{ "Event": { "analysis": "1", "date": "2026-06-26", "extends_uuid": "", "info": "[Threat Intel] STOCKSTAY Another Day: The Latest Addition to Turla\u2019s Intelligence Gathering Apparatus", "protected": false, "publish_timestamp": "1782531910", "published": true, "threat_level_id": "2", "timestamp": "1782531910", "uuid": "2b690960-2893-4ea4-9fcb-52c7605467b3", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#6e57da", "local": false, "name": "misp-galaxy:producer=\"Mandiant\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive via Utility - T1560.001\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#4cea11", "local": false, "name": "misp-galaxy:target-information=\"Italy\"", "relationship_type": "" }, { "colour": "#e4d611", "local": false, "name": "misp-galaxy:target-information=\"Ukraine\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Turla\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#3500ca", "local": false, "name": "rectifyq:detection-rules=\"yara-from-src\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782471614", "to_ids": false, "type": "link", "uuid": "dc937422-1005-4d3a-b932-ad67d41b28f0", "value": "https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782471614", "to_ids": false, "type": "text", "uuid": "1d53e11e-0ae7-46ca-ad31-ed2310a1062f", "value": "Google Threat Intelligence Group has identified STOCKSTAY, a .NET backdoor continuously developed and deployed by Russia-linked Turla (FSB Center 16) since December 2022. The multi-component malware communicates via secure WebSocket connections and targets government and military organizations in Ukraine, as well as entities interested in Italian foreign policy. STOCKSTAY shares significant code overlaps with KAZUAR, particularly the K1MORPHER obfuscation mechanism. The threat actor employs academic and diplomatic lures, malicious RDP files, and compromised Ukrainian infrastructure for deployment. STOCKSTAY demonstrates environmental keying for configuration protection and operates at multiple operational stages. The malware's modular architecture separates C2 communication, task orchestration, and execution into distinct components, mirroring KAZUAR's design philosophy and indicating shared development resources within Turla's cyber espionage arsenal." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782471614", "to_ids": false, "type": "text", "uuid": "6045e2e0-ce43-47fd-9ed9-82a98c1e1a61", "value": "Name: STOCKSTAY Another Day: The Latest Addition to Turla\u2019s Intelligence Gathering Apparatus\nAuthor: AlienVault\nAdversary: Turla\nTags: [\"stockstay\", \"diamondback\", \"turla\", \"kazuar\", \"wildday\", \"k1morpher\"]\nTgtd countries: [\"Italy\", \"Ukraine\"]\nMlwr families: [\"STOCKSTAY\", \"Kazuar - S0265\", \"WILDDAY\", \"DIAMONDBACK\", \"STOCKSTAY.STOCKBROKER\", \"STOCKSTAY.STOCKMARKET\", \"STOCKSTAY.STOCKTRADER\", \"STOCKSTAY.MARKETMAKER\"]\nAttack_ids: [\"T1560.001\", \"T1113\", \"T1204.002\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1005\", \"T1140\", \"T1055\", \"T1112\", \"T1090\", \"T1057\", \"T1041\", \"T1547.001\", \"T1027\", \"T1573\", \"T1059.003\", \"T1071.001\", \"T1105\"]\nIndustries: [\"Government\", \"Defense\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1782515584", "to_ids": false, "type": "threat-actor", "uuid": "d22e46a1-450a-42b9-9847-2bc01221dc60", "value": "Turla", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Turla\"", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782471614", "to_ids": false, "type": "vulnerability", "uuid": "06059e22-80c8-46dc-8429-ad19ec13ec40", "value": "CVE-2025-8088" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528069", "to_ids": true, "type": "sha256", "uuid": "c32aa716-11fb-48e6-abf8-fac5afb951a3", "value": "391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782471614", "to_ids": false, "type": "vulnerability", "uuid": "3ab620e9-6510-461f-8850-cc2dcf41fb2e", "value": "CVE-2026-20245" }, { "category": "Payload delivery", "comment": "Module containing backdoor command handlers, historically found within STOCKSTAY.STOCKTRADER No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528071", "to_ids": true, "type": "sha256", "uuid": "6e4218f4-261e-4194-811f-d8db00107e8e", "value": "1682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d851", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528072", "to_ids": true, "type": "sha256", "uuid": "e0a9f6d2-6b30-4f73-9bac-373288f7935d", "value": "19e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528073", "to_ids": true, "type": "sha256", "uuid": "5ca52d43-f2d2-4ccd-879a-b9ae876d1784", "value": "1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528074", "to_ids": true, "type": "sha256", "uuid": "3e463129-e31e-4948-8309-3f1f30f73b06", "value": "2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LNK shortcut intended to execute STOCKSTAY.STOCKMARKET No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528075", "to_ids": true, "type": "sha256", "uuid": "61b4f6b0-7f4a-419c-a7df-0db3b1454f20", "value": "3627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528077", "to_ids": true, "type": "sha256", "uuid": "5016adc7-cc6a-415f-baf3-fc177302e56c", "value": "4e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a38320", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528078", "to_ids": true, "type": "sha256", "uuid": "85a26892-7ddf-40f3-a968-bdb382bc8807", "value": "6298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "STOCKSTAY.STOCKTRADER backdoor No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528079", "to_ids": true, "type": "sha256", "uuid": "66318d62-2730-4134-9bb2-97ad068c3704", "value": "667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a38", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528080", "to_ids": true, "type": "sha256", "uuid": "1d066418-6dc7-4004-9efb-5bcf6c103de5", "value": "6cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528081", "to_ids": true, "type": "sha256", "uuid": "4a11caef-81d3-4d71-8e5a-e503ba6d3479", "value": "7615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd78", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LNK shortcut intended to execute STOCKSTAY.STOCKTRADER No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528083", "to_ids": true, "type": "sha256", "uuid": "105c89ab-954e-4fe8-9168-33dc173b8d12", "value": "77417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a82244167", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "LNK shortcut intended to execute STOCKSTAY.STOCKBROKER No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528084", "to_ids": true, "type": "sha256", "uuid": "4c472229-5025-4150-a645-2fd2d3258ffd", "value": "813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "STOCKSTAY.STOCKMARKET orchestrator No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528085", "to_ids": true, "type": "sha256", "uuid": "fba90b68-71ee-4b8b-ba83-a2f051190b72", "value": "a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Module containing core crypt and obfuscation routines, historically found within core STOCKSTAY components No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528086", "to_ids": true, "type": "sha256", "uuid": "a1bfcf5f-1629-4ea9-b931-553a7d360dd5", "value": "b287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528087", "to_ids": true, "type": "sha256", "uuid": "12784dea-51cb-44ea-8892-20009821074f", "value": "b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "STOCKSTAY.STOCKMARKET tunneler No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528088", "to_ids": true, "type": "sha256", "uuid": "841a08da-2feb-4c2e-94d1-b02c27a13efe", "value": "c905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528090", "to_ids": true, "type": "sha256", "uuid": "5904083a-0e3d-4d5b-bcf4-7ca428244371", "value": "d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528091", "to_ids": true, "type": "sha256", "uuid": "286e74b8-a675-4207-baa0-315e30c8babc", "value": "da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Module containing STOCKSTAY\u2019s IPC logic, historically found within each STOCKSTAY component No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528092", "to_ids": true, "type": "sha256", "uuid": "b651bd1f-fb67-4a6c-bbdb-2fabd801782c", "value": "e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "STOCKSTAY.STOCKMARKET orchestrator No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528093", "to_ids": true, "type": "sha256", "uuid": "00935885-2bb2-475b-953b-67981b7f1535", "value": "e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "STOCKSTAY configuration file No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528094", "to_ids": true, "type": "sha256", "uuid": "d78b8bbe-a146-49b2-a686-198d7643c63d", "value": "e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "STOCKSTAY configuration file No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528095", "to_ids": true, "type": "sha256", "uuid": "7e61674e-f7a5-4a4e-8e5f-b20a6a28a0dc", "value": "e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Python STOCKSTAY C2 controller No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528096", "to_ids": true, "type": "sha256", "uuid": "e2ee1dd3-6913-42b4-a1b0-dcdb7b7dc50a", "value": "f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "STOCKSTAY configuration file No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528098", "to_ids": true, "type": "sha256", "uuid": "a5d10494-552b-4dcd-b05f-325a9acd68c3", "value": "f964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531170", "to_ids": true, "type": "url", "uuid": "036177d0-33cc-4995-93cc-bb7e77922633", "value": "http://weatherdataai.theworkpc.com/ws", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531191", "to_ids": true, "type": "url", "uuid": "2d57d483-14e4-4002-a90e-640245dd8c55", "value": "https://basecon.com.ua/calculator.rar", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531212", "to_ids": true, "type": "url", "uuid": "543b277d-e135-4dad-8f3b-85c089621121", "value": "https://circoloesteri.elezioni.idnet.it/admin-election/riepilogo.