{ "Event": { "analysis": "1", "date": "2026-07-30", "extends_uuid": "", "info": "[Threat Intel] OctLurk and SilkLurk: new Backdoors in Central Asia", "protected": false, "publish_timestamp": "1785648685", "published": true, "threat_level_id": "2", "timestamp": "1785648685", "uuid": "2f79f163-1e6c-4793-b909-4b313f4054bf", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#3000b9", "local": false, "name": "rectifyq:workflow=\"enrichment\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#77a4ec", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#3909cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#07ff3c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#07a4a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#370063", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": "" }, { "colour": "#86e845", "local": false, "name": "misp-galaxy:target-information=\"Afghanistan\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Kazakhstan\"", "relationship_type": "" }, { "colour": "#41c393", "local": false, "name": "misp-galaxy:target-information=\"Kyrgyzstan\"", "relationship_type": "" }, { "colour": "#4ece2e", "local": false, "name": "misp-galaxy:target-information=\"Tajikistan\"", "relationship_type": "" }, { "colour": "#aad0dc", "local": false, "name": "misp-galaxy:target-information=\"Uzbekistan\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Syria\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Pandora\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"PlugX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SilentRaid\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"AnyDesk\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"IMPACKET\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": false, "type": "link", "uuid": "ac430683-25dc-444b-baf2-9ba2ead99b67", "value": "https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": false, "type": "text", "uuid": "0a4448a3-65f7-4d63-bcb9-ebdb9b037bd3", "value": "Two newly identified backdoors, OctLurk and SilkLurk, have been targeting government organizations across Central Asia since January 2025. Victims span Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria, affecting healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement, urban planning, and educational institutions. Both backdoors employ heavily obfuscated loaders customized per victim, using machine-specific data for decryption. They deploy multiple plugins for command execution, file manipulation, credential harvesting, keylogging, network scanning, and remote access. The attackers also utilized LurkProxy for network traffic proxying and deployed additional tools including PlugX, Impacket, FSCAN, and Pandora FMS agents. Analysis indicates both backdoors are operated by the same Chinese-speaking threat actor, though attribution to a specific known group remains unconfirmed. The campaigns demonstrate sophisticated persistence mechanisms and ext..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": false, "type": "text", "uuid": "6b44b705-6fdf-4cdf-a2be-d27c73d21de6", "value": "Name: OctLurk and SilkLurk: new Backdoors in Central Asia\nAuthor: AlienVault\nAdversary: \nTags: [\"silklurk\", \"cyber-espionage\", \"octlurk\", \"impacket\", \"government targeting\", \"plugx\", \"central asia\", \"lurkproxy\", \"fscan\", \"credential harvesting\"]\nTgtd countries: [\"Afghanistan\", \"Kazakhstan\", \"Kyrgyzstan\", \"Syrian Arab Republic\", \"Tajikistan\", \"Uzbekistan\"]\nMlwr families: [\"OctLurk\", \"SilkLurk\", \"LurkProxy\", \"PlugX - S0013\", \"Thoper\", \"TVT\", \"DestroyRAT\", \"Sogu\", \"Kaba\", \"Korplug\", \"Impacket\", \"FSCAN\"]\nAttack_ids: [\"T1053.005\", \"T1056.001\", \"T1114\", \"T1543.003\", \"T1119\", \"T1005\", \"T1140\", \"T1055\", \"T1560\", \"T1555.003\", \"T1003.001\", \"T1090\", \"T1083\", \"T1059.001\", \"T1027\", \"T1573\", \"T1132\", \"T1059.003\", \"T1071.001\", \"T1021.001\"]\nIndustries: [\"Government\", \"Healthcare\", \"Education\"]" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "193c2211-dd9e-4211-8184-75a18acd79d6", "value": "confbase.mdpsupport.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "a6829653-0320-4d61-99a1-9b42a70d2266", "value": "fm01.clouddevicemetrics.