{ "Event": { "analysis": "1", "date": "2026-05-29", "extends_uuid": "", "info": "[Threat Intel] Operation Dragon Weave: Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan Using Azure Cloud C2", "protected": false, "publish_timestamp": "1780377506", "published": true, "threat_level_id": "2", "timestamp": "1780377506", "uuid": "2a39eb24-b765-4968-9c52-198844a7f7f9", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#57356b", "local": false, "name": "misp-galaxy:producer=\"Seqrite\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#98f3da", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#8d021b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"", "relationship_type": "" }, { "colour": "#74d147", "local": false, "name": "misp-galaxy:target-information=\"Czech Republic\"", "relationship_type": "" }, { "colour": "#2613b0", "local": false, "name": "misp-galaxy:target-information=\"Taiwan\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"vulnerability\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#1b0068", "local": false, "name": "rectifyq:topic=\"cloud\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780311606", "to_ids": false, "type": "link", "uuid": "67b35664-d837-4d25-8d6c-593f15ad026b", "value": "https://www.seqrite.com/blog/operation-dragon-weave-uncovering-a-china-linked-campaign-targeting-czech-republic-and-taiwan-using-azure-cloud-c2/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780311606", "to_ids": false, "type": "text", "uuid": "1eaaee62-1542-459a-88bb-5261128532af", "value": "A sophisticated cyber-espionage campaign attributed to China-linked actors targets officials and citizens in Czech Republic and Taiwan through spearphishing attacks. The operation deploys malicious ZIP archives containing dual infection paths that ultimately deliver AZUREVEIL, an Adaptix C2 agent. The campaign uniquely leverages Microsoft Azure Blob Storage as a dead-drop command-and-control channel, bypassing traditional C2 infrastructure. A multi-stage infection chain employs RUSTCLOAK, a Rust-based loader implementing triple-layer encryption using modified RC4, Base64, and SM4-CBC algorithms. The final payload supports 36 post-exploitation commands including Beacon Object File execution in memory, file system manipulation, process control, network pivoting, and data exfiltration. Lure documents impersonate official communications from Taiwanese research institutions and Czech Social Security Administration, demonstrating targeted social engineering tailored to each region." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780311606", "to_ids": false, "type": "text", "uuid": "c4043263-030a-4cbd-87a0-5fbb568d7bdd", "value": "Name: Operation Dragon Weave: Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan Using Azure Cloud C2\nAuthor: AlienVault\nAdversary: \nTags: [\"china-linked\", \"taiwan\", \"dll sideloading\", \"spearphishing\", \"azureveil\", \"adaptix agent\", \"rustcloak\", \"adaptix\", \"czech republic\", \"bof execution\", \"azure cloud c2\"]\nTgtd countries: [\"Czechia\", \"Taiwan\"]\nMlwr families: [\"RUSTCLOAK\", \"AZUREVEIL\", \"Adaptix\"]\nAttack_ids: [\"T1204.002\", \"T1497.001\", \"T1566.001\", \"T1082\", \"T1055\", \"T1016\", \"T1090\", \"T1083\", \"T1057\", \"T1041\", \"T1059.001\", \"T1027\", \"T1573\", \"T1059.005\", \"T1574.002\", \"T1105\", \"T1102.001\"]\nIndustries: [\"Government\", \"Education\", \"Technology\", \"Finance\"]" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:02/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780370805", "to_ids": true, "type": "sha256", "uuid": "287db133-e841-409e-bfef-79740027e8e7", "value": "047687548605734348792e2a9d771b6cba42facd0d0d7d44d778290a25848574", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:02/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780370806", "to_ids": true, "type": "sha256", "uuid": "25f17058-2e9b-4701-baea-0ad33d3ec04f", "value": "783661d0f7edb338d2d50be087764d82dbbc9ee7989ddc57db1801e4ec9045b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Azure Blob Storage