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531234", "to_ids": true, "type": "url", "uuid": "33e97c7c-e96d-4f71-9976-5c5bfa08aa97", "value": "https://online.zp.ua/wp-content/uploads/Tools/EditorToolsPdf.zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531256", "to_ids": true, "type": "url", "uuid": "69bb0ad5-def3-4411-9a58-5eed6e3bd62a", "value": "https://www.circoloesteri.it/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531277", "to_ids": true, "type": "url", "uuid": "67727089-50f6-40d9-961a-75648b06ed14", "value": "https://www.drs.gov.ua/wp-content/themes/twentytwentyfive/docs.zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531298", "to_ids": true, "type": "url", "uuid": "1bee4171-b3cb-457b-855d-33aa224730d3", "value": "wss://driverx86-adobe.onrender.com/ws", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531319", "to_ids": true, "type": "url", "uuid": "13814b54-56e4-4e14-9522-6487e00f881e", "value": "wss://google-ai-labs-it.onrender.com/ws", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782531340", "to_ids": true, "type": "url", "uuid": "4208b8ba-3411-4620-98e0-b9e8c99ec6ef", "value": "wss://canal1zac1a.onrender.com/ws", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515686", "uuid": "b4a07fc0-e6aa-428b-b72f-dab5f671a5d9", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515686", "to_ids": false, "type": "text", "uuid": "42b2db3c-dd5a-4936-bed0-3dcd04b74165", "value": "G_Backdoor_STOCKSTAY_ConfigurationFile_2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515686", "to_ids": false, "type": "comment", "uuid": "f5c934e7-486c-4460-b1ef-19a85bd554be", "value": "Detects encrypted configuration files associated with STOCKSTAY." }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515686", "to_ids": true, "type": "yara", "uuid": "b51fd5f9-a9b4-4372-9638-4c52767808c0", "value": "rule G_Backdoor_STOCKSTAY_ConfigurationFile_2 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects encrypted configuration files associated with STOCKSTAY.\"\r\n hash = \"40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3\"\r\n\r\n strings:\r\n $s1 = \"\\\"SystemConfiguration\\\"\"\r\n $s2 = \"An application for getting information about current events on trading platforms\"\r\n $s3 = \"To set the time for updating information, enter a value in minutes in the `Interval` field\"\r\n $s4 = \"The `SystemConfiguration` field stores the system settings of the application.\"\r\n $s5 = \"In the `services` field, fill in the list of addresses of services that provide the `WebSocket protocol`.\"\r\n $s6 = \"wss://\"\r\n\r\n condition:\r\n uint16(0) == 0x227B // {\"\r\n and 4 of ($s*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515707", "uuid": "dc1c72ca-1f41-47b7-b6e2-bb1998b7ae1d", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515707", "to_ids": false, "type": "text", "uuid": "a90e86d5-9e74-4a70-9e4f-466912b78545", "value": "G_Backdoor_STOCKSTAY_ConfigurationFile_3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515707", "to_ids": false, "type": "comment", "uuid": "0aba5e3f-3e59-4bbb-a201-f59a2e78afb4", "value": "Detects early configuration files associated with STOCKSTAY." }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515707", "to_ids": true, "type": "yara", "uuid": "279d40fd-96a7-4c2c-923e-2e7d88eb2100", "value": "rule G_Backdoor_STOCKSTAY_ConfigurationFile_3 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects early configuration files associated with STOCKSTAY.\"\r\n hash = \"1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f\"\r\n\r\n strings:\r\n $key_required_1 = \"\\\"List 1\\\"\"\r\n $key_required_2 = \"\\\"List 2\\\"\"\r\n $key_required_3 = \"\\\"List 3\\\"\"\r\n $key_dummy_1 = \"\\\"BinanceApi\\\"\"\r\n $key_dummy_2 = \"\\\"CoinbaseCloudApi\\\"\"\r\n $key_dummy_3 = \"\\\"CoinbaseCloudApi Sandbox\\\"\"\r\n $key_dummy_4 = \"\\\"ByBitApi Spot\\\"\"\r\n $key_dummy_5 = \"\\\"ByBitApi Linear\\\"\"\r\n $key_dummy_6 = \"\\\"Info level\\\"\"\r\n $key_dummy_7 = \"\\\"Rate info\\\"\"\r\n $key_dummy_8 = \"\\\"Info level\\\"\"\r\n\r\n condition:\r\n uint8(0) == 0x7B // {\r\n and filesize > 500\r\n and all of ($key_required_*)\r\n and 3 of ($key_dummy*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515727", "uuid": "25cc40df-fd9f-4d17-992a-7715c297ee12", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515727", "to_ids": false, "type": "text", "uuid": "bf720f85-148a-4988-87d6-afa480e82534", "value": "G_Backdoor_STOCKSTAY_ConfigurationFile_5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515727", "to_ids": false, "type": "comment", "uuid": "31f55c7d-ace5-4362-ada1-c9cfa0d26e6e", "value": "Detects plaintext configuration files used by the STOCKSTAY malware family" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515727", "to_ids": true, "type": "yara", "uuid": "97c61f10-8d68-4d20-ac5f-3bc5cafec603", "value": "rule G_Backdoor_STOCKSTAY_ConfigurationFile_5 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects plaintext configuration files used by the STOCKSTAY malware family.\"\r\n hash = \"6cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b\"\r\n\r\n strings:\r\n $internal_id_1 = \"\\\"internal_id\\\"\"\r\n $internal_id_2 = \"\\\"i_id\\\"\"\r\n $internal_key_1 = \"\\\"internal_key\\\"\"\r\n $internal_key_2 = \"\\\"i_k\\\"\"\r\n $interval_engine_1 = \"\\\"interval_engine\\\"\"\r\n $interval_engine_2 = \"\\\"ie\\\"\"\r\n $level_info_1 = \"\\\"level_info\\\"\"\r\n $level_info_2 = \"\\\"li\\\"\"\r\n $time_scale_1 = \"\\\"time_scale\\\"\"\r\n $time_scale_2 = \"\\\"ts\\\"\"\r\n $span_min_1 = \"\\\"span_min\\\"\"\r\n $span_min_2 = \"\\\"mx1\\\"\"\r\n $span_max_1 = \"\\\"span_max\\\"\"\r\n $span_max_2 = \"\\\"my1\\\"\"\r\n $rate_1 = \"\\\"rate\\\"\"\r\n $rate_2 = \"\\\"rt_x_y\\\"\"\r\n $rate_control_1 = \"\\\"rate_control\\\"\"\r\n $service_1 = \"\\\"service\\\"\"\r\n $service_2 = \"\\\"srv\\\"\"\r\n $days_not_work_1 = \"\\\"days_not_work\\\"\"\r\n $days_not_work_2 = \"\\\"dnw\\\"\"\r\n $system_properties_1 = \"\\\"system_properties\\\"\"\r\n $system_properties_2 = \"\\\"sp\\\"\"\r\n\r\n condition:\r\n any of ($internal_id*)\r\n and any of ($internal_key*)\r\n and any of ($interval_engine*)\r\n and any of ($level_info*)\r\n and any of ($time_scale*)\r\n and any of ($span_min*)\r\n and any of ($span_max*)\r\n and any of ($rate*)\r\n and any of ($service*)\r\n and any of ($days_not_work*)\r\n and any of ($system_properties*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515744", "uuid": "7e82f830-3284-44f7-817b-d582aa25b3f0", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515744", "to_ids": false, "type": "text", "uuid": "2d2817ad-d2e2-4aa4-9567-c838b06f6e00", "value": "G_Backdoor_STOCKSTAY_CryptoContainer_1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515744", "to_ids": false, "type": "comment", "uuid": "01b5e1c5-a8e0-423c-8a62-ab9a46dda7eb", "value": "Detects code for parsing crypto containers within STOCKSTAY components" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515744", "to_ids": true, "type": "yara", "uuid": "791cc4a7-9168-4b48-b570-1d85dc96da30", "value": "rule G_Backdoor_STOCKSTAY_CryptoContainer_1 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects code for parsing crypto containers within STOCKSTAY components.\"\r\n hash = \"82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb\"\r\n\r\n strings:\r\n $s1 = \"BuildCryptoContainer\"\r\n $s2 = \"ParseCryptoContainer\"\r\n $s3 = \"Windows-1251\" wide\r\n $s4 = \"AesCryptoServiceProvider\"\r\n $s5 = \"RSACryptoServiceProvider\"\r\n\r\n condition:\r\n uint16(0) == 0x5a4d\r\n and all of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515762", "uuid": "a2f0ea4c-d4fe-42f6-a84d-91e2172ba9bb", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515762", "to_ids": false, "type": "text", "uuid": "378b8ebb-68b8-4f01-8f4d-583ea62cfc13", "value": "G_Backdoor_STOCKSTAY_WindowNames_1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515762", "to_ids": false, "type": "comment", "uuid": "740457f5-ca82-4b52-877f-327abc57827d", "value": "Detects STOCKSTAY window names." }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515762", "to_ids": true, "type": "yara", "uuid": "265ff126-2512-4c54-88b1-b85df87a02f3", "value": "rule G_Backdoor_STOCKSTAY_WindowNames_1 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects STOCKSTAY window names.