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "9bb074f8-b163-48dd-aa00-2e3a3dcdfc43", "value": "ssl.blsouqs.com" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644908", "to_ids": true, "type": "md5", "uuid": "eedf7a9a-8756-4405-b4a0-337244c9aee6", "value": "082d49ef9f14e6811d68c7e0e82e5069", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644929", "to_ids": true, "type": "md5", "uuid": "8bb2acfb-dde4-42a9-aaad-af4a15c4a085", "value": "1415a78b75de7db4ba3d1e61d7db4501", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644950", "to_ids": true, "type": "md5", "uuid": "8dca2d61-c336-4267-a8bc-7ec657b4184d", "value": "2a571f6cee42a17d873f4c942649813f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644971", "to_ids": true, "type": "md5", "uuid": "81c59df8-6491-4242-b97d-a6bf344ce44c", "value": "2f18472866f38c1e1c2c5c14b9a6ab56", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785644992", "to_ids": true, "type": "md5", "uuid": "0b789edf-3fec-4efe-90eb-99e414327c0c", "value": "32a5985543433a4f60da2fafd873b927", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645013", "to_ids": true, "type": "md5", "uuid": "c381d649-ab69-4c08-887b-1a96ee897bd1", "value": "37dc84e4bcad92fa28f1e7778d088283", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645034", "to_ids": true, "type": "md5", "uuid": "ced2086c-d076-4ccb-b779-39ddc0008b7f", "value": "3c9a1ba8e0c7475706adc6376e9d7b7c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645055", "to_ids": true, "type": "md5", "uuid": "e139d7be-202d-4c41-bd73-0e7eeb6201b8", "value": "45cf5916fab4272a1313c26e67aa9220", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645075", "to_ids": true, "type": "md5", "uuid": "c1fdba56-5e06-490d-9c0a-6dbde8d35fce", "value": "4e6d5c4770d5a822d7fcce6a74f7ad73", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645096", "to_ids": true, "type": "md5", "uuid": "707a0dac-6e8e-4f4c-9947-a42cc33e3095", "value": "5e26df131ff0a679a0a2699b723b46e3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645117", "to_ids": true, "type": "md5", "uuid": "31c8240f-9fd2-43e7-8e79-9a398de01c64", "value": "6ecf84fb18f6747ed08d7598364d853a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645160", "to_ids": true, "type": "md5", "uuid": "f58215e0-2511-4400-870b-e14e4bed30d5", "value": "8269d6ba1b6842f9152c90cf7add9b93", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645181", "to_ids": true, "type": "md5", "uuid": "58836459-2a84-4579-b80d-b06047654747", "value": "a0cc7accc79abb0287aaba825d0351f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645202", "to_ids": true, "type": "md5", "uuid": "e63889ff-5c20-458f-b321-6395112531d2", "value": "a4d550a3ba0cd073fe3839b99d98a7a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645223", "to_ids": true, "type": "md5", "uuid": "6b033b36-17af-4ac6-bcc3-278c6909435c", "value": "a56cce62930a6bee80d679b4c495a340", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645244", "to_ids": true, "type": "md5", "uuid": "8eb643c8-274a-4132-a67e-50c432f9597e", "value": "b874123a80fc4f40e06872b9cb54ebc6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645265", "to_ids": true, "type": "md5", "uuid": "b0796f9b-1541-4537-8587-ef0b8537986c", "value": "be4731c09734da2e8eb6814a9c82f266", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645286", "to_ids": true, "type": "md5", "uuid": "a017d820-2adf-4c09-9d50-fa7311968173", "value": "ef59aad625eebda8650aec5820d6ce69", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785645307", "to_ids": true, "type": "md5", "uuid": "bbb4245f-0179-49b6-8409-fd157496e70e", "value": "f4578e869a735cfad691f927bae3e638", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "038d73e6-3da0-4a05-a1f4-0acb453bada1", "value": "about.blsouqs.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "209dcba3-2f00-48fd-9cb8-adb4c9edf4c5", "value": "api2.annoyingremote.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "188f532c-e93a-4bcc-9357-eb33146da2a4", "value": "ctyuhjerf.kozow.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "f0271962-e19c-40d7-966b-b0f8109cbc98", "value": "digital.leroymerling.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "c203a8db-b9d3-4a21-9f0e-ee3961730203", "value": "dns.multitoconference.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "fb839d48-131e-44ea-a172-441f124e3126", "value": "dns.ssentialserv.xyz" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "078659cf-2f6c-4428-9950-cbdbacb931af", "value": "gycudore.kozow.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "5b353e0b-2029-4eb1-b210-7c2050efbf4e", "value": "rgnojb.casacam.net" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "bc9aa04d-5620-45c9-b93d-e4466940ba84", "value": "tj.tajikistandip.