C2", "deleted": false, "disable_correlation": false, "timestamp": "1780375025", "to_ids": true, "type": "hostname", "uuid": "804b1173-04df-49ef-a983-3f55f24ae86a", "value": "note1ggbbhggdwa1.blob.core.windows.net", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375046", "uuid": "d29723f0-fa96-4da0-a2f7-2e9ab3491ca7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375046", "to_ids": true, "type": "md5", "uuid": "71d1eb6d-a884-41fb-aab4-cc1c14d2d9ed", "value": "4479c73e0c28a00debd8fae5963d5af0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370795", "to_ids": true, "type": "sha1", "uuid": "59ae0c67-c4d6-40b1-81a6-764086b54d76", "value": "6f569139805e4ca507dc6fc2f1cb880beb3d7ac7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370795", "to_ids": true, "type": "sha256", "uuid": "a362a84e-4f4d-4ef1-abf5-aa0e96c1ccbc", "value": "5ed14c2b7f7433a1a72dd6b668413f935a217ba10b69d89b774a82990fa12fe1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370243", "to_ids": true, "type": "ssdeep", "uuid": "25f2616e-0352-486d-a4c7-98a28859a5d2", "value": "6144:AlOv+qZT1Y4j5h4T7q/oIG/Ii/fcZoFHPVF:AlT0Te4juq/bisZo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370243", "to_ids": false, "type": "size-in-bytes", "uuid": "6eb619d7-39bf-41a4-9cb1-c81d595ea3af", "value": "269312" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370243", "to_ids": true, "type": "vhash", "uuid": "43c923a8-aa67-4a3e-9b18-95291576df71", "value": "125066655d155d055az5b3z3yz2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370243", "to_ids": true, "type": "filename", "uuid": "f3486131-bb04-483e-9099-0a4866c170bd", "value": "a4g0mn29c.exe" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370243", "to_ids": false, "type": "text", "uuid": "5d5e27da-91f7-4ec8-9d61-a7ccfc4e5268", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:41/71\nFirst Submission:2026-03-26T16:24:56.000000+00:00\nLast Submission:2026-03-26T16:24:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375067", "uuid": "87d0e34a-fe75-4144-af42-6f6a98f8821f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375067", "to_ids": true, "type": "md5", "uuid": "bf337b92-4ca0-4d4f-a00f-3010aad232cc", "value": "9378a8075f26ab0f2a3add6d97eb0533", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370796", "to_ids": true, "type": "sha1", "uuid": "7b5c7a05-d14e-401c-ab91-25d35574bcd2", "value": "04f7126031fe11475e0b24ce5298ecd6e56ec363", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370796", "to_ids": true, "type": "sha256", "uuid": "8e4da619-fbb1-49ca-b13b-92ffc83d714b", "value": "61f7d9cd2d8ce7df950639b23ce90085b300b0c6dd0d8d934bba8fdecb670f15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370264", "to_ids": true, "type": "ssdeep", "uuid": "62fa5aff-e7aa-4b5f-8fd4-d8097a04d21f", "value": "12288:X4eC+qonGqx4jppanq0rWw3g2U3c9TDeMd6PU5OE1CQty8toR44eN:oCUWNqqd685OE1CQty9R47N" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370264", "to_ids": false, "type": "size-in-bytes", "uuid": "b4931525-f351-41e6-9478-9c4005c8012f", "value": "665496" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370264", "to_ids": true, "type": "vhash", "uuid": "05ddca21-6bbf-41da-869e-088fb97313df", "value": "065076655d151515755az41?z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370264", "to_ids": true, "type": "filename", "uuid": "a6ff777b-22c5-4be2-a636-b6805ace241c", "value": "wufwon.exe" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370264", "to_ids": false, "type": "text", "uuid": "4fbf47e1-90d0-4080-9c72-9e0ec4bc9713", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:0/71\nFirst Submission:2026-01-09T13:55:31.000000+00:00\nLast Submission:2026-04-28T15:29:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375089", "uuid": "aeb523d6-f9e6-47d1-9551-45f6ff20552b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375089", "to_ids": true, "type": "md5", "uuid": "140ebb51-e24c-4de5-85ad-8f7e25f5b52a", "value": "9704a1b4a305de9aa49b71b4e1a42166", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370797", "to_ids": true, "type": "sha1", "uuid": "1e3e5596-b124-4728-ad04-0675bc1bc7bd", "value": "91da32b86ba15952bde22f330158125359043f59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370797", "to_ids": true, "type": "sha256", "uuid": "3b67078d-e36e-4004-bd80-2694859d551a", "value": "02542a49b3bd6bd2795afb67840acb4557b17e017f7503dd03ebe3aeeb28720e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370286", "to_ids": true, "type": "ssdeep", "uuid": "e79fccbc-9f66-48da-9f9f-14b1e8683257", "value": "1536:EJ/yMWpI+rvUKL5Z1SIZjMU9n3pRRQOHu2:g/yJRrvb1SIZQU95RRtO2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