{ "Event": { "analysis": "1", "date": "2026-07-03", "extends_uuid": "", "info": "[Threat Intel] Armored Likho's new weapon: BusySnake Stealer", "protected": false, "publish_timestamp": "1784321923", "published": true, "threat_level_id": "3", "timestamp": "1784321923", "uuid": "2ac9319c-4f74-4b10-beb8-a4be22567d84", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#f95f85", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Kazakhstan\"", "relationship_type": "" }, { "colour": "#15cd0b", "local": false, "name": "misp-galaxy:target-information=\"Russia\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Electric\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783335617", "to_ids": false, "type": "link", "uuid": "f33f6728-970c-4314-8014-82df853eb58e", "value": "https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783335617", "to_ids": false, "type": "text", "uuid": "3ff91e96-8441-4ffd-b271-67b8a2d5fcc5", "value": "Kaspersky uncovered a sophisticated phishing campaign by the APT group Armored Likho, deploying a previously undocumented Python-based infostealer dubbed BusySnake Stealer. The campaign targets government agencies and electric power sectors across Russia, Brazil, and Kazakhstan through spear-phishing emails containing malicious EXE or LNK attachments. BusySnake Stealer features advanced obfuscation using PyArmor Pro, extracts credentials from browsers using DPAPI and NSS libraries, captures screenshots, logs keystrokes, scrapes cryptocurrency wallets and 2FA tokens, and establishes reverse SSH tunnels for remote access. The threat actor leverages AI-generated code for first-stage payloads and distributes components via GitHub repositories. The stealer maintains persistence through scheduled tasks and communicates with C2 infrastructure to receive commands dynamically, representing a significant evolution in the group's technical capabilities." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783335617", "to_ids": false, "type": "text", "uuid": "a880bc14-de6a-4e7f-81fe-c622ef6a7a4e", "value": "Name: Armored Likho's new weapon: BusySnake Stealer\nAuthor: AlienVault\nAdversary: Armored Likho\nTags: [\"busysnake stealer\", \"pyarmor obfuscation\", \"credential theft\", \"electric power sector\", \"go2tunnel\", \"reverse ssh tunnel\", \"aquilarat\", \"spear-phishing\", \"browser password extraction\", \"government targeting\"]\nTgtd countries: [\"Brazil\", \"Kazakhstan\", \"Russian Federation\"]\nMlwr families: [\"BusySnake Stealer\", \"AquilaRAT\", \"Go2Tunnel\"]\nAttack_ids: [\"T1113\", \"T1056.001\", \"T1539\", \"T1204.002\", \"T1566.001\", \"T1140\", \"T1219\", \"T1055\", \"T1555.003\", \"T1090\", \"T1552.001\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1027\", \"T1573\", \"T1059.003\", \"T1071.001\", \"T1105\"]\nIndustries: [\"Government\", \"Energy\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784294952", "to_ids": false, "type": "threat-actor", "uuid": "11781fd0-3d8a-4cac-8fab-2a14eb42baad", "value": "Armored Likho", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306344", "to_ids": true, "type": "domain", "uuid": "df3c448f-b9e8-45f8-9f64-b2ec37849dce", "value": "lvl99.store", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306365", "to_ids": true, "type": "ip-dst", "uuid": "4366b041-9489-4fcc-8bef-5e335faf2d55", "value": "159.198.41.140", "Tag": [ { "colour": "#17fb50", "local": false, "name": "asn:asn=\"22612\"", "relationship_type": "" }, { "colour": "#e80394", "local": false, "name": "asn:as-owner=\"NAMECHEAP-NET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305078", "to_ids": true, "type": "md5", "uuid": "467c3b0e-3487-4677-95dd-d9fa4cfe59e4", "value": "006887732ca4a4a46a97989cf4deeef6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305079", "to_ids": true, "type": "md5", "uuid": "ffc0436d-3a77-42ed-adb7-fce70fedff2d", "value": "1096268fa2b3d454c86cf851cb782319", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305080", "to_ids": true, "type": "md5", "uuid": "9db28844-b69d-48d5-87c1-7c48293d1ed9", "value": "1dba3e505491a260a44c867902c3296e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305081", "to_ids": true, "type