", "object_relation": "md5", "timestamp": "1784585934", "to_ids": true, "type": "md5", "uuid": "8d23c856-fee9-40da-a088-a9f059656d3c", "value": "b0970910f70d3f95a2f4605a499545ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:17:12+00:00", "last_seen": "2026-06-02T11:34:05+00:00", "object_relation": "sha1", "timestamp": "1784585043", "to_ids": true, "type": "sha1", "uuid": "9f57fe0c-0487-4f8e-8410-e22a4a327a6e", "value": "9585db3be82893b5e727f3d055c1417f72893065", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:17:12+00:00", "last_seen": "2026-06-02T11:34:05+00:00", "object_relation": "sha256", "timestamp": "1784585043", "to_ids": true, "type": "sha256", "uuid": "b7c6890a-5de7-4e39-9015-211aeb8e7565", "value": "6700e6d2a0c285d3ebf1a55aecec63b1e42d7d581f691331c667a8920dac7029", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T05:17:12+00:00", "last_seen": "2026-06-02T11:34:05+00:00", "object_relation": "text", "timestamp": "1784583223", "to_ids": false, "type": "text", "uuid": "94ebd60c-9e48-41b9-a2f5-b857f1c4437c", "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/Cryxos.HBY!MTB\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-06-02T05:17:12+00:00\nLast Submission: 2026-06-02T11:34:05+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:17:12+00:00", "last_seen": "2026-06-02T11:34:05+00:00", "object_relation": "ssdeep", "timestamp": "1784583223", "to_ids": true, "type": "ssdeep", "uuid": "2cccb42a-a46f-42ae-b196-57e7ce4f0d44", "value": "98304:ITmZ2q4SH5fp8krTsOM0/MiiQatvRsxOwQe5oVehb7szWPi3Q0/vQen:eSH5BAOM0/piQatpKOwDaehb7Qr3QsIe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T05:17:12+00:00", "last_seen": "2026-06-02T11:34:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583223", "to_ids": false, "type": "size-in-bytes", "uuid": "c209cd6e-c36a-44be-b22d-e9d60605b5c1", "value": "5034802" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T05:17:12+00:00", "last_seen": "2026-06-02T11:34:05+00:00", "object_relation": "filename", "timestamp": "1784583223", "to_ids": true, "type": "filename", "uuid": "aaf1744b-7aeb-4aac-b7a3-02cf70f851c7", "value": "F10097782 (Request)-9200090_0990.PDF.JS" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585955", "uuid": "30ad10bd-af52-499e-bff4-456edd113f07", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "object_relation": "md5", "timestamp": "1784585955", "to_ids": true, "type": "md5", "uuid": "cc4c9a59-105a-4039-aa0c-ad2220c2e384", "value": "5eab356fc08df9961247dd1f14e59626", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "object_relation": "sha1", "timestamp": "1784585045", "to_ids": true, "type": "sha1", "uuid": "4d0674e7-2e66-4666-b43b-36aa610b2041", "value": "eb0f94326af92923e329e0b78d9cd2b15e84b475", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "object_relation": "sha256", "timestamp": "1784585045", "to_ids": true, "type": "sha256", "uuid": "4d23ad97-06a2-49ae-9696-7ba6a74527d0", "value": "81edd5e740bea0fefb5c1bbd14a671bd1daff37bf3641e34f3a1f7e93559184a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "object_relation": "text", "timestamp": "1784583287", "to_ids": false, "type": "text", "uuid": "64d5ba99-1af2-437c-9b61-1552df860ae1", "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-05-24T00:38:12+00:00\nLast Submission: 2026-05-28T05:54:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "object_relation": "ssdeep", "timestamp": "1784583287", "to_ids": true, "type": "ssdeep", "uuid": "bbd901c8-3d5e-4852-9f33-d095b343ca8b", "value": "98304:FG9dFaTG+KZWIZbHPfLRwMEterCS++arhW0J27bfYoa2J7b3IhFmzA/bD:Uj3+KZWODRwMEt6CSPag0Q7bTa2lIR/3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583287", "to_ids": false, "type": "size-in-bytes", "uuid": "607724ca-4702-41b9-b7e2-a0d2da35e9ce", "value": "4276487" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "object_relation": "vhash", "timestamp": "1784583287", "to_ids": true, "type": "vhash", "uuid": "a4bf5b56-67b2-44ab-b792-17541a369c4c", "value": "91bed147bdb8be0819c2d756a0f1b9df" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-24T00:38:12+00:00", "last_seen": "2026-05-28T05:54:52+00:00", "object_relation": "filename", "timestamp": "1784583287", "to_ids": true, "type": "filename", "uuid": "e71686d3-d9c2-4192-b716-53d955670978", "value": "RFQ_SSQ2026_1880_P503_PA_NO. 