\"\r\n hash = \"dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22\"\r\n\r\n\r\n strings:\r\n $import = \"_CorExeMain\"\r\n $s2 = \"SMEditorPage\" wide\r\n $s3 = \"SMNetPage\" wide\r\n $s4 = \"StockMarketViewPage\" wide\r\n $s5 = \"window_system32_x128\" wide\r\n $s6 = \"window_system32_x64\" wide\r\n $s7 = \"window_system32_x32\" wide\r\n\r\n condition:\r\n $import \r\n and any of ($s*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515780", "uuid": "2645a616-8c0a-45ce-b7b0-04fc392db906", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515780", "to_ids": false, "type": "text", "uuid": "fffa6eed-1b8c-4eda-9d31-264939d93908", "value": "G_Downloader_STOCKSTAY_MARKETMAKER_1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515780", "to_ids": false, "type": "comment", "uuid": "c22e5142-cb0b-4343-816c-b331210d70c1", "value": "Detects STOCKSTAY.MARKETMAKER downloader based on method names and payload filenames" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515780", "to_ids": true, "type": "yara", "uuid": "2c823d54-ea6a-4bae-a7c8-dd095733b149", "value": "rule G_Downloader_STOCKSTAY_MARKETMAKER_1 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects STOCKSTAY.MARKETMAKER downloader based on method names and payload filenames.\"\r\n hash = \"da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40\"\r\n\r\n strings:\r\n $f1 = \"CheckAutoRun\"\r\n $f2 = \"SetupAutoRun\"\r\n $f3 = \"DownloadAndExtractZip\"\r\n $f4 = \"GetSystemProxy\"\r\n\r\n $s0 = \"_CorExeMain\"\r\n $s1 = \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" wide\r\n $s2 = \"StockMarketView.exe\" wide\r\n $s3 = \"SMNet.exe\" wide\r\n $s4 = \"SMEditor.exe\" wide\r\n\r\n condition:\r\n all of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515802", "uuid": "a3f22a72-d5bd-4f90-9e45-8870ea70d81b", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515802", "to_ids": false, "type": "text", "uuid": "5f527e23-074e-4835-b44c-11823bec74c2", "value": "G_Controller_STOCKSTAY_STOCKMARKET_1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515802", "to_ids": false, "type": "comment", "uuid": "989a6514-d35e-41d8-9370-6e88d9261d77", "value": "Detects STOCKSTAY.STOCKMARKET controller based on method and field names, and SQL queries" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515802", "to_ids": true, "type": "yara", "uuid": "1a4d318f-78e9-48f7-8e00-160dd6cb6221", "value": "rule G_Controller_STOCKSTAY_STOCKMARKET_1 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects STOCKSTAY.STOCKMARKET controller based on method and field names, and SQL queries\"\r\n hash = \"2af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0\"\r\n\r\n strings:\r\n $f1 = \"ProtocolMessageConnect\"\r\n $f2 = \"ProtocolMessageEnd\"\r\n $f3 = \"ProtocolMessagePing\"\r\n $f4 = \"ProtocolMessageRequestRecv\"\r\n $f5 = \"ProtocolMessageRequestSend\"\r\n $f6 = \"ProtocolMessageTask\"\r\n $f7 = \"ProtocolMessageTaskSysinfo\"\r\n $f8 = \"TMR_AppInit_Tick\"\r\n $f9 = \"TMR_Engine_Tick\"\r\n $f10 = \"TMR_KeepAlive_Tick\"\r\n $f11 = \"TMR_PingNet_Tick\"\r\n $f12 = \"TMR_PingSystem_Tick\"\r\n $f13 = \"GetDataTrade\"\r\n $f14 = \"GetDataNews\"\r\n $f15 = \"InsertDataTrade\"\r\n $f16 = \"InsertDataNews\"\r\n $sql1 = \"CREATE TABLE IF NOT EXISTS News (\" wide\r\n $sql2 = \"CREATE TABLE IF NOT EXISTS Trade (\" wide\r\n $sql3 = \"CREATE TABLE IF NOT EXISTS Market (\" wide\r\n $sql4 = \"INSERT INTO Market ( Guid, Version, Config, Status, Launch, Type ) VALUES (@Guid, @Version, @Config, @Status, @Launch, @Type)\" wide\r\n $sql5 = \"INSERT INTO News (Container) VALUES (@Container)\" wide\r\n $sql6 = \"INSERT INTO Trade (Container) VALUES (@Container)\" wide\r\n\r\n condition:\r\n 8 of ($f*)\r\n and any of ($sql*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515822", "uuid": "20702425-5358-40c6-bfa7-5e0db12378f2", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515822", "to_ids": false, "type": "text", "uuid": "dc8b6d37-0cf4-427d-938e-6888d3e86606", "value": "G_Tunneler_STOCKSTAY_STOCKBROKER_1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515822", "to_ids": false, "type": "comment", "uuid": "5d9fd4a9-94a7-4bc5-8a4a-8336e854a0e8", "value": "Detects STOCKSTAY.STOCKBROKER tunneler based on known IPC message handler and variable names." }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515822", "to_ids": true, "type": "yara", "uuid": "2e5f475d-a857-4290-9ce5-b583d458da36", "value": "rule G_Tunneler_STOCKSTAY_STOCKBROKER_1 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects STOCKSTAY.STOCKBROKER tunneler based on known IPC message handler and variable names.\"\r\n hash = \"dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22\"\r\n\r\n strings:\r\n $s1 = \"_CorExeMain\"\r\n $s2 = \"ProtocolMessageStatusConnection\"\r\n $s3 = \"ProtocolMessageResult\"\r\n $s4 = \"ProtocolMessageEnd\"\r\n $s5 = \"OnGetDataFromServer\"\r\n $s6 = \"webSocket\"\r\n $s7 = \"wmCopyData\"\r\n $s8 = \"tempStorage\"\r\n\r\n condition:\r\n all of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515842", "uuid": "f641af19-d875-4228-b14c-bd4cc69ac8b9", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515842", "to_ids": false, "type": "text", "uuid": "cfeeb925-6968-40d9-a1ca-309983ab4a0e", "value": "G_Backdoor_STOCKSTAY_STOCKTRADER_3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515842", "to_ids": false, "type": "comment", "uuid": "13a752d5-e46e-4a9f-9c44-16e349b6f7a3", "value": "Detects STOCKSTAY.STOCKTRADER backdoor based on known command handlers and FNV1a hashes." }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515842", "to_ids": true, "type": "yara", "uuid": "c722e4c1-e6c8-48e3-aea9-2036b8feebf2", "value": "rule G_Backdoor_STOCKSTAY_STOCKTRADER_3 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects STOCKSTAY.STOCKTRADER backdoor based on known command handlers and FNV1a hashes.\"\r\n hash = \"82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb\"\r\n\r\n strings:\r\n $cmd_1 = \"AppDel\"\r\n $cmd_3 = \"AppDeleteRegistryValue\"\r\n $cmd_4 = \"AppDir\"\r\n $cmd_5 = \"AppGet\"\r\n $cmd_6 = \"AppMkdir\"\r\n $cmd_7 = \"AppPut\"\r\n $cmd_8 = \"AppReadRegistryValue\"\r\n $cmd_9 = \"AppRegistryKeyExists\"\r\n $cmd_10 = \"AppRmdir\"\r\n $cmd_11 = \"AppRun\"\r\n $cmd_12 = \"AppWriteRegistryValue\"\r\n $cmd_13 = \"AppUnpackArchive\"\r\n $cmd_14 = \"ArchiveFiles\"\r\n $cmd_15 = \"GetFiles\"\r\n $cmd_16 = \"Sysinfo\"\r\n \r\n $hash_1 = {ea8e5e34}\r\n $hash_2 = {3445694e}\r\n $hash_3 = {f73e97b6}\r\n $hash_4 = {9aa70c59}\r\n $hash_5 = {18b496c9}\r\n $hash_6 = {0f716ebc}\r\n $hash_7 = {8e2d79ce}\r\n $hash_8 = {3ae2a963}\r\n $hash_9 = {35d26840}\r\n $hash_10 = {6c41d6bc}\r\n $hash_11 = {1fdbbb2f}\r\n $hash_12 = {6ae6578d}\r\n $hash_13 = {66732be7}\r\n $hash_14 = {0b113b3d}\r\n\r\n condition:\r\n uint16(0) == 0x5a4d\r\n and (\r\n 12 of ($cmd*)\r\n or 10 of ($hash*)\r\n )\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515862", "uuid": "7782d044-33f8-4c4e-8c51-6b38e4de96eb", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515862", "to_ids": false, "type": "text", "uuid": "28a4804b-73fe-4eba-92dd-f48a05935e8e", "value": "G_Hunting_K1MORPHER_1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515862", "to_ids": false, "type": "comment", "uuid": "f7d3ff06-b3f7-4341-a0b9-c231029f6d4e", "value": "Detects plaintext class and method names associated with the .NET class K1.Morpher" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515862", "to_ids": true, "type": "yara", "uuid": "27c13bbf-5f5c-4ec6-9ef4-07db9dc4ceb1", "value": "rule G_Hunting_K1MORPHER_1 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects plaintext class and method names associated with the .NET class K1.Morpher\"\r\n hash = \"45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893\"\r\n\r\n strings:\r\n $plain_api_1 = \"Squirrel3\"\r\n $plain_api_2 = \"DecryptArraySimple\"\r\n $plain_api_3 = \"DecryptIntSimple\"\r\n $plain_api_4 = \"DecryptLongSimple\"\r\n $plain_api_5 = \"DecryptFloatSimple\"\r\n $plain_api_6 = \"DecryptStringSimple\"\r\n $plain_api_7 = \"DecryptDoubleSimple\"\r\n $plain_api_8 = \"_squ_ui1\"\r\n $plain_api_9 = \"_squ_ui2\"\r\n $plain_api_10 = \"_squ_ui3\"\r\n $plain_api_11 = \"InjectedSeedCipher\"\r\n\r\n condition:\r\n dotnet.is_dotnet\r\n and 5 of ($plain_api*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515883", "uuid": "36038320-32b1-497e-ad84-3e0d4916e97c", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515883", "to_ids": false, "type": "text", "uuid": "713c615b-ed40-4d9b-ad08-1b352cccb593", "value": "G_Hunting_K1MORPHER_2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515883", "to_ids": false, "type": "comment", "uuid": "d7b632b2-436f-4d16-9963-6361941c4b63", "value": "Detects the Squirrel3 RNG implemented within K1.Morpher" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515883", "to_ids": true, "type": "yara", "uuid": "3fdc3dda-55de-4d33-854d-c96e8cc0569f", "value": "rule G_Hunting_K1MORPHER_2 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects the Squirrel3 RNG implemented within K1.Morpher\"\r\n hash = \"45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893\"\r\n\r\n strings:\r\n $squirrel3_code_1 = {\r\n 00 // nop\r\n 03 // ldarg.1\r\n 0A // stloc.0\r\n 06 // ldloc.0\r\n 7E ??????04 // ldsfld \r\n 5A // mul\r\n 0A // stloc.0\r\n 06 // ldloc.0\r\n 02 // ldarg.0\r\n 58 // add\r\n 0A // stloc.0\r\n 06 // ldloc.0\r\n 06 // ldloc.0\r\n 1E // ldc.i4.8\r\n 