370286", "to_ids": false, "type": "size-in-bytes", "uuid": "ecffa582-1de3-4ddb-ad9c-7e8390ba4ca6", "value": "66468" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370286", "to_ids": true, "type": "vhash", "uuid": "b004034f-6ae2-472d-937e-217b202e0939", "value": "99a3fc518ff1d5cbcb9f0cb0ca0e0a243" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370286", "to_ids": true, "type": "filename", "uuid": "1a46cd9a-6911-4324-b298-38ea87ce9b55", "value": "001a0f6304daee6f9df4d6e0dd9c1a81rezervaci.pdf" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370286", "to_ids": false, "type": "text", "uuid": "2c14e563-668b-4b35-84e3-dc515b3e32e0", "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-03-26T04:42:24.000000+00:00\nLast Submission:2026-03-26T04:42:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375110", "uuid": "82942261-d61d-41a5-8ad9-5edbd6766159", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375110", "to_ids": true, "type": "md5", "uuid": "050c3291-e166-4ed4-aad7-14b5a9623811", "value": "8364f7774245bee15fc58465fa30c47c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370798", "to_ids": true, "type": "sha1", "uuid": "65ecfed8-b77e-4b61-a2b8-ea19576b246f", "value": "c741b31d246c1b68f7e536501b94b671cea1de5c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370798", "to_ids": true, "type": "sha256", "uuid": "771b8eb7-b60f-41bf-8a2b-5dcc47f5fa8a", "value": "080ab9bc2893ba7bad354551604a667af40ed2ae2d042d2323c2bd9ad3122192", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370329", "to_ids": true, "type": "ssdeep", "uuid": "d765e28e-fd00-4eee-994a-7a6578ef31e1", "value": "6144:xOE/TgberpZ3NT3Ze1vLIs//ZbaGoFup06bh:xLTCerpLZlspbaGo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370329", "to_ids": false, "type": "size-in-bytes", "uuid": "dae00696-6fe3-479a-a3d6-14bed99da79f", "value": "268800" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370329", "to_ids": true, "type": "vhash", "uuid": "975c7ae4-ad4a-46cf-a1fc-c60b49b65fe7", "value": "125066655d155d055az5b3z3yz2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370329", "to_ids": true, "type": "filename", "uuid": "29863616-a08a-46fd-a752-b8172d2abfcb", "value": "UnityPlayer.dll" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370329", "to_ids": false, "type": "text", "uuid": "780866ff-26c5-4892-b2ad-f391d0a7fc94", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:41/71\nFirst Submission:2026-03-25T07:40:32.000000+00:00\nLast Submission:2026-03-25T07:46:17.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375131", "uuid": "70d72b8d-5f1c-481c-93e8-3afb89ac8360", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375131", "to_ids": true, "type": "md5", "uuid": "e247781a-eb8f-4d82-8a2d-17912c1e4c74", "value": "b57c1fc9cc28d92873297c76a486aa2d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370799", "to_ids": true, "type": "sha1", "uuid": "d98b818e-5164-459f-8f9f-f110a9ab7a25", "value": "ca2325ae883afaf187ae750b057d5ca84c64a651", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370799", "to_ids": true, "type": "sha256", "uuid": "9f7f018b-d7f2-4fd2-acd4-f14f5d1cdf82", "value": "096372d19b4787e989f44e04c5ecc29885aa927c34ae8666628d6c0eb20bb447", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370351", "to_ids": true, "type": "ssdeep", "uuid": "a485c5df-5583-4f4c-89a9-f85423701a58", "value": "24:8sHGeJoJ3CRJ5r5xgAy6IRj+/xdQnqdd+cP6eXuHY8DFtEablTmw:82GeGJ3+5r30CdQqdbPXuHnFtEa1V" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370351", "to_ids": false, "type": "size-in-bytes", "uuid": "295402d2-a796-4a4f-980e-a56b1ec65498", "value": "2651" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370351", "to_ids": true, "type": "vhash", "uuid": "40ad4f67-f9cc-4548-a502-4f1423d75491", "value": "f23c10f39998a69f34576d01bf030761" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370351", "to_ids": true, "type": "filename", "uuid": "59373ccf-48f0-4414-8650-3b7e1f3887d4", "value": "\u8a08\u756b\u7533\u8acb\u5be9\u67e5\u7d50\u679c\u901a\u77e5\u55ae.pdf.lnk" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370351", "to_ids": false, "type": "text", "uuid": "a09c48e0-aa95-4951-9c64-4da5d5543f4c", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: None\nVT Total Detection:10/62\nFirst Submission:2026-03-25T07:40:32.000000+00:00\nLast Submission:2026-03-25T07:40:32.