326087_SS304_PO#2021980.JS" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585976", "uuid": "e9d80e89-5fa1-48fa-8f17-e2b621fcfbb0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "md5", "timestamp": "1784585976", "to_ids": true, "type": "md5", "uuid": "dc2d40f9-d54d-4aab-b4de-8074a75c3b44", "value": "b5e5043bbd61d65511b8ea13a299a529", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "sha1", "timestamp": "1784585046", "to_ids": true, "type": "sha1", "uuid": "7390c6a3-45c3-46f5-82c7-b2e07af8519c", "value": "20ea34c28a685e04871f8c91b019658ea34d1083", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "sha256", "timestamp": "1784585046", "to_ids": true, "type": "sha256", "uuid": "3f281b25-a180-45c0-8508-09ebf643fb72", "value": "9674da676ee226ee456d35c774715d9b58655423806f281de19dc9ef899e9532", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "text", "timestamp": "1784583309", "to_ids": false, "type": "text", "uuid": "c0d792fb-4f25-42fe-9153-76962ce4638d", "value": "Type Description: PDF\nMicrosoft: None\nClamAV: None\nVT Total Detection: 18/74\nFirst Submission: 2026-06-02T05:11:55+00:00\nLast Submission: 2026-06-11T03:59:34+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "creation-time", "timestamp": "1784583309", "to_ids": false, "type": "datetime", "uuid": "b925ddb4-fc7e-4196-a207-056854431bdd", "value": "2026-06-01T17:21:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "ssdeep", "timestamp": "1784583309", "to_ids": true, "type": "ssdeep", "uuid": "05106c2a-a357-4669-a713-5ca2353ad17c", "value": "3072:6pmHtNf660ayqQnm/JyCWXcZ3Vt7s1Rry7ckr:5fcuQnm/CcZaQckr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583309", "to_ids": false, "type": "size-in-bytes", "uuid": "95198bae-02e0-4a49-af6c-986160e884f2", "value": "141475" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "vhash", "timestamp": "1784583309", "to_ids": true, "type": "vhash", "uuid": "d0c1922a-b4a8-4200-8219-f9355774c1bf", "value": "9a21daac0a7be585b8149f09ac43f68bf" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T05:11:55+00:00", "last_seen": "2026-06-11T03:59:34+00:00", "object_relation": "filename", "timestamp": "1784583309", "to_ids": true, "type": "filename", "uuid": "5dea8ac2-38e0-408e-b496-7b60e1958844", "value": "__substg1.0_37010102" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-12T10:58:55+00:00", "last_seen": "2026-05-12T10:58:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784585997", "uuid": "69e75ead-c37a-429d-ae48-db1f3141ceae", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T10:58:55+00:00", "last_seen": "2026-05-12T10:58:55+00:00", "object_relation": "md5", "timestamp": "1784585997", "to_ids": true, "type": "md5", "uuid": "59ec089d-8f15-4971-84cb-8fc9b6d45e8b", "value": "4afea26fd1c3fb593f125bb6d6d3fb88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T10:58:55+00:00", "last_seen": "2026-05-12T10:58:55+00:00", "object_relation": "sha1", "timestamp": "1784585047", "to_ids": true, "type": "sha1", "uuid": "99399ff7-58e6-4314-9d0f-894941f8dcda", "value": "825254b566f7fa98b7ab6039210110c3f7644bb2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T10:58:55+00:00", "last_seen": "2026-05-12T10:58:55+00:00", "object_relation": "sha256", "timestamp": "1784585047", "to_ids": true, "type": "sha256", "uuid": "fd150714-242e-47cd-babe-9599f6311627", "value": "bbeb74e6af12536ecb6761a65ed893fbddd1b86a17cd4a61b616e5fc6106ec9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T10:58:55+00:00", "last_seen": "2026-05-12T10:58:55+00:00", "object_relation": "text", "timestamp": "1784583372", "to_ids": false, "type": "text", "uuid": "60cd3aea-3485-4894-9a02-eba7e9ae5bcb", "value": "Type Description: Text\nMicrosoft: Trojan:Script/Cryxos.HAB!MTB\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-05-12T10:58:55+00:00\nLast Submission: 