": "md5", "uuid": "0a0abf79-505d-4b95-9a9f-e0127d9f8ed9", "value": "5d5c3e483c5e544260ce98fc29fbf192", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305083", "to_ids": true, "type": "md5", "uuid": "f9be97fb-e98c-4219-8723-c2bbdff7cd9a", "value": "6b45ddb39a6e86229348dcbba3857e7c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305084", "to_ids": true, "type": "md5", "uuid": "4384f61b-97c6-40ec-ae44-8ec8698ebeeb", "value": "7141917cba2eee2b4d31107faccf3a39", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305085", "to_ids": true, "type": "md5", "uuid": "ea47d4e1-e240-4279-ac49-f20fcb8a72e5", "value": "732c31acf971a81c7e51b2a3dae82020", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305086", "to_ids": true, "type": "md5", "uuid": "e1da2c68-9cbe-4c18-b2b2-4f4a4d2a3b3a", "value": "78135f72ab148a0cc074f6b2dd51fff6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305087", "to_ids": true, "type": "md5", "uuid": "0eba84af-865b-4ecf-bbe0-b782298c903f", "value": "7db9c688c620e54e8c69b7e52a7579fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305088", "to_ids": true, "type": "md5", "uuid": "fd8a712f-27c6-4503-89d9-5c4a5fc2aa9b", "value": "80b7700053e115d65365ce7330383320", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305090", "to_ids": true, "type": "md5", "uuid": "c4dcd1a6-2331-43cf-9438-29b18a1cd912", "value": "8188b2f347b77d65d08cfb23808ac244", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305091", "to_ids": true, "type": "md5", "uuid": "1ac60b88-d66a-478f-b89c-5cfb135984cf", "value": "894332174f536c2e1efeda05cba79f8b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305091", "to_ids": true, "type": "md5", "uuid": "ca6bfaa6-304a-4004-8030-1cfeaaec7df0", "value": "90378881856abfa47d7745c0a3ef9dc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305092", "to_ids": true, "type": "md5", "uuid": "dad73b5e-2875-4046-9b06-fcd7d44a0898", "value": "a0ec7a8e61eff3f445a7455b3aef9fbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305093", "to_ids": true, "type": "md5", "uuid": "3d293683-5d1e-4ea1-a771-456bf8129006", "value": "c019797a00fd56edb1f468ac0a598510", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305095", "to_ids": true, "type": "md5", "uuid": "e251729c-5d0c-4023-8330-fa8093d4cf6b", "value": "c7622a1effa27bbfee6d6e03d6474343", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305096", "to_ids": true, "type": "md5", "uuid": "3ce88f69-5e33-4b41-9145-8027da4a9a07", "value": "cf74ac018d158ea2c2cfa1b1d71d95bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305096", "to_ids": true, "type": "md5", "uuid": "a33aacf6-f278-4f6e-90be-fb4c26df4563", "value": "ddff82a115558584bbd7741d4ffb35b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305097", "to_ids": true, "type": "md5", "uuid": "52016a52-2046-4d43-a5fe-7039613a0354", "value": "e2550cfad9dcc880bf04f6048f90868c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305098", "to_ids": true, "type": "md5", "uuid": "215e5d45-2850-47b5-b1e9-7c3e2a28e382", "value": "f2ab09d7e7a375a192508a5014aa2ee4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305099", "to_ids": true, "type": "md5", "uuid": "c12feda9-c56b-487f-9888-b80a2cc5d98f", "value": "fd2bdd8047addee6fde2f532de181bfd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306386", "to_ids": true, "type": "ip-dst", "uuid": "90eaa56f-e3b1-4237-b143-fd4064b01722", "value": "159.198.32.222", "Tag": [ { "colour": "#17fb50", "local": false, "name": "asn:asn=\"22612\"", "relationship_type": "" }, { "colour": "#e80394", "local": false, "name": "asn:as-owner=\"NAMECHEAP-NET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306407", "to_ids": true, "type": "ip-dst", "uuid": "2f75dfc0-88a0-4cfe-ae53-01603e74d5c7", "value": "159.198.75.219", "Tag": [ { "colour": "#17fb50", "local": false, "name": "asn:asn=\"22612\"", "relationship_type": "" }, { "colour": "#e80394", "local": false, "name": "asn:as-owner=\"NAMECHEAP-NET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306429", "to_ids": true, "type": "ip-dst", "uuid": "d3806852-ef24-4224-9953-035c43476355", "value": "69.67.173.153", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306451", "to_ids": true, "type": "domain", "uuid": "a8506ac4-16ce-4156-9b65-d33d3687ef2c", "value": "arvax.