64 // shr.un\r\n 61 // xor\r\n 0A // stloc.0\r\n 06 // ldloc.0\r\n 7E ??????04 // ldsfld \r\n 58 // add\r\n 0A // stloc.0\r\n 06 // ldloc.0\r\n 06 // ldloc.0\r\n 1E // ldc.i4.8\r\n 62 // shl\r\n 61 // xor\r\n 0A // stloc.0\r\n 06 // ldloc.9\r\n 7E ??????04 // ldsfld \r\n 5A // mul\r\n 0A // stloc.0\r\n 06 // ldloc.0\r\n 06 // ldloc.0\r\n 1E // ldc.i4.8\r\n 64 // shr.un\r\n 61 // xor\r\n 0A // stloc.0\r\n 06 // ldloc.0\r\n 0B // stloc.1\r\n 2B 00 // br.s 40\r\n 07 // ldloc.1\r\n 2A // ret\r\n }\r\n\r\n condition:\r\n dotnet.is_dotnet\r\n and all of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782515908", "uuid": "d0b37103-8217-44d3-88b0-a0c827570d0d", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782515908", "to_ids": false, "type": "text", "uuid": "2ee0f315-06d0-4f48-9329-c489ba6f31fa", "value": "G_Hunting_K1MORPHER_3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782515908", "to_ids": false, "type": "comment", "uuid": "4826e864-230d-4530-8a52-fb6f93100b88", "value": "Detects the Squirrel3 RNG implemented within K1.Morpher" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782515908", "to_ids": true, "type": "yara", "uuid": "bcf6d3f7-4341-4a13-8686-cc5801439a4d", "value": "rule G_Hunting_K1MORPHER_3 {\r\n meta:\r\n author = \"Google Threat Intelligence Group\"\r\n description = \"Detects the Squirrel3 RNG implemented within K1.Morpher\"\r\n hash = \"391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e\"\r\n\r\n strings:\r\n $squirrel3_code_1 = {\r\n 03 // ldarg.1\r\n 7E??????04 // ldsfld \r\n 5A // mul\r\n 02 // ldarg.0\r\n 58 // add\r\n 25 // dup\r\n 1E // ldc.i4.8\r\n 64 // shr.un\r\n 61 // xor\r\n 7E??????04 // ldsfld \r\n 58 // add\r\n 25 // dup\r\n 1E // ldc.i4.8\r\n 62 // shl\r\n 61 // xor\r\n 7E??????04 // ldsfld \r\n 5A // mul\r\n 25 // dup\r\n 1E // ldc.i4.8\r\n 64 // shr.un\r\n 61 // xor\r\n 2A // ret\r\n }\r\n\r\n condition:\r\n dotnet.is_dotnet\r\n and all of them\r\n}" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531361", "uuid": "52c6b398-719d-4a71-ba13-c780d140f96c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531361", "to_ids": true, "type": "md5", "uuid": "872095d8-9007-4225-8d18-51f14662a856", "value": "8ac4b7f4d5ff0934a31f8ada2991e68b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528034", "to_ids": true, "type": "sha1", "uuid": "af73c7f2-47fe-49f2-8dca-b3e00d09c14c", "value": "2e6dfc75204df8ae073b2393866d73aafe8c63c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528034", "to_ids": true, "type": "sha256", "uuid": "4ff8f302-e1da-4430-867e-4c82b88a2c4f", "value": "0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526505", "to_ids": true, "type": "ssdeep", "uuid": "ff62c245-9dee-4b38-b56a-1b7f49473ef9", "value": "384:mtBOuvVon8K7kNRZa9E4M+YDWqpghak33Se6H+XCcIZInhk8IM6tpa95fw:mBK9kNRKEVDfpBk33yzp4K" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526505", "to_ids": false, "type": "size-in-bytes", "uuid": "9b7213b2-8697-457c-b65e-24912cfa2fdb", "value": "29184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526505", "to_ids": true, "type": "vhash", "uuid": "d367bccc-72d7-42db-86c7-26f32890eee0", "value": "224036551512008432355251c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526505", "to_ids": true, "type": "filename", "uuid": "d56b66ba-07f2-4873-8733-52aab5c508f5", "value": "StockMarketSystem.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526505", "to_ids": false, "type": "text", "uuid": "392d6523-c449-45d8-ba77-cb47c40ec649", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.C!dha\nVT Total Detection:24/71\nFirst Submission:2023-12-06T08:54:11.000000+00:00\nLast Submission:2023-12-06T08:54:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531382", "uuid": "2c8fedec-f39f-47a1-adc0-ee04e5e842ed", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531382", "to_ids": true, "type": "md5", "uuid": "43b95021-e56f-4fb8-8967-230c8adc3a6e", "value": "c5b2d3bfe364d412bf4eac9936a74c61", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528036", "to_ids": true, "type": "sha1", "uuid": "56c3a0dc-4ad8-4a2a-a288-140a3025e392", "value": "a35053104e8f0ec40babd3e9912eea6f07aba1ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528036", "to_ids": true, "type": "sha256", "uuid": "8cc5c684-fe84-40c9-95d7-ad6931cb4adf", "value": "0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526526", "to_ids": true, "type": "ssdeep", "uuid": "426a6973-2599-4f76-bb6e-5589ee367aed", "value": "192:lFONtX7ySNyzI55Zlucu2748Xu9IuROc3NrcrrN9rJrrx3sB:yyUNc3NrcrrN9rJrrZy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526527", "to_ids": false, "type": "size-in-bytes", "uuid": "18653e8d-5eb1-4f11-a388-bfdb2f5f7127", "value": "9811" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526527", "to_ids": true, "type": "vhash", "uuid": "37db375f-0054-4c3a-be05-d078023f8ae6", "value": "77f4a8cc4008c9dec18067518dd49a09" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526527", "to_ids": true, "type": "filename", "uuid": "e0c00f49-2206-4427-927f-a5e17f149483", "value": "\u041a\u0430\u043b\u044c\u043a\u0443\u043b\u044f\u0442\u043e\u0440 \u0433\u0440\u043e\u0448\u043e\u0432\u043e\u0433\u043e \u0437\u0430\u0431\u0435\u0437\u043f\u0435\u0447\u0435\u043d\u043d\u044f \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0441\u043b\u0443\u0436\u0431\u043e\u0432\u0446\u0456\u0432 2025.hta" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526527", "to_ids": false, "type": "text", "uuid": "f43bf69f-4c34-4fe9-b457-24d40e3d85d9", "value": "Type Description: HTML\nMicrosoft: None\nVT Total Detection:5/61\nFirst Submission:2025-08-11T07:34:10.000000+00:00\nLast Submission:2025-08-11T07:34:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531404", "uuid": "b5299d54-9404-4abc-8e1f-4c8d7a91a6fe", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531404", "to_ids": true, "type": "md5", "uuid": "de7476a3-ecdd-45dc-8700-8ca2d29b32c8", "value": "a2f93ca8e8d3345e305f7e66d6ab67f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528037", "to_ids": true, "type": "sha1", "uuid": "718ee38d-f8bc-49a3-a8b7-674133ca890a", "value": "a0a31ad9814c31fb047e95f87038a61bd3adec39", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528037", "to_ids": true, "type": "sha256", "uuid": "84e5834c-1356-4ad3-a80e-f76e03de23dc", "value": "1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526611", "to_ids": true, "type": "ssdeep", "uuid": "84077464-cffe-4431-a3e6-ba508e04b3ed", "value": "768:u6bP95Ds90Y+sAh4VLoxcSHMedwqQXM+uQDKlwIbN:LD95gVcxnaKlv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526611", "to_ids": false, "type": "size-in-bytes", "uuid": "a1768817-ff04-4fce-b412-7d0161dadb1a", "value": "39424" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526611", "to_ids": true, "type": "vhash", "uuid": "ba47b8c2-2931-4741-8593-04fb49db3cd8", "value": "234036551511f0852a26612d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526611", "to_ids": true, "type": "filename", "uuid": "28b1ac02-1d26-4d24-9bce-f2822f87afbe", "value": "StockMarketNews.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526611", "to_ids": false, "type": "text", "uuid": "7937b864-96a0-4745-83c3-ad9340e07675", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:8/71\nFirst Submission:2023-09-21T09:46:42.000000+00:00\nLast Submission:2023-09-21T09:46:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531425", "uuid": "c74dd8a2-57c5-4c53-b61b-b829f0d6efc0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531425", "to_ids": true, "type": "md5", "uuid": "5e1055c8-44d3-4317-a8e3-3980a07bec3a", "value": "eb2327e5ac1e6f46c14b0af13f71544b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528039", "to_ids": true, "type": "sha1", "uuid": "ba0757b9-8011-44c9-91bc-e198775d8171", "value": "c6cfbcdecbb1609230aefbf00ac12c362dbc94e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528039", "to_ids": true, "type": "sha256", "uuid": "5d38d5a1-c2ef-4805-be38-4ff692a417fa", "value": "249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526633", "to_ids": true, "type": "ssdeep", "uuid": "76b6b6f1-8ec6-4c60-a5d2-38cd761c62f9", "value": "384:Ht8AAySR5Upn3hb8ufhHpVvD8bUENfErQXYaogWx2IUV0mePNE4+38VZ55rmgIfs:H+AD+5+8uhHpVvD8XN+aWY8ffSgl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526633", "to_ids": false, "type": "size-in-bytes", "uuid": "5fd1dcd6-4262-44d8-98f6-59213d237d73", "value": "24064" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526633", "to_ids": true, "type": "vhash", "uuid": "4551d37d-eff2-4adf-bae8-32269e5641e5", "value": "224036551511e0831d1ea52b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526633", "to_ids": true, "type": "filename", "uuid": "371ca4e5-63b2-4a4c-aca0-40b9aeaf8894", "value": "StockMarketNet.