2026-05-12T10:58:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T10:58:55+00:00", "last_seen": "2026-05-12T10:58:55+00:00", "object_relation": "ssdeep", "timestamp": "1784583372", "to_ids": true, "type": "ssdeep", "uuid": "66caabd8-ac42-4d5b-853c-862cec3edd9c", "value": "24576:UKyHOBtyd7JxZQqkgXcNsniK/rf4vLdF/3fOW6+WyU55:UKyuLyd7JndniK/rf4vLdF/3fOW6+WyC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T10:58:55+00:00", "last_seen": "2026-05-12T10:58:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583372", "to_ids": false, "type": "size-in-bytes", "uuid": "969d5625-8872-4410-8bf8-86ed1a2e704e", "value": "949398" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T10:58:55+00:00", "last_seen": "2026-05-12T10:58:55+00:00", "object_relation": "filename", "timestamp": "1784583372", "to_ids": true, "type": "filename", "uuid": "50edd212-2514-4dbf-ba5d-2f4893d7607e", "value": "GSRYVGCSNUWTHQVX.ttf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-18T02:13:39+00:00", "last_seen": "2026-06-18T02:13:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784586018", "uuid": "7bbcad76-d128-4810-ab3d-718b817a00d3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T02:13:39+00:00", "last_seen": "2026-06-18T02:13:39+00:00", "object_relation": "md5", "timestamp": "1784586018", "to_ids": true, "type": "md5", "uuid": "078bde85-99a0-497e-946e-8f1622886762", "value": "f9aef6b675d56a1a7ae0fd7107ab6876", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T02:13:39+00:00", "last_seen": "2026-06-18T02:13:39+00:00", "object_relation": "sha1", "timestamp": "1784585048", "to_ids": true, "type": "sha1", "uuid": "360268c9-1451-4b74-ba87-20ba6f64db87", "value": "e5de7764327ddc9220c7a97828d4b36ce88063ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T02:13:39+00:00", "last_seen": "2026-06-18T02:13:39+00:00", "object_relation": "sha256", "timestamp": "1784585048", "to_ids": true, "type": "sha256", "uuid": "4380f024-30cf-4e64-9b2a-35a36b60a868", "value": "be4fcf88a287f783a3d199e889f9f088f77338eafe0dce70a38ade01192fb223", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-18T02:13:39+00:00", "last_seen": "2026-06-18T02:13:39+00:00", "object_relation": "text", "timestamp": "1784583394", "to_ids": false, "type": "text", "uuid": "870a07ab-4698-4fa0-82c4-5ceb691ac320", "value": "Type Description: Text\nMicrosoft: Trojan:Script/Cryxos.HAB!MTB\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-06-18T02:13:39+00:00\nLast Submission: 2026-06-18T02:13:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T02:13:39+00:00", "last_seen": "2026-06-18T02:13:39+00:00", "object_relation": "ssdeep", "timestamp": "1784583394", "to_ids": true, "type": "ssdeep", "uuid": "4266d67b-9d5c-4fe0-9207-9c560e1d4e69", "value": "12288:jFASbJ0AUI9P+OOTBBrHb3mfZnlev5nbYZBsp:jqSdRhlq7bmZngn0ZBsp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-18T02:13:39+00:00", "last_seen": "2026-06-18T02:13:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583394", "to_ids": false, "type": "size-in-bytes", "uuid": "8c8fa4cb-c844-4bc8-a011-f87931b5d9c7", "value": "519142" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-18T02:13:39+00:00", "last_seen": "2026-06-18T02:13:39+00:00", "object_relation": "filename", "timestamp": "1784583394", "to_ids": true, "type": "filename", "uuid": "4f19066f-a150-4cd6-8fac-264d3d0f61fb", "value": "OFSRGFHZDOHMEHLG.ttf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-04T01:28:22+00:00", "last_seen": "2026-05-04T01:28:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784586039", "uuid": "f62e21eb-d190-4508-ac67-a52b8e6f5507", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-04T01:28:22+00:00", "last_seen": "2026-05-04T01:28:22+00:00", "object_relation": "md5", "timestamp": "1784586039", "to_ids": true, "type": "md5", "uuid": "dfa29d92-23b6-4fbb-9ee2-39ec9fcaef43", "value": "339a8d92a36e445c36c042b137777557", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-04T01:28:22+00:00", "last_seen": "2026-05-04T01:28:22+00:00", "object_relation": "sha1", "timestamp": "1784585050", "to_ids": true, "type": "sha1", "uuid": "12b38ab2-1818-4faf-8f37-17d97af4d4ec", "value": "65e780d7c4f69e25a7214cb7c6ded49b467ebcbd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-04T01:28:22+00:00", "last_seen": "2026-05-04T01:28:22+00:00", "object_relation": "sha256", "timestamp": "1784585050", "to_ids": true, "type": "sha256", "uuid": "329faed3-25b1-4b5d-9332-9feea675760b", "value": "c7159e589e29f9c866cc9983839ae9c9a1457df542a2dcd5103baf38636e08fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-04T01:28:22+00:00", "last_seen": "2026-05-04T01:28:22+00:00", "object_relation": "text", "timestamp": "1784583415", "to_ids": false, "type": "text", "uuid": "cb684c4b-7b4f-49df-aac9-2f7a1b2e7e7c", "value": "Type