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306472", "to_ids": true, "type": "domain", "uuid": "788fd6f5-bc11-4e17-bde0-f24fa1770db6", "value": "grked.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306493", "to_ids": true, "type": "domain", "uuid": "cec8381a-e517-4f13-9048-5507f1a1cd73", "value": "ndrt.ink", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306514", "to_ids": true, "type": "domain", "uuid": "cbe93b22-4052-4ef3-bc7d-47b443575434", "value": "onetoken.ink", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306535", "to_ids": true, "type": "domain", "uuid": "cad39426-8eed-46c2-a624-f9e1e79ad4ae", "value": "varenie.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306556", "to_ids": true, "type": "domain", "uuid": "b999b9f6-1094-4506-95ae-b13fc8bcbca8", "value": "winupdate.ink", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306578", "to_ids": true, "type": "domain", "uuid": "3e2314d3-838b-4211-810e-021bbc166c29", "value": "winupdate.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306599", "to_ids": true, "type": "hostname", "uuid": "f14991ae-4fba-455b-91a4-938565f7d027", "value": "myboard.chickenkiller.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306620", "to_ids": true, "type": "hostname", "uuid": "fe028d09-8b8d-48a3-9daf-ffdc8da3771b", "value": "myboard.twilightparadox.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306641", "uuid": "905c6926-654e-4f3a-b509-71997e8dda7c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "object_relation": "md5", "timestamp": "1784306641", "to_ids": true, "type": "md5", "uuid": "abb4e11b-e91b-4a51-9722-00bdb25035f1", "value": "393b498f2114cabc0b29d5fcd9dc6723", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "object_relation": "sha1", "timestamp": "1784305071", "to_ids": true, "type": "sha1", "uuid": "903ac826-e27a-4247-a95f-2785f0cade8c", "value": "a0b80c0ec77f62b0ed46edb3fef05ccb88c74afb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "object_relation": "sha256", "timestamp": "1784305071", "to_ids": true, "type": "sha256", "uuid": "d24cdb4f-768f-4cd2-8ad9-123517c1c600", "value": "8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "object_relation": "text", "timestamp": "1784303658", "to_ids": false, "type": "text", "uuid": "c1041cbc-1e53-477e-a3e7-3f04591e6a26", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 31/74\nFirst Seen In The Wild: 2026-04-19T07:35:28+00:00\nFirst Submission: 2026-04-19T04:56:43+00:00\nLast Submission: 2026-04-19T07:35:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "object_relation": "ssdeep", "timestamp": "1784303658", "to_ids": true, "type": "ssdeep", "uuid": "faafa340-0b71-4732-b806-074f7d35c2b9", "value": "768:HKCh+dwdRRhjDQlVYfHf9HvJYpNItPZVs+bmfBg7fdnGw6IWLfQ+6bo4F7D:qCkoxDCaf/phYkrafs1CVlbED" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303658", "to_ids": false, "type": "size-in-bytes", "uuid": "a4abe9c6-1a4f-4245-ad0d-a6b0cfc6f6b0", "value": "44394" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "object_relation": "vhash", "timestamp": "1784303658", "to_ids": true, "type": "vhash", "uuid": "9c182695-2f9c-4d56-9f70-8ee05210d334", "value": "d5ffb6535c3d81225a4be14637b4b1e2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-19T04:56:43+00:00", "last_seen": "2026-04-19T07:35:26+00:00", "object_relation": "filename", "timestamp": "1784303658", "to_ids": true, "type": "filename", "uuid": "4941ad73-3e2a-40ad-8e32-b22b8ee1327d", "value": "3rd3lby3q.