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526633", "to_ids": false, "type": "text", "uuid": "208b2095-9ee9-4dda-acf6-d1eb88030b21", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.C!dha\nVT Total Detection:30/71\nFirst Submission:2024-02-20T11:55:38.000000+00:00\nLast Submission:2024-02-20T20:58:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531446", "uuid": "680f8d55-f319-42d3-8cc5-bde47e519e29", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531446", "to_ids": true, "type": "md5", "uuid": "718bfc64-c4f1-41eb-ad43-42ca9d96fe3f", "value": "30b3a2034989cc2919a43e05e1226bb2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528040", "to_ids": true, "type": "sha1", "uuid": "8e6e28d4-2719-4be3-aab4-ab712a9082a4", "value": "fc3b31fa2fba012e3fbda57bc7a439b4be5db38b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528040", "to_ids": true, "type": "sha256", "uuid": "347c0426-f398-4f16-a66e-b3b7cbee1199", "value": "2af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526676", "to_ids": true, "type": "ssdeep", "uuid": "055ca9d3-8654-480c-bb43-2af332c551f1", "value": "1536:zwq+92zosshI5wydhmV6AdH1tA12oHzDW7Ib/h:z3ZshI9VHzDfN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526676", "to_ids": false, "type": "size-in-bytes", "uuid": "7d750ba3-3120-4918-9702-3137b7afb117", "value": "90624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526676", "to_ids": true, "type": "vhash", "uuid": "f00ba6cf-15f2-44c5-8dd2-956d6b527a04", "value": "2940361515125083322751516" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526676", "to_ids": true, "type": "filename", "uuid": "3b8c26b6-74a0-4f39-b33e-c64e33337f88", "value": "StockMarketView.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526676", "to_ids": false, "type": "text", "uuid": "10f0c001-2f7f-43e0-84f9-07f7b1408560", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.AA!dha\nVT Total Detection:40/71\nFirst Submission:2025-04-03T10:47:02.000000+00:00\nLast Submission:2025-04-03T10:47:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531468", "uuid": "1bd2b893-77e5-4e6e-8754-1422e480f0f6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531468", "to_ids": true, "type": "md5", "uuid": "07fc5f27-edea-41f3-b2e0-7942765b9bc4", "value": "98c5af0c8309f3827d000fdd4d30f038", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528042", "to_ids": true, "type": "sha1", "uuid": "fd3c20c2-1a70-4c19-8f3e-83377e221b1d", "value": "37a8477db66d63c844211fa419c34fcda93ccb5e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528042", "to_ids": true, "type": "sha256", "uuid": "45456cc8-9056-421a-ad33-9993ee2583d3", "value": "34fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526698", "to_ids": true, "type": "ssdeep", "uuid": "2cab1ff0-6a99-48cd-a38b-667aee6c1156", "value": "384:4Z9atLv7Ck9DAcolty+yrNRGEMXZIWb2IUrZmePQE4FJOEv7NpfC:4ZYBv7Cioi+yrNRGE20wOSw" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526698", "to_ids": false, "type": "size-in-bytes", "uuid": "757dc0f0-9768-42a9-9e76-644cdb758543", "value": "22528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526698", "to_ids": true, "type": "vhash", "uuid": "30861b15-59a7-4f7f-8b82-859cbba34294", "value": "224036551511e082191ca52c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526698", "to_ids": true, "type": "filename", "uuid": "d8ab7f15-07da-4f3f-9f50-25c9529fb0d0", "value": "StockMarketNet.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526698", "to_ids": false, "type": "text", "uuid": "5dd6cada-8805-461f-8ccc-7ea4c6e5091b", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.C!dha\nVT Total Detection:34/71\nFirst Submission:2023-12-06T08:54:11.000000+00:00\nLast Submission:2023-12-06T08:54:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531489", "uuid": "693e174c-9571-4cbb-9aed-25b5b7929b13", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531489", "to_ids": true, "type": "md5", "uuid": "398753bf-403d-4443-a1b0-794c9bbbba7b", "value": "63df274ad85c9ff6b571a72cf1d49d53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528043", "to_ids": true, "type": "sha1", "uuid": "b7b73272-0517-4d4e-94de-e45073dddf5a", "value": "6622360fce74e188ccd3f73590c808421789ebc4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528043", "to_ids": true, "type": "sha256", "uuid": "439a7533-f23d-4649-8408-acc159ba3c64", "value": "40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526742", "to_ids": true, "type": "ssdeep", "uuid": "585f9365-f463-4e22-ad07-9d1bc2b8a8fb", "value": "96:mo6lGN/yKgfFmO+OW1oEkUDFt+gy2EKBkI+RIzWlpy:mzl+/FiA6WtduD2EK3vWm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526742", "to_ids": false, "type": "size-in-bytes", "uuid": "188ad456-d7d7-4f21-9221-587cd31b3856", "value": "4124" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526742", "to_ids": true, "type": "filename", "uuid": "ac8d7e9b-0b25-4c3b-8dce-a09a9e4b26dd", "value": "fonts" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526742", "to_ids": false, "type": "text", "uuid": "3f431794-c37b-4e93-8321-1bdc65c8661b", "value": "Type Description: JSON\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2025-04-03T12:29:04.000000+00:00\nLast Submission:2025-04-03T12:29:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531510", "uuid": "e45379ec-80dd-4295-97ab-b67ea86946a8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531510", "to_ids": true, "type": "md5", "uuid": "835b69d7-690a-4ea2-a270-130bac11c7ad", "value": "279049419e38fdeee9ebcc060b3ab06f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528044", "to_ids": true, "type": "sha1", "uuid": "ddf01161-65c9-4961-9d0b-d9a1ee81ccd7", "value": "7a58c1fd33d2ea8b8712f19acfdc484d11059e20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528044", "to_ids": true, "type": "sha256", "uuid": "f4b8d10a-57eb-4f86-9a2f-7b6653a88625", "value": "40b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526764", "to_ids": true, "type": "ssdeep", "uuid": "d04dfcce-eaa9-493e-a0f3-4eb530e93e93", "value": "96:mo6M9HLxiUkzliiO6UI7K9rkBYs3gBXW+0zk18QQeJG4T0Nr3I+py:mzULxCg6S9gYsQFAk+5Zy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526764", "to_ids": false, "type": "size-in-bytes", "uuid": "32610032-b985-44e0-aa3a-c7111696916d", "value": "5038" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526764", "to_ids": true, "type": "filename", "uuid": "a9b93e7c-c5e9-4430-aa0e-6496cb071c09", "value": "default.conf" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526764", "to_ids": false, "type": "text", "uuid": "caa91ba8-436f-4a44-94e3-54fe594179fe", "value": "Type Description: JSON\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2024-02-20T11:55:37.000000+00:00\nLast Submission:2024-02-20T11:55:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531531", "uuid": "b8fea7c1-85ac-45a1-ad90-ccdceacbc10f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531531", "to_ids": true, "type": "md5", "uuid": "3f644ec9-553f-49ad-abd8-e0df15b0c726", "value": "123508dbce0c72623756ccf793eb7183", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528046", "to_ids": true, "type": "sha1", "uuid": "a26d34ec-0be9-4eab-b836-a5ebbe2d5d9c", "value": "c214c62867aae327fbaa4f35dadc786cbe213727", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528046", "to_ids": true, "type": "sha256", "uuid": "ee082e8f-0880-4d6d-b8df-76a0d155a3e8", "value": "447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526786", "to_ids": true, "type": "ssdeep", "uuid": "058d3d94-7b1c-45f4-b408-5859b2b6d8c2", "value": "98304:i/kSSh9X5CfJpCpu4XwMgokiE2fQAN2+izRVJC3T9SBYgx:iJa434+oVQ1yTQBYgx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526786", "to_ids": false, "type": "size-in-bytes", "uuid": "7c7e5434-a29e-460d-b336-240e67877b99", "value": "3903699" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526786", "to_ids": true, "type": "vhash", "uuid": "bbb576c2-1367-4e22-929c-e0c386092c8e", "value": "b603b33287faa1d9fc0b631c25577dd9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526786", "to_ids": true, "type": "filename", "uuid": "1a58ab11-1ef8-4545-bf5b-23e35bbad85e", "value": "EditorToolsPdf.zip" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526786", "to_ids": false, "type": "text", "uuid": "277a6eb3-b631-48d9-ac9a-e13599a5c357", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:42/68\nFirst Submission:2025-07-18T21:24:42.000000+00:00\nLast Submission:2025-07-18T21:24:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531552", "uuid": "ac2d0d64-dab7-4317-94b2-bc5bfd592327", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531552", "to_ids": true, "type": "md5", "uuid": "fcbb9c13-f258-4a1e-a436-e9b07903a9db", "value": "86a75cdc7c5f2a9cc87bbf56e925e544", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528047", "to_ids": true, "type": "sha1", "uuid": "6083aef0-c7a6-4256-a552-dcc074c0f8fe", "value": "fb3dbf671ff7c72e02ab03837bd9ce72dca799bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528047", "to_ids": true, "type": "sha256", "uuid": "f4ced5cc-9bf9-4adc-952f-d8a57edd5755", "value": "45bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e893", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526808", "to_ids": true, "type": "ssdeep", "uuid": "545fcf09-b9d4-4ca4-8bd0-dd0c57f495d6", "value": "1536:b6dzWjRTZsmuw7nK0Uw5lfeKTJIibm0ZgY:kWjRVruwuPw5pfTJIAm2F" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526808", "to_ids": false, "type": "size-in-bytes", "uuid": "fcca7961-6cb1-42b6-a47a-1299b0395575", "value": "111104" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526808", "to_ids": true, "type": "vhash", "uuid": "a548bcf3-60de-4e75-bdf6-a47d811ee705", "value": "2150365515125083382751616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526808", "to_ids": true, "type": "filename", "uuid": "b2319384-f579-4347-9e59-60612aa00810", "value": "ViewPdf.