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "94a81f26-3a93-4230-a6cb-2b50bcba8ee9", "value": "tyhbgtyuj.gleeze.com" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "75e118f7-2902-4deb-ae53-b451ace6817e", "value": "uyhvfredc.accesscam.org" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785553222", "to_ids": true, "type": "hostname", "uuid": "5b1e5e43-bfff-4063-9510-a4025450e28c", "value": "wedfcvbn.gleeze.com" }, { "category": "Network activity", "comment": "\"...research, the domain was resolving to the address 154[.]196[.]162[.]76 which is used as a LurkProxy C2 server. After co...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785633801", "to_ids": true, "type": "ip-dst", "uuid": "0685df7a-9fbd-41a4-9fab-4d39293b8135", "value": "154.196.162.76" }, { "category": "Network activity", "comment": "\"...domain gycudore[.]kozow[.]com and the IP address 64[.]7[.]198[.]130. Below are the extracted configuration fields fro...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785648673", "to_ids": true, "type": "ip-dst", "uuid": "17bfac01-df64-4090-a8ff-a41522517e79", "value": "64.7.198.130", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "OctLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648674", "to_ids": true, "type": "ip-dst", "uuid": "0e8763b5-bfd5-4025-8150-e589f4886e61", "value": "45.138.157.165", "Tag": [ { "colour": "#35cda0", "local": false, "name": "asn:asn=\"33993\"", "relationship_type": "" }, { "colour": "#53d4e2", "local": false, "name": "asn:as-owner=\"UFO-AS\"", "relationship_type": "" }, { "colour": "#fdd220", "local": false, "name": "asn:as-country=\"RU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilkLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648675", "to_ids": true, "type": "ip-dst", "uuid": "343e80bb-c984-4fa7-b380-aa8ccfa10b89", "value": "95.179.210.138", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilkLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648676", "to_ids": true, "type": "ip-dst", "uuid": "a1ecdb23-8b35-4076-9e91-8ca8e6b5f852", "value": "45.77.136.228", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilkLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648678", "to_ids": true, "type": "ip-dst", "uuid": "a98acc71-7b66-4e02-a438-01bdc80d0193", "value": "95.179.141.26", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilkLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648679", "to_ids": true, "type": "ip-dst", "uuid": "298737fe-57e5-45b3-8a90-d9ee13a1524a", "value": "45.32.152.50", "Tag": [ { "colour": "#133012", "local": false, "name": "asn:asn=\"20473\"", "relationship_type": "" }, { "colour": "#650025", "local": false, "name": "asn:as-owner=\"AS-VULTR\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilkLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648680", "to_ids": true, "type": "ip-dst", "uuid": "b7bf4a10-0751-4391-982a-c18c9af89a10", "value": "212.11.39.138", "Tag": [ { "colour": "#e6065f", "local": false, "name": "asn:asn=\"984\"", "relationship_type": "" }, { "colour": "#348df3", "local": false, "name": "asn:as-owner=\"OWS-NETWORK\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilkLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648682", "to_ids": true, "type": "ip-dst", "uuid": "90fa74ff-64c5-4915-9936-5dea6a8f8273", "value": "195.86.120.2", "Tag": [ { "colour": "#e6065f", "local": false, "name": "asn:asn=\"984\"", "relationship_type": "" }, { "colour": "#348df3", "local": false, "name": "asn:as-owner=\"OWS-NETWORK\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilkLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785633854", "to_ids": true, "type": "ip-dst", "uuid": "3cddec1b-78b8-4d57-a83a-841345de9b2a", "value": "154.196.187.73" }, { "category": "Network activity", "comment": "SilkLurk