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375152", "uuid": "3315c503-cfad-438d-8aa2-968c314f15e8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375152", "to_ids": true, "type": "md5", "uuid": "5a36f4ca-01d3-480b-aad9-19a3c13ad170", "value": "283d44117811085feb9496551de48562", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370800", "to_ids": true, "type": "sha1", "uuid": "dabe5873-fbd0-4189-bb76-09c67dfe49c2", "value": "66618c94f907cee2657ae4ea1523a8cb63d55c83", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370800", "to_ids": true, "type": "sha256", "uuid": "99215c3a-792e-4de2-bf3e-6a7d26ef6e36", "value": "1c56228cbd1bdebb9e5ea55c2749150fee06c865ede4a3754e8bd6843e51d2d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370373", "to_ids": true, "type": "ssdeep", "uuid": "eac01185-5b49-48c0-b6d2-772293f59e40", "value": "24576:Ao6FB2lONG1uqlZSCUWNqqd685OE1CQty9R47B:AoBJ6CDq1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370373", "to_ids": false, "type": "size-in-bytes", "uuid": "adfc4bd7-f177-4fb6-ac90-50e4712959c5", "value": "1509376" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370373", "to_ids": true, "type": "vhash", "uuid": "d14357a0-226e-417e-9edf-0bf915b99b56", "value": "016076657d155d05155az683z4@z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370373", "to_ids": true, "type": "filename", "uuid": "9ef68b01-0f1c-4aea-a23b-d0fe6f3757ed", "value": "_\u8a08\u756b\u7533\u8acb\u5be9\u67e5\u7d50\u679c\u901a\u77e5\u55ae.exe" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370373", "to_ids": false, "type": "text", "uuid": "f703eec0-02fb-4843-8e4e-9feb498bddd6", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:39/71\nFirst Submission:2026-03-26T04:34:06.000000+00:00\nLast Submission:2026-03-26T04:34:06.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375173", "uuid": "4b9540ff-d6fd-4575-9184-3cd5d766a0ae", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375173", "to_ids": true, "type": "md5", "uuid": "e8ea6c42-88d2-4eed-a526-c70574fe7a1c", "value": "8d796050863098578c712bc1e6f0689c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370801", "to_ids": true, "type": "sha1", "uuid": "6e83a43d-5efc-4bf5-bcec-e71d0f3fb313", "value": "29af6ac8452ba17f4b7c8b5588e99c7636a12157", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370801", "to_ids": true, "type": "sha256", "uuid": "dc71d634-7bf8-429c-b38f-8cbe4cf0d827", "value": "24aa4e780ccd66cef13da9ef98c32954105cf2a32ec643efab0ba1aa2d6352f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370395", "to_ids": true, "type": "ssdeep", "uuid": "2707efb9-38ef-4af1-a769-c4938dac8c38", "value": "3072:1bjrxJ9eWXEXHlEX4SbdCuV4f825B05UQ27LWrj1ssErY7gZZOE87Vnmi4:lrxJ9ZXEXFtUCB825B0KQ2g1crY7giEP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370395", "to_ids": false, "type": "size-in-bytes", "uuid": "22865a52-76ad-4452-b298-4b5be0f7d3c4", "value": "137920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370395", "to_ids": true, "type": "filename", "uuid": "0c024728-ebb8-4048-a70b-784672f9452b", "value": "Com.dat" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370395", "to_ids": false, "type": "text", "uuid": "bb3ecaf0-9adf-4605-8583-2417ea6afc7c", "value": "Type Description: unknown\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2026-04-22T11:44:30.000000+00:00\nLast Submission:2026-04-22T11:44:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375194", "uuid": "97338eed-04f8-4ed4-b38a-0f4c70fecf23", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375194", "to_ids": true, "type": "md5", "uuid": "0326ddf6-3926-4464-834b-bc0975dd056c", "value": "e8df391aae27fcddaa056352753a6878", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370802", "to_ids": true, "type": "sha1", "uuid": "010f0bff-b7d3-4baa-b921-06c245ba7f42", "value": "c50132a5b3bd653637160824db1b78bda301ada4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370802", "to_ids": true, "type": "sha256", "uuid": "5f69593e-5f18-43be-831c-dae57d40ddd6", "value": "823d5969db3f3b72ebbdce1b78752717ea849884a0fb40d86146416c38e128de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370438", "to_ids": true, "type": "ssdeep", "uuid": "f0eddecb-1ded-4d5c-ba78-0f2dabebbc29", "value": "24:R6FrH2TI3T1I8qhHaz9LwBunn2+Bt8oWXjHTgnIgrYNcnTkEkpsH2C65v:w1WTI3ThqkeghkrTgnIgcNcnTkJpsHjs" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