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526808", "to_ids": false, "type": "text", "uuid": "2230f13f-1cd6-4c06-a074-c35aa8af1a5c", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyMorph.A!dha\nVT Total Detection:45/71\nFirst Submission:2025-07-18T21:25:25.000000+00:00\nLast Submission:2025-07-18T21:25:25.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531573", "uuid": "98c6198b-d8f7-4a33-8215-fe42d74f5dda", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531573", "to_ids": true, "type": "md5", "uuid": "a56c37a6-4d82-4931-b894-80b5dee7ad24", "value": "2ee228def4ab5f4f75b978be1f2d474d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528048", "to_ids": true, "type": "sha1", "uuid": "cc932104-cc29-4c94-b8e0-5bd4abde1f01", "value": "4ec2ba1fdc083f69a6132afba72c21f456f6d0af", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528049", "to_ids": true, "type": "sha256", "uuid": "8d53f34c-44b7-4a2b-b66f-545da4fdfa03", "value": "55249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526851", "to_ids": true, "type": "ssdeep", "uuid": "782c81f7-f7e0-4742-b35e-55dc5c9762fb", "value": "768:AP5V6iX0pja/gl1nhE4V1uTfJV0ktxrGkaxLZv9K:uV3XEjfnhEEuDxSTxq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526851", "to_ids": false, "type": "size-in-bytes", "uuid": "15412320-d6e1-44b3-857a-bef8bc7a4a27", "value": "47616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526851", "to_ids": true, "type": "vhash", "uuid": "792aa24e-47f6-403f-9286-962c98021173", "value": "244036651511f088383130720" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526851", "to_ids": true, "type": "filename", "uuid": "6c6c83be-bbff-42b1-af4c-a514d9edafb3", "value": "ConverterDDSNet.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526851", "to_ids": false, "type": "text", "uuid": "7630fa47-4755-4af7-8cd6-dcf70230ea3e", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyMorph.A!dha\nVT Total Detection:46/71\nFirst Submission:2025-07-18T21:25:25.000000+00:00\nLast Submission:2025-07-18T21:25:25.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531594", "uuid": "0b18d1df-6c91-4307-9caa-1064554e55aa", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531594", "to_ids": true, "type": "md5", "uuid": "ea64ea01-62c4-4698-a4d0-e9bf90bb8469", "value": "f9b03f5ba954a7e5d1fcbb3c1c411f1a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528050", "to_ids": true, "type": "sha1", "uuid": "d59e5dca-4518-484c-96e9-6beaf989404d", "value": "4a896011c1b71f84d81bce6445839ac0970f48eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528050", "to_ids": true, "type": "sha256", "uuid": "3f20ba34-20fe-4809-9cfc-da5959832da3", "value": "626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee7459", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526872", "to_ids": true, "type": "ssdeep", "uuid": "7708bb71-2193-468f-9c0c-cf7cf722eb94", "value": "192:4UHE/2ATHMiZy8r5hG4KwEskvwKwq6k98HKTEBPW:fE/YO5hGpwrkvwKwq6uwKTEBPW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526872", "to_ids": false, "type": "size-in-bytes", "uuid": "c5ed7454-ad21-4cb3-b5a3-06016e37cf07", "value": "47616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526872", "to_ids": true, "type": "vhash", "uuid": "8b5c069f-01c5-428b-bbf8-9511f7d480ce", "value": "244036151511a084411z20" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526872", "to_ids": true, "type": "filename", "uuid": "076a63c5-fc47-4d07-855f-461a8908db5d", "value": "MicrosoftUpdateOneDrive.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526872", "to_ids": false, "type": "text", "uuid": "f2c030a6-35cc-41e2-9d70-0a3aa502dce9", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:42/71\nFirst Submission:2025-08-08T15:53:24.000000+00:00\nLast Submission:2025-08-08T15:53:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531615", "uuid": "15645e9b-4634-4c87-b304-19c26d236f4e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531615", "to_ids": true, "type": "md5", "uuid": "d2d92cd3-fdc3-4787-9f8c-03c12fb0eaf0", "value": "e6b2e87761bcff6b5481d8b0bb14cc15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528051", "to_ids": true, "type": "sha1", "uuid": "a3635ae3-8a63-4c76-81a9-c88b33dba340", "value": "d0080c0f84b046ea3fdbdd4f415900a5fc45cf0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528051", "to_ids": true, "type": "sha256", "uuid": "4676b325-abbb-420d-81ed-2a44404d84ee", "value": "6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e2342", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526957", "to_ids": true, "type": "ssdeep", "uuid": "3e9b7559-0ef9-4bf7-960c-0444157a2933", "value": "12288:mHdLbDC91syULenB9FREOYG6g7WvJ4TXqoR:m9LfaOKBPRE+TXL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526957", "to_ids": false, "type": "size-in-bytes", "uuid": "3314c3bf-ba8d-4348-b9d3-948ab478e6fa", "value": "556239" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526957", "to_ids": true, "type": "vhash", "uuid": "1b477b47-0321-4d81-bd3c-4d175c6a6112", "value": "29005b387721a1c43c0ec1762e0aa750" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526957", "to_ids": true, "type": "filename", "uuid": "a7537f41-5eb3-4644-bae7-6daaabe7b6a4", "value": "calculator.rar" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526957", "to_ids": false, "type": "text", "uuid": "30c58688-35dd-4847-85eb-5908c5c56e8c", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:33/63\nFirst Submission:2025-08-08T15:53:00.000000+00:00\nLast Submission:2025-08-08T15:53:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531636", "uuid": "eee5bff5-8f20-499b-bd28-6a6597ac99cd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531636", "to_ids": true, "type": "md5", "uuid": "71a470da-919c-4063-8673-437b120be77e", "value": "ff9f6af06c64a51a576333da5c780263", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528052", "to_ids": true, "type": "sha1", "uuid": "99e6f3c1-c33c-4665-a6e3-505b35e8b035", "value": "b5939b7b8925a83d715429aaa2603ae85746d485", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528052", "to_ids": true, "type": "sha256", "uuid": "587cab2e-d2a8-43d7-ae08-05e4f6b7828d", "value": "80f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527021", "to_ids": true, "type": "ssdeep", "uuid": "1b7d0ebf-da5d-4293-ba2e-16780b3588fd", "value": "384:4ly85ffBPFn1eiXFYUmvlofLo3hZtnYr7c5wElXlCbDRAiEnfnoBHMGMq/RjYjbN:1Uf5PpsMqntYn6LK9QfuMGt/OvvHr5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527021", "to_ids": false, "type": "size-in-bytes", "uuid": "76798832-0930-445d-b7db-37904493ad80", "value": "28672" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527021", "to_ids": true, "type": "vhash", "uuid": "c44717bb-e263-4fc1-adc0-53134cfc4259", "value": "224036651511c0831d14532b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527021", "to_ids": true, "type": "filename", "uuid": "d8fcae09-6dc0-4b19-9b4a-f004f5d0744b", "value": "ClientMNGR.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527021", "to_ids": false, "type": "text", "uuid": "c7947cb2-2c40-4331-bf6e-b7eb6e16fef4", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyMorph.A!dha\nVT Total Detection:45/71\nFirst Submission:2025-07-18T21:25:25.000000+00:00\nLast Submission:2025-07-18T21:25:25.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531657", "uuid": "401c452e-ef83-4482-9192-a8e3d2a815b6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531657", "to_ids": true, "type": "md5", "uuid": "10db885a-637c-4eec-a465-b0859f57078b", "value": "49ee47b5f496af7e8307ea094bf0e894", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528054", "to_ids": true, "type": "sha1", "uuid": "5c0ccfbf-40ba-4f54-a716-64887bc0ca0c", "value": "c6e48ef695719662a44f66ef4d8608ee995bc498", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528054", "to_ids": true, "type": "sha256", "uuid": "bc0c1a1c-209b-4144-bfdc-e28754df9251", "value": "81aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527064", "to_ids": true, "type": "ssdeep", "uuid": "455c4b9f-03b0-460f-b1fb-95019e4b9067", "value": "786432:CEiSmjjrjXN49iVJofLO0n/6BxoKIOVa/aRM73kjlvWUfYR2N7cidczLDA5ULSWm:g37SCUKIOQ2m3khY+/dWLDY39zXR8ZVS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527064", "to_ids": false, "type": "size-in-bytes", "uuid": "bd43bd3f-99f6-4bf1-a989-128e43b2b63c", "value": "68889802" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527064", "to_ids": true, "type": "vhash", "uuid": "fef8c0cf-c889-4a69-b4d9-71416d9122fa", "value": "e2666686bd358cc27afc9404f8e0ba6c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527064", "to_ids": true, "type": "filename", "uuid": "2d8cd632-fb7a-4bb5-999a-0c345cd9da6a", "value": "apps_libwallets_v1.3.rar" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527064", "to_ids": false, "type": "text", "uuid": "14489abd-03d3-4c4e-9700-0d5c19d87a22", "value": "Type Description: RAR\nMicrosoft: None\nVT Total Detection:21/63\nFirst Submission:2023-12-06T08:52:49.000000+00:00\nLast Submission:2023-12-06T08:52:49.