C2", "deleted": false, "disable_correlation": false, "timestamp": "1785648685", "to_ids": true, "type": "ip-dst", "uuid": "3e8cd2f8-4c81-4296-a640-d0cf00310918", "value": "45.61.149.112", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785644801", "uuid": "7161bd9a-1ab0-4330-a67a-b77d370118ae", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "md5", "timestamp": "1785644800", "to_ids": true, "type": "md5", "uuid": "29e8dfd1-3326-4027-94d5-6aa3d7eb345a", "value": "62944e26b36b1dcace429ae26ba66164", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "sha1", "timestamp": "1785644800", "to_ids": true, "type": "sha1", "uuid": "9bf09cca-dfa0-4aea-bf11-5ee665102682", "value": "2616da1697f7c764ee7fb558887a6a3279861fac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "sha256", "timestamp": "1785644801", "to_ids": true, "type": "sha256", "uuid": "77fce249-22ca-4bd7-b53a-54adeb1d0788", "value": "f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "text", "timestamp": "1785644799", "to_ids": false, "type": "text", "uuid": "8379d0f1-cad6-45c5-a5b3-e8f4ed4575ad", "value": "Type Description: Win32 EXE\nOriginal name: dot1xtra.exe\nVerified: Signed\nSigning date: 05:42 AM 02/02/2009\nSigners: Symantec Corporation; VeriSign Class 3 Code Signing 2004 CA; VeriSign Class 3 Public Primary CA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 3/75\nFirst Seen In The Wild: 2013-05-04T10:00:45+00:00\nFirst Submission: 2009-05-30T17:58:55+00:00\nLast Submission: 2026-03-22T08:34:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "creation-time", "timestamp": "1785644800", "to_ids": false, "type": "datetime", "uuid": "87fa52a6-1d59-42d4-9459-ac2dbf6bed2b", "value": "2009-02-02T05:38:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "ssdeep", "timestamp": "1785644799", "to_ids": true, "type": "ssdeep", "uuid": "60b7a6c4-67d5-44f8-abc6-58e2aebed702", "value": "1536:To0lZUH+MeI1M04n45PFmsMfgiqf5YXneJ07soW8VD5cN:TOw4jYgiqf5yh7sl8VF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1785644799", "to_ids": false, "type": "size-in-bytes", "uuid": "39027096-ac4d-4d22-9180-17ca2f30b383", "value": "107848" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "vhash", "timestamp": "1785644799", "to_ids": true, "type": "vhash", "uuid": "f7b2f39a-20d7-43fa-873a-e65735d2b3f6", "value": "015046655d1550b8z61hz12z17fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2009-05-30T17:58:55+00:00", "last_seen": "2026-03-22T08:34:36+00:00", "object_relation": "filename", "timestamp": "1785644799", "to_ids": true, "type": "filename", "uuid": "73d34ae6-9851-43a3-ba55-e37459e1169c", "value": "dot1xtra.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785644824", "uuid": "24a4ae03-642b-4cb5-b374-d3e714873f56", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "object_relation": "md5", "timestamp": "1785644823", "to_ids": true, "type": "md5", "uuid": "ac4b2328-22ba-484f-b63e-8d24c8952d96", "value": "cf903e4a1629aa0582fd0363b5786676", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "object_relation": "sha1", "timestamp": "1785644823", "to_ids": true, "type": "sha1", "uuid": "57875287-6590-40b9-b467-cee0460a1400", "value": "bd5f3da317e449334b5c059a2d65c1fa945cf408", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "object_relation": "sha256", "timestamp": "1785644824", "to_ids": true, "type": "sha256", "uuid": "f1af6264-ab85-45b2-96cc-6c02f538e96e", "value": "7b9efc7ef8957411cdd22582ce4bfb3a5f76d9c91cdb7e36bf85c9785a2480e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "object_relation": "text", "timestamp": "1785644822", "to_ids": false, "type": "text", "uuid": "472dedd9-c838-4119-866b-66a33fb317f6", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 52/75\nFirst Seen In The Wild: 2024-05-29T14:01:23+00:00\nFirst Submission: 2024-05-16T06:11:04+00:00\nLast Submission: 2026-07-30T08:36:12+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "object_relation": "ssdeep", "timestamp": "1785644822", "to_ids": true, "type": "ssdeep", "uuid": "f157d797-9417-42de-856f-e2d4e5152b0a", "value": "196608:d7YwHfueyh4imo5Yb/mFYTJ0AfD0ghVg23qcdO4A5hTq:d5uDXYTmKJ0Ab0gF3qZZnT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "object_relation": "size-in-bytes", "timestamp": "1785644822", "to_ids": false, "type": "size-in-bytes", "uuid": "f5dd8cb7-f66f-4406-be26-498ef6189a24", "value": "7266304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "object_relation": "vhash", "timestamp": "1785644822", "to_ids": true, "type": "vhash", "uuid": "f91698f7-87a3-415c-8c9c-b88aa43eddf1", "value": "07603e0f7d1bz4!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-05-16T06:11:04+00:00", "last_seen": "2026-07-30T08:36:12+00:00", "object_relation": "filename", "timestamp": "1785644822", "to_ids": true, "type": "filename", "uuid": "f34b7d0a-f3d2-48c1-9679-1d2ca6ad6743", "value": "fscan.