370438", "to_ids": false, "type": "size-in-bytes", "uuid": "77ecc71f-6f3e-465c-bd25-db8df8735e5a", "value": "1502" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370438", "to_ids": true, "type": "vhash", "uuid": "f43a4318-edfc-460a-92de-01e6738632e0", "value": "ce51716be6ba646f94da462dfab53c44" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370438", "to_ids": true, "type": "filename", "uuid": "288ac078-18c9-45f0-b5f7-5eeeaa2b1b8f", "value": "Profile.ps1" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370438", "to_ids": false, "type": "text", "uuid": "22587402-0567-4465-9582-eb115be533c5", "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:4/62\nFirst Submission:2026-03-25T07:46:16.000000+00:00\nLast Submission:2026-03-25T07:46:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375215", "uuid": "9ffda98d-5146-484d-a438-491e7fdc7906", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375215", "to_ids": true, "type": "md5", "uuid": "f6ec51e8-9dd1-4201-a286-00f91552617c", "value": "a5ce0cb0c07b1566663253fa7c8c3042", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370803", "to_ids": true, "type": "sha1", "uuid": "b83ec889-56d3-46c0-80c2-9308478de63e", "value": "66f642b33f8ec8c0dcce816514bd7bfac2d287a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370803", "to_ids": true, "type": "sha256", "uuid": "e9a7dc1c-12de-4bb5-8d8f-fcaa5c30ce7d", "value": "8ae7c82a3e4f742777e590b25a1c563d19bd9bcba2a387d004aae72c4b2828f9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370460", "to_ids": true, "type": "ssdeep", "uuid": "1bf15d9b-6129-4d1e-aca7-a29a21685532", "value": "6144:0EW1KuEGkjvyFkV1Xi8Bsy+NbRhAVZII+jDvVSyek1PiyMjUr:c1vC2+bTBsLdtjNS3k1iyMk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370460", "to_ids": false, "type": "size-in-bytes", "uuid": "7a3a3c11-41c9-40f4-b017-abdfa34ad2b3", "value": "341620" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370460", "to_ids": true, "type": "vhash", "uuid": "f89fc6e9-e878-4448-93ff-5cee48bfb68b", "value": "9adf5ed09e489028a9966e5074bbb0020" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370460", "to_ids": true, "type": "filename", "uuid": "87e4695d-4bd3-465b-b62e-15f82de56971", "value": "WPS PDF\u4ecb\u7ecd\u6587\u6863.pdf" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370460", "to_ids": false, "type": "text", "uuid": "90667f72-32ae-4098-a8cc-81dc7177278a", "value": "Type Description: PDF\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-03-28T03:39:50.000000+00:00\nLast Submission:2026-03-28T03:39:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780375236", "uuid": "6adebbda-61e2-4bc8-9b55-51d039f47a50", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780375236", "to_ids": true, "type": "md5", "uuid": "9b54e107-4cc6-4ff4-b70b-dd92a945e557", "value": "f55cd7df2e9cfcc9b5063308b0a5c1d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370804", "to_ids": true, "type": "sha1", "uuid": "6d875517-544a-4ce0-903d-eaa321db07ee", "value": "dc143fea64e457b1f7dbfa468423b0730d67b5ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370805", "to_ids": true, "type": "sha256", "uuid": "57777d97-8b28-46b6-acc1-3b6782429d6e", "value": "a4e9f9919d62589b57cfa08c9ccb89e386b09f683271373413cd8e8c8c7d1c5a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780370483", "to_ids": true, "type": "ssdeep", "uuid": "b1ffe637-f6b4-4222-adab-6ead7eb263cc", "value": "3:jblYFFEm8nhCXhm8x7D/ect24p27Rd6WrBgSSJJFIAV/jdeBNZ6XFD95lAFVXM:ju3Nqhr+7yQ7ARkW1s8AV/jvX59MFu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780370483", "to_ids": false, "type": "size-in-bytes", "uuid": "c294cff1-8a1c-484d-a971-c81604926216", "value": "221" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780370483", "to_ids": true, "type": "vhash", "uuid": "b27b8d9d-37fc-4f03-935d-a1c1dc0b0a39", "value": "3f459b8d34ea80746e373ee7fed77985" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780370483", "to_ids": true, "type": "filename", "uuid": "9a964e28-6a51-43f8-b95a-fef8b7d89d56", "value": "empty.vbs" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780370483", "to_ids": false, "type": "text", "uuid": "ab458cd8-9333-4419-b07c-ee2abe5d576a", "value": "Type Description: VBA\nMicrosoft: None\nVT Total Detection:2/61\nFirst Submission:2026-03-25T07:46:15.000000+00:00\nLast Submission:2026-03-25T07:46:15.000000+00:00" } ] } ] } }