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306662", "uuid": "7237502a-4473-4565-8c28-39807fc0a13f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "md5", "timestamp": "1784306662", "to_ids": true, "type": "md5", "uuid": "4c5b1594-d812-4a03-8e91-e8e002fee66a", "value": "0041fd1b2358cd08dbcbc28ea8fc3d20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "sha1", "timestamp": "1784305073", "to_ids": true, "type": "sha1", "uuid": "5869b7d7-2188-49e0-898d-b60fdb2c424c", "value": "8436fba39929e8da81fc78b2bc7eb74da6b9578a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "sha256", "timestamp": "1784305073", "to_ids": true, "type": "sha256", "uuid": "d1b31982-c3a3-42b4-ad3c-296f6fad1f63", "value": "3ec02d6bed160a97edea549ec88c46f10105f6cdf6a4b3f356b2fc6a4a14f386", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "text", "timestamp": "1784303679", "to_ids": false, "type": "text", "uuid": "23320f3c-91c2-43d6-9b56-947f8633aea5", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2026-04-29T08:12:56+00:00\nLast Submission: 2026-04-29T08:12:56+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "creation-time", "timestamp": "1784303679", "to_ids": false, "type": "datetime", "uuid": "969f7d4f-0da5-40f9-9c46-7f140f9c33f4", "value": "2025-03-08T23:05:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "ssdeep", "timestamp": "1784303679", "to_ids": true, "type": "ssdeep", "uuid": "baa0b994-2007-4612-baa0-4cc0f3efbd83", "value": "12288:GTAwfX2BCPk/rYbvL4Rc0hqVoGp0e/g13VirEulaDx:GTAwfBM/dRcvPp0awVirwN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303679", "to_ids": false, "type": "size-in-bytes", "uuid": "11762d9d-bf16-4551-874c-ef261f18f991", "value": "650148" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "vhash", "timestamp": "1784303679", "to_ids": true, "type": "vhash", "uuid": "fefda876-647e-44f5-b88b-ef69ed537321", "value": "065056655d1c0510c043z800417z57z52z4gz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T08:12:56+00:00", "last_seen": "2026-04-29T08:12:56+00:00", "object_relation": "filename", "timestamp": "1784303679", "to_ids": true, "type": "filename", "uuid": "e02f18b8-941e-4d5c-acc9-27d784960378", "value": "22yiq.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306683", "uuid": "9b9f5950-e61c-4061-986c-1bb886abba61", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "md5", "timestamp": "1784306683", "to_ids": true, "type": "md5", "uuid": "9f7bd655-9d0e-4ccf-86e6-ad8a8f9e7726", "value": "07213c419489c02791e8d67b91e404ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "sha1", "timestamp": "1784305074", "to_ids": true, "type": "sha1", "uuid": "56e8a969-728e-495c-a40f-208a7d0abfd6", "value": "09318273b7dd478ee8902a9a00533ebbeccfa6ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "sha256", "timestamp": "1784305074", "to_ids": true, "type": "sha256", "uuid": "7ef3f279-15c6-43c4-99fa-9e77f799ce5b", "value": "5eb161bb76225defc198d27fc490742f61b62e6296c84c14019f38c3fecd4049", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "text", "timestamp": "1784303722", "to_ids": false, "type": "text", "uuid": "f03ad7e7-54a3-46ba-a7dc-3a4fce73eaf1", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 24/74\nFirst Seen In The Wild: 2026-05-16T02:18:01+00:00\nFirst Submission: 2026-05-15T18:42:22+00:00\nLast Submission: 2026-05-15T18:42:22+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "creation-time", "timestamp": "1784303722", "to_ids": false, "type": "datetime", "uuid": "df45b5a1-dfd3-49fe-a13f-d88ba3fc852b", "value": "2026-05-14T11:43:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "ssdeep", "timestamp": "1784303722", "to_ids": true, "type": "ssdeep", "uuid": "dea1f826-d79d-4fb3-92b6-0f81868846aa", "value": "3072:/Q+QZujqaGpcPVtO7U8t0WRcQB9bLdkXKzsrEN2I4gVpFCpjwIzEXgd:/qGVtu9TnLqOcBppGXgd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303722", "to_ids": false, "type": "size-in-bytes", "uuid": "0fdad504-1ec2-4c79-9f63-f79ec2ccaab8", "value": "163328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "vhash", "timestamp": "1784303722", "to_ids": true, "type": "vhash", "uuid": "75a1da0c-4e5e-4d9d-b9d4-81a02ed392c9", "value": "115066655d1d05556az5alz1gzd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-15T18:42:22+00:00", "last_seen": "2026-05-15T18:42:22+00:00", "object_relation": "filename", "timestamp": "1784303722", "to_ids": true, "type": "filename", "uuid": "c6fefbb8-0acf-4d01-84bc-cbbdcea1eeda", "value": "diary.