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785644846", "uuid": "b8ba9bbf-a8e8-4529-bda0-9a9818ce7186", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "md5", "timestamp": "1785644845", "to_ids": true, "type": "md5", "uuid": "0051e6da-0aec-4093-929d-eaedb0d8320a", "value": "9a1dd1d96481d61934dcc2d568971d06", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "sha1", "timestamp": "1785644845", "to_ids": true, "type": "sha1", "uuid": "9895f8a8-bd4a-4c5c-b16f-ae1e34b2e3de", "value": "f136ef9bf8bd2fc753292fb5b7cf173a22675fb3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "sha256", "timestamp": "1785644846", "to_ids": true, "type": "sha256", "uuid": "d2449cd6-3806-4810-81a4-cefd8501f05c", "value": "8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "text", "timestamp": "1785644844", "to_ids": false, "type": "text", "uuid": "7f95727b-249d-4875-9ee1-876a5347cedf", "value": "Type Description: Win32 EXE\nOriginal name: 7z.exe\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/75\nFirst Seen In The Wild: 2023-07-04T17:48:43+00:00\nFirst Submission: 2023-06-20T10:40:11+00:00\nLast Submission: 2026-08-01T13:03:04+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "creation-time", "timestamp": "1785644845", "to_ids": false, "type": "datetime", "uuid": "9f9d4bde-0157-4083-81fa-46d48ed878f8", "value": "2023-06-20T08:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "ssdeep", "timestamp": "1785644844", "to_ids": true, "type": "ssdeep", "uuid": "c88b5c57-086e-4806-b871-cb376a29e6bf", "value": "6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "size-in-bytes", "timestamp": "1785644844", "to_ids": false, "type": "size-in-bytes", "uuid": "06d8f232-95d3-4751-a6c4-c9966acdf02b", "value": "557056" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "vhash", "timestamp": "1785644844", "to_ids": true, "type": "vhash", "uuid": "66061152-fae7-4b35-8f05-da522982b910", "value": "055066655d1555551088z4d247z7bz1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-06-20T10:40:11+00:00", "last_seen": "2026-08-01T13:03:04+00:00", "object_relation": "filename", "timestamp": "1785644844", "to_ids": true, "type": "filename", "uuid": "2f8f8e9a-8db7-4f20-8316-f4ce2a27042f", "value": "7z.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785644867", "uuid": "54da4d7f-b94c-46c2-8526-8d396b3a8a4a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "md5", "timestamp": "1785644867", "to_ids": true, "type": "md5", "uuid": "b3e87e39-ca50-4ca1-90e8-46392a1b1f85", "value": "18dc8bff47cc282508354771d0c8cf8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "sha1", "timestamp": "1785644867", "to_ids": true, "type": "sha1", "uuid": "d0d1063d-2f49-4f79-83c9-33556a466763", "value": "cc5cc2546d3ea8e27250cc4bec24f6ca13caf341", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "sha256", "timestamp": "1785644867", "to_ids": true, "type": "sha256", "uuid": "b4092158-0efe-4942-8c1b-05a43b455411", "value": "23b122deea347dbe2407c1542c1cc6caaafca537eb5d1950a4ed7c8a69395dbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "text", "timestamp": "1785644866", "to_ids": false, "type": "text", "uuid": "36edf751-80e5-4c12-81f8-f6c770d9f63f", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 10:01 AM 03/20/2025\nSigners: win.rar GmbH; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/75\nFirst Seen In The Wild: 2025-07-01T11:16:05+00:00\nFirst Submission: 2025-03-24T08:13:29+00:00\nLast Submission: 2026-07-14T15:07:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "creation-time", "timestamp": "1785644866", "to_ids": false, "type": "datetime", "uuid": "3a87f42f-ff08-4ffc-9431-72fb4352b606", "value": "2025-03-20T10:00:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "ssdeep", "timestamp": "1785644866", "to_ids": true, "type": "ssdeep", "uuid": "007b9be1-5169-43c6-9a82-427844739fd3", "value": "12288:RCL+bHfyT2J6rqn6ZlvBcqK5XAMbaZ4xl/yoUO4blha6r7wO:AybHfy2wbl3nWi4x1yhRTr7wO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1785644866", "to_ids": false, "type": "size-in-bytes", "uuid": "73511116-3781-410e-b073-de112c2afd81", "value": "812176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "vhash", "timestamp": "1785644866", "to_ids": true, "type": "vhash", "uuid": "4f742ffe-58f1-4acb-880e-0b0540ce9b62", "value": "085066655d5555155158z8c7z2035z53zbfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-03-24T08:13:29+00:00", "last_seen": "2026-07-14T15:07:30+00:00", "object_relation": "filename", "timestamp": "1785644866", "to_ids": true, "type": "filename", "uuid": "5cbca27b-803c-4cf7-a19a-