Description: Text\nMicrosoft: Trojan:Script/Cryxos.HAB!MTB\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-05-04T01:28:22+00:00\nLast Submission: 2026-05-04T01:28:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-04T01:28:22+00:00", "last_seen": "2026-05-04T01:28:22+00:00", "object_relation": "ssdeep", "timestamp": "1784583415", "to_ids": true, "type": "ssdeep", "uuid": "eb97cab9-4e76-414b-aa67-dea0e1039b44", "value": "24576:rlPB/vB5piZO+0Y4KdlYy2ZsnByUYMMZ1mOW7ZjlA7bmrz1wgH8g:RlB5p0OQDn+fDW7ZjlA7bmrz1wgH8g" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-04T01:28:22+00:00", "last_seen": "2026-05-04T01:28:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583415", "to_ids": false, "type": "size-in-bytes", "uuid": "d7965887-ab7f-470f-9327-551a207f6d70", "value": "906208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-04T01:28:22+00:00", "last_seen": "2026-05-04T01:28:22+00:00", "object_relation": "filename", "timestamp": "1784583415", "to_ids": true, "type": "filename", "uuid": "3e510650-1108-4a44-877e-b6f7714dd054", "value": "dqhxcteegqmylphs.ttf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784586061", "uuid": "798bfc19-20e2-42ac-9e21-05679d55b338", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "md5", "timestamp": "1784586061", "to_ids": true, "type": "md5", "uuid": "f3134789-882d-437b-a107-2c94fde6af24", "value": "fc644b0d12faf54ffe5b4ad2389aea02", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "sha1", "timestamp": "1784585051", "to_ids": true, "type": "sha1", "uuid": "7437b5ae-975b-4a63-a56a-0b864fb18594", "value": "6b6a73f3461e6fe8a174bdda54dbd422db089aa4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "sha256", "timestamp": "1784585051", "to_ids": true, "type": "sha256", "uuid": "9ce5608c-80f4-41ce-8f26-79fefa9050ae", "value": "ec494785f243f5f1b516b31d8455fadafe5495e11d47a5ce2bd50b1b3791fec6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "text", "timestamp": "1784583520", "to_ids": false, "type": "text", "uuid": "4d73a658-09bb-41b9-8196-c5a4cf900bc2", "value": "Type Description: Win32 EXE\nOriginal name: 14643896-d282-46e0-a97c-9fe2bc06da74.exe\nMicrosoft: Trojan:MSIL/AgentTesla.CCHS!MTB\nClamAV: Win.Packed.Generic-10003641-0\nVT Total Detection: 58/74\nFirst Seen In The Wild: 2026-06-13T22:55:39+00:00\nFirst Submission: 2026-06-13T21:55:22+00:00\nLast Submission: 2026-06-13T23:07:05+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "creation-time", "timestamp": "1784583520", "to_ids": false, "type": "datetime", "uuid": "7a02a702-d34f-43fa-b21d-4f23386786af", "value": "2024-03-27T22:04:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "ssdeep", "timestamp": "1784583520", "to_ids": true, "type": "ssdeep", "uuid": "f2d88f5d-85ae-4d98-a43f-9bbeee5b7b39", "value": "3072:QwNwIYAwNr7M+l5W3TA9B9yFOEjPC5sKJrh5L:QUwIYAwNr7hlnyUEjPsJF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583520", "to_ids": false, "type": "size-in-bytes", "uuid": "2f3c0e13-73ed-46c5-9c92-2e3c36821722", "value": "252928" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "vhash", "timestamp": "1784583520", "to_ids": true, "type": "vhash", "uuid": "b83fb66b-e8ca-447c-a585-0fed003b2a9f", "value": "225036551512101237b4a4362b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-13T21:55:22+00:00", "last_seen": "2026-06-13T23:07:05+00:00", "object_relation": "filename", "timestamp": "1784583520", "to_ids": true, "type": "filename", "uuid": "3ffbb180-cc32-4a42-a225-e8bdc646d0f0", "value": "14643896-d282-46e0-a97c-9fe2bc06da74.exe" } ] } ] } }