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306704", "uuid": "b9127aee-01ca-4ce6-9a46-18ea84fb5790", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "object_relation": "md5", "timestamp": "1784306704", "to_ids": true, "type": "md5", "uuid": "85c94956-e8a4-43b0-92c8-4d62a3942652", "value": "2dfa1d949872c1b2f04952dd3e5f5d8f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "object_relation": "sha1", "timestamp": "1784305075", "to_ids": true, "type": "sha1", "uuid": "47ca618b-72c1-48cd-926d-25cda05dec66", "value": "2654dfefff26ad290037230bf2dc7353411d0cc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "object_relation": "sha256", "timestamp": "1784305075", "to_ids": true, "type": "sha256", "uuid": "0057cf16-a418-4319-b248-bfebf5d2abe3", "value": "00ccbf72b8a0f0314d829766775889bbe9c964ce7b499ff26ba12fb62cadf906", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "object_relation": "text", "timestamp": "1784303785", "to_ids": false, "type": "text", "uuid": "76ff332d-9857-426e-afc3-6fa32ec6e0c4", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 31/74\nFirst Seen In The Wild: 2026-04-24T06:55:30+00:00\nFirst Submission: 2026-04-23T18:13:26+00:00\nLast Submission: 2026-04-23T18:13:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "object_relation": "ssdeep", "timestamp": "1784303785", "to_ids": true, "type": "ssdeep", "uuid": "4f47bad8-e0f4-4ab4-9f63-faa49007df27", "value": "768:ykoDIAHLf95/3MwL6wVlzV02xFMeqElWCsDMICz:ykWrf95/3MwLHV42xCZE49DlCz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303785", "to_ids": false, "type": "size-in-bytes", "uuid": "c3248a02-ba5c-4aa3-8dd6-4a8b7dc6cbc7", "value": "40718" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "object_relation": "vhash", "timestamp": "1784303785", "to_ids": true, "type": "vhash", "uuid": "21a95b0b-823a-47fd-b624-f92ccde46845", "value": "6a35ded7ec16c985c3c605eb3853e00f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-23T18:13:26+00:00", "last_seen": "2026-04-23T18:13:26+00:00", "object_relation": "filename", "timestamp": "1784303785", "to_ids": true, "type": "filename", "uuid": "aa7b6ee0-7ee3-4108-ba1b-941a4eb41348", "value": "Dementyeva_Anna_Vasilyevna_zayavka_gumanitarnayapomosch.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306725", "uuid": "0b63ee36-1cfa-4e64-8953-d0405cfbd011", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "md5", "timestamp": "1784306725", "to_ids": true, "type": "md5", "uuid": "ce8f7793-a02a-4a6b-924c-6d570f614260", "value": "f5c6434ee5f7578faa3bc1257e1c9226", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "sha1", "timestamp": "1784305077", "to_ids": true, "type": "sha1", "uuid": "3e4f148b-e524-4674-a881-15bf4f943137", "value": "1c80dd68eedf0b0337696e9a74fe30a9ee4c6d48", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "sha256", "timestamp": "1784305077", "to_ids": true, "type": "sha256", "uuid": "98f9de4d-8f44-4dd8-8509-98d67bca17e5", "value": "af09e6bb864e64aa6bc2d736deb5713a97c984da2d2f6054d3229315e5ee2eda", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "text", "timestamp": "1784304165", "to_ids": false, "type": "text", "uuid": "0e347d77-5593-4904-b709-a80f35536185", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 33/74\nFirst Submission: 2026-03-31T14:54:53+00:00\nLast Submission: 2026-03-31T14:54:53+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "creation-time", "timestamp": "1784304165", "to_ids": false, "type": "datetime", "uuid": "fa4e697e-10e2-487e-806a-bd946500c5da", "value": "2025-03-08T23:05:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "ssdeep", "timestamp": "1784304165", "to_ids": true, "type": "ssdeep", "uuid": "de70d72d-3145-46db-8f9f-709f14d57840", "value": "3072:GX47fcIrwR8ksukZfGpl0cgZNG1OiegdeJ6NgL08yBROWKAPJ/VMM3/M9PFEWUQY:GX45rw6NVGpl0cgKOiegdeJSe08yBYWH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304165", "to_ids": false, "type": "size-in-bytes", "uuid": "beda2130-eb33-45e8-b570-902cd4a44762", "value": "186043" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "vhash", "timestamp": "1784304165", "to_ids": true, "type": "vhash", "uuid": "cde0637b-e054-41dd-bdc9-25fc3e55d0a4", "value": "015056655d1c0550c043z800417z57z52z4gz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-31T14:54:53+00:00", "last_seen": "2026-03-31T14:54:53+00:00", "object_relation": "filename", "timestamp": "1784304165", "to_ids": true, "type": "filename", "uuid": "2f538b69-0d3e-49d3-be7b-6ea1cbe1e4a8", "value": "smx4qaxxa.exe" } ] } ] } }