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531679", "uuid": "4e577e9b-4b79-404b-ac63-d41e7b920673", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531679", "to_ids": true, "type": "md5", "uuid": "c4da1954-e7d5-43af-89d2-f115e09f61e7", "value": "e0e5c5aad1193591146015ca71f26e34", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528054", "to_ids": true, "type": "sha1", "uuid": "254be18f-232d-4a97-ab94-fefc1225505a", "value": "f57b79f683c1d549ae6a2e5882b429fba77b7b18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528055", "to_ids": true, "type": "sha256", "uuid": "ac709e71-5869-4def-9b68-fe95f5da80b1", "value": "82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527086", "to_ids": true, "type": "ssdeep", "uuid": "3fd1b06c-0961-400d-ac90-3decf2d07e19", "value": "1536:ZgLnYu0VL/SHswTcSOhygtQGCWiAwSjUYUReRTBlxCIh12xDOWykf+llL+qQMb:ZgLnYu0VrSHLTvgzjUYf/lxT12oUglLH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527086", "to_ids": false, "type": "size-in-bytes", "uuid": "4ae5685e-ca8b-4cc6-8671-841147df6a26", "value": "87552" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527086", "to_ids": true, "type": "vhash", "uuid": "24c7b8e9-5343-432b-8140-100c5784c587", "value": "28403655751200855a4cb581f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527086", "to_ids": true, "type": "filename", "uuid": "900290ae-09a6-40a3-8596-dccbda80d4ca", "value": "StockMarketView.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527086", "to_ids": false, "type": "text", "uuid": "71fbfda0-3fcb-4108-b9bc-78d4a500de40", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.C!dha\nVT Total Detection:31/71\nFirst Submission:2024-02-20T11:55:37.000000+00:00\nLast Submission:2024-02-20T11:55:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531700", "uuid": "b4d672c8-5499-45fc-825d-70b70a80630e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531700", "to_ids": true, "type": "md5", "uuid": "d463d084-57fd-4c71-a421-35a87465e4e7", "value": "bbcdb649a0a278873387d465f67078c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528056", "to_ids": true, "type": "sha1", "uuid": "5a1a4d3f-252d-447d-a14a-36368666d3a1", "value": "b16d16eefe54ff3a5569a5407fb57dd38d8da513", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528056", "to_ids": true, "type": "sha256", "uuid": "511ce9ae-4503-44c0-a0db-f7653440aaaf", "value": "9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527107", "to_ids": true, "type": "ssdeep", "uuid": "454059b6-6f0d-432a-aa71-d17e31f7dd4e", "value": "768:HZlA6mYahVG5vqNdK86RI0YH+W8eoa7OOuxWM2EwGucgWyevDsDLOHdE+15f2/7D:brmRGodT0zeX94WM28uc/buL+qQMb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527107", "to_ids": false, "type": "size-in-bytes", "uuid": "99df0d79-49c9-4208-8d38-0e39b0e4908e", "value": "76288" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527107", "to_ids": true, "type": "vhash", "uuid": "45fbe580-5b92-4af3-b226-cf55866cf206", "value": "27403655751200845448b581e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527107", "to_ids": true, "type": "filename", "uuid": "70621dec-8f2b-4749-a506-ae766f4f6c98", "value": "StockMarketView.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527107", "to_ids": false, "type": "text", "uuid": "a576d0b2-066d-4450-8465-2843542028f6", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.C!dha\nVT Total Detection:32/71\nFirst Submission:2023-12-06T08:54:11.000000+00:00\nLast Submission:2023-12-06T08:54:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531721", "uuid": "3ec17b32-2236-4673-b7f2-401ca237415b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531721", "to_ids": true, "type": "md5", "uuid": "e86a437e-5caa-446d-ab4f-a212af650862", "value": "00f4ba63c51f07a33b2ec5e902e7732d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528057", "to_ids": true, "type": "sha1", "uuid": "5e352ea1-5a97-420c-8695-7baed357a0fe", "value": "3b649a2b3307c1d6b738c70a4ae7212c2d3ad5d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528057", "to_ids": true, "type": "sha256", "uuid": "8a291c05-5cbc-4bee-af7d-f8a4b34a77ed", "value": "98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be397", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527129", "to_ids": true, "type": "ssdeep", "uuid": "4f593b99-d02a-4b27-898d-7375d8a7e679", "value": "384:xTnkh9O3LIQBcpBpF7kSiapmtYhL+CsptaJ8TpDgN2yqZ0hF6mZ8VSMV/Q0u2AF5:xg9gIwSpFPL+xp8J8lzyH6DVSOo9Rd9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527129", "to_ids": false, "type": "size-in-bytes", "uuid": "1af6bb1f-292f-4d52-b484-1ee2f1b4ef96", "value": "29696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527129", "to_ids": true, "type": "vhash", "uuid": "fe90087a-a65b-4f10-aa54-6e9e9c06deef", "value": "224036651511c0831c145320" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527129", "to_ids": true, "type": "filename", "uuid": "07b6b886-520e-43cc-96b9-a01039aa8e21", "value": "ClientMNGR.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527129", "to_ids": false, "type": "text", "uuid": "7ea2e6cc-fdf9-408e-a092-ac000c4d1db7", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.BA!dha\nVT Total Detection:33/71\nFirst Submission:2025-05-14T10:43:14.000000+00:00\nLast Submission:2025-05-14T10:43:14.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531742", "uuid": "7dc91e4e-99ef-409c-b017-a8c917efec71", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531742", "to_ids": true, "type": "md5", "uuid": "c41aee29-32c4-4d51-87b4-706a75911b7a", "value": "6d84fcadcd2dd4352bc4994f6cb30652", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528059", "to_ids": true, "type": "sha1", "uuid": "02745753-543c-466f-b9e4-22eb66601b0c", "value": "546d038a7392a7c2c5e104da56fd2ffb787cf6bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528059", "to_ids": true, "type": "sha256", "uuid": "aaaf4551-615a-4a1a-a61f-e25bd533041f", "value": "9fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527151", "to_ids": true, "type": "ssdeep", "uuid": "c00873b1-5e5e-45b3-8e12-36a4000e353d", "value": "98304:jih/kSSh9X5CfJpCpu4XfNSi2fQAN2+izRPJC3T9SBYgi:yJa434c1Q1ETQBYgi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527151", "to_ids": false, "type": "size-in-bytes", "uuid": "85f16e22-d23b-4a16-8272-1fec65aca15c", "value": "3883518" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527151", "to_ids": true, "type": "vhash", "uuid": "2574644c-4b8f-4093-b224-14933ad11104", "value": "598a8419bfb76865816eb28416bfe722" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527151", "to_ids": true, "type": "filename", "uuid": "f50273f7-e273-4731-9e2a-d3be90349487", "value": "docs.zip" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527151", "to_ids": false, "type": "text", "uuid": "cdc0e1a2-c59c-4d08-beda-9ed63d4c9794", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:33/68\nFirst Submission:2025-04-03T10:46:30.000000+00:00\nLast Submission:2025-04-03T10:46:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531763", "uuid": "9575049c-8efd-4811-abd2-361d82846563", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531763", "to_ids": true, "type": "md5", "uuid": "53450d59-3f61-4e11-bddf-4ae4439e6ccf", "value": "17d1b4df9a044c6ce97aed9bc9d0e556", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528060", "to_ids": true, "type": "sha1", "uuid": "6a129838-ab18-4530-a896-8c05075a2e9f", "value": "e052ddf48a980dab5cf393dbf5823229e2919361", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528060", "to_ids": true, "type": "sha256", "uuid": "b595c361-ef9e-4d5e-9adf-c8f05e7838a1", "value": "b064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527194", "to_ids": true, "type": "ssdeep", "uuid": "2791fc98-ecca-4533-8bd2-73de84047688", "value": "196608:ubJjnk6Qs6dnnlbJn41Lf4SgJewC3WckWv4lpgNuwVELaaF8k:uNjnQs6JlbJnCgAzJvipgNuwaLaY8k" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527194", "to_ids": false, "type": "size-in-bytes", "uuid": "13866d20-3406-426d-9634-416a14d03ad1", "value": "9262080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527194", "to_ids": true, "type": "vhash", "uuid": "5358a29a-0e39-4d6f-a960-523d2cf951ce", "value": "9138003c79247af30c0741e46d2cc978" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527194", "to_ids": true, "type": "filename", "uuid": "368db89e-97d6-4a78-8552-f215c9b1b7b4", "value": "Copia.msi" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527194", "to_ids": false, "type": "text", "uuid": "1143e30a-4af7-4e1d-bbde-0ce1737a4977", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:25/62\nFirst Submission:2024-02-20T11:45:26.000000+00:00\nLast Submission:2024-02-20T11:45:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531784", "uuid": "24c7c95d-5aa6-488f-95dd-2bc9450091d4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531784", "to_ids": true, "type": "md5", "uuid": "34f59a8d-12c0-4951-a0d4-35a332a6cd63", "value": "81f3b6e3d9046d8dc58136729294e60a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528062", "to_ids": true, "type": "sha1", "uuid": "4f75a283-6bb4-4884-ab62-397d0c2c2a0c", "value": "629db9564ca4b7b19e9a51ae3bbd0d68cd1b65f5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528062", "to_ids": true, "type": "sha256", "uuid": "accbbbb5-aa3e-4d70-ab39-afcd6b261fe5", "value": "b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527258", "to_ids": true, "type": "ssdeep", "uuid": "62135e68-bb3c-4704-ab89-0ead85f40517", "value": "384:LYWI1Dcp3XeO2tQTsyslvaXmmZhDabyoFcfZqnhk8Y1nCt+ZeTfI:Mk12wsyslimGhZf/CpE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527258", "to_ids": false, "type": "size-in-bytes", "uuid": "b437eb09-3c9c-43ea-a84b-cbdd3674716b", "value": "30208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527258", "to_ids": true, "type": "vhash", "uuid": "2df4fb5a-0406-49ec-88ac-3d93c55ba86e", "value": "234036551512008534375251c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527258", "to_ids": true, "type": "filename", "uuid": "d253fc3a-b6b6-4093-adce-e7010e124a03", "value": "StockMarketSystem.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527258", "to_ids": false, "type": "text", "uuid": "fb2fc201-353b-4825-9621-fe04cf6ead6f", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.C!dha\nVT Total Detection:25/71\nFirst Submission:2024-02-20T11:55:37.000000+00:00\nLast Submission:2024-02-20T20:58:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531805", "uuid": "8bfcdf92-87de-4c0a-8607-37d8060b80d4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531805", "to_ids": true, "type": "md5", "uuid": "e5f6e224-991d-4964-ab84-1fa1c048ac57", "value": "9f89939b8b3cbf015b85b67974e15ce7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528063", "to_ids": true, "type": "sha1", "uuid": "162b767d-5c03-4ae4-8e5a-8bc69a6e73d5", "value": "5c96ada9b79fa8bd2feb496a8bd6ac7d17287c99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528063", "to_ids": true, "type": "sha256", "uuid": "bd86eca4-13ae-4f7d-8b40-00083d2e2f86", "value": "d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527305", "to_ids": true, "type": "ssdeep", "uuid": "0260617e-eb3e-4f53-b79f-61ad6360417a", "value": "6144:0RGzl3IEVtQaRitBgKGVbuH9uyJCZf346p5U:0RGZ3DVtQa4tBgKGVknJC5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527305", "to_ids": false, "type": "size-in-bytes", "uuid": "773f1055-5e25-4c81-a9ec-2d4745abc240", "value": "243200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527305", "to_ids": true, "type": "vhash", "uuid": "fe06e784-e26d-4fcc-afe5-14237c75d9f6", "value": "325036551512b074ff52dc1a35" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527305", "to_ids": true, "type": "filename", "uuid": "4d141bad-bdc5-43aa-b765-dffc58a7b049", "value": "websocket-sharp.dll" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527305", "to_ids": false, "type": "text", "uuid": "218f06fe-0cbe-44c2-b184-7bdb7483baae", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:0/71\nFirst Submission:2023-12-06T08:54:11.000000+00:00\nLast Submission:2023-12-06T08:54:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531826", "uuid": "18030091-eb82-4298-9a87-a6a6bd69238a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531826", "to_ids": true, "type": "md5", "uuid": "b8f6c35f-5681-40f6-9ea2-70e5d88bae54", "value": "03cfaab422c924a97ae6646085f5e760", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528065", "to_ids": true, "type": "sha1", "uuid": "a1f99506-2312-4a9a-95ca-8af5cf374648", "value": "65242726a8b2628fbd5f69fab99f44eb215dcc8b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528065", "to_ids": true, "type": "sha256", "uuid": "08b64b83-7001-4e3c-9eaf-90c1f8bcc811", "value": "d3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527328", "to_ids": true, "type": "ssdeep", "uuid": "040dbed3-fe6d-476d-8dd0-5ad6f9538783", "value": "384:VQs0ZiJKsWznnAT8mkwjddU5oeuQEESRYI1PVmBV7Rx2HzADnYE4tWAKpTAk2kDB:VQs0EJKsWDAONSRYkQhFT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527328", "to_ids": false, "type": "size-in-bytes", "uuid": "d8a12124-9e3a-4221-8e86-f5ed495d5d75", "value": "23040" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527328", "to_ids": true, "type": "vhash", "uuid": "6e4c5d40-b9ef-435b-8c9e-7ebd30f365af", "value": "224036551511e0831914532b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527328", "to_ids": true, "type": "filename", "uuid": "2472552a-ff3f-4c9d-94ca-5d77a7bb0097", "value": "ClientMNGR.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527328", "to_ids": false, "type": "text", "uuid": "97bdf9e1-57f0-4cbf-a473-75174dc1fc8b", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.B!dha\nVT Total Detection:42/71\nFirst Submission:2025-05-14T10:37:31.000000+00:00\nLast Submission:2025-05-14T10:37:31.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531847", "uuid": "0ff0bdcc-44af-4578-ac4a-155ffbf30901", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531847", "to_ids": true, "type": "md5", "uuid": "be0013cb-cb76-4da4-a266-c60d544ce147", "value": "992bac3c46ce2a8c2d23e65de8c3e1bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528066", "to_ids": true, "type": "sha1", "uuid": "2ea74874-8fc4-48ba-901e-a40a1047e0ec", "value": "6ac8296d314a7bd0b9d508a9aa7bad3926b41e4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528066", "to_ids": true, "type": "sha256", "uuid": "17de2ad0-fa6c-48a1-bd3a-9a864dfeedf6", "value": "dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527392", "to_ids": true, "type": "ssdeep", "uuid": "567e7e13-79e9-41dc-a0db-40d9d719606a", "value": "384:pNw5UkF/NmVJMfGyTt7Mzh/W+Gxj2dZiJq0pzE4+ZAcncpTAMuTvMVBf2:pOlF/dYh/WzKvMC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527392", "to_ids": false, "type": "size-in-bytes", "uuid": "279bc477-3c32-489e-b841-4c491f44490e", "value": "20480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527392", "to_ids": true, "type": "vhash", "uuid": "3734767f-96a6-4db3-8a44-08afab5df28d", "value": "224036551511d0831312532b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527392", "to_ids": true, "type": "filename", "uuid": "e78f09de-b941-40ca-8079-09692c64ac92", "value": "SMNet.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527392", "to_ids": false, "type": "text", "uuid": "6c6a06d3-cedc-432d-964f-c36fed830e99", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.B!dha\nVT Total Detection:42/71\nFirst Submission:2025-04-03T10:47:02.000000+00:00\nLast Submission:2025-04-03T10:47:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531868", "uuid": "21878be4-5069-4657-98bf-c563c1589889", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531868", "to_ids": true, "type": "md5", "uuid": "08df5e6c-6f38-4b88-ae54-f69cb787a748", "value": "6fab47912fc212f5c205773ba1c3699d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528067", "to_ids": true, "type": "sha1", "uuid": "59423d48-7d3b-4bdc-b7db-1f91bd6e1113", "value": "75c8a16af0ea1396e7c9a56a41705d83164ce6e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528067", "to_ids": true, "type": "sha256", "uuid": "74b1158e-77ed-453c-8f68-1a485385dc39", "value": "e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527414", "to_ids": true, "type": "ssdeep", "uuid": "3307653f-0fbe-4ed6-b840-65b439bba4c2", "value": "768:xIB7jtAyEvWn3STq7ujzpaUHnVQXKEniqc7AfD0I9cu1:xI1Zn6jp1crc7ALGa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527414", "to_ids": false, "type": "size-in-bytes", "uuid": "87231c99-1529-46b7-8c9e-4d0c90effc93", "value": "44544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782527414", "to_ids": true, "type": "vhash", "uuid": "94624ac0-4cea-4d79-bcc6-b4504e309192", "value": "244036651511f088372c3070" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527414", "to_ids": true, "type": "filename", "uuid": "dc5aa439-84b6-4620-8391-2dd97d2ec6be", "value": "SMEditor.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527414", "to_ids": false, "type": "text", "uuid": "defe0e3a-c884-4a71-b23e-ef83dbb68b72", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:MSIL/FrostyStash.F!dha\nVT Total Detection:46/71\nFirst Submission:2025-04-03T10:47:02.000000+00:00\nLast Submission:2025-04-03T10:47:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531889", "uuid": "4d886918-9579-4f64-9a14-1d43d9b2c3a8", "Attribute": [ { "category": "Payload delivery", "comment": "RAR archive containing STOCKSTAY", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531889", "to_ids": true, "type": "md5", "uuid": "008440b3-5ab0-470a-87e2-266bda276cf4", "value": "18246e8c5c7a3239b7fbda4bcc3cde01", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RAR archive containing STOCKSTAY", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528068", "to_ids": true, "type": "sha1", "uuid": "183f86e2-d30e-4550-9d4d-a8f03b94f84c", "value": "252a3a2d02af50f24c150b1835f49e4db3133827", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RAR archive containing STOCKSTAY", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528068", "to_ids": true, "type": "sha256", "uuid": "c7e93f48-4de9-4d51-903f-c4dd7cc0bf5a", "value": "e6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782527499", "to_ids": true, "type": "ssdeep", "uuid": "34414b2f-832a-4b53-9ccd-23433ea0573b", "value": "196608:99KseH1g3Jq+yYY+/NaKqTJMqCZ0WxHcXCZVNJG:99+g3J7ytTJMqCZ0LXCZXw" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782527499", "to_ids": false, "type": "size-in-bytes", "uuid": "7f69bf44-92f5-47ea-84aa-6df1362722a9", "value": "7265918" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782527499", "to_ids": true, "type": "filename", "uuid": "a2bd7770-b91b-43fe-9869-83cbd5c094e8", "value": "DriversPrinterGraphic.rar" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782527499", "to_ids": false, "type": "text", "uuid": "4f380a85-4937-4ffc-b15a-239140516ef0", "value": "RAR archive containing STOCKSTAY\r\nType Description: RAR\nMicrosoft: None\nVT Total Detection:3/64\nFirst Submission:2023-09-21T09:45:57.000000+00:00\nLast Submission:2023-09-21T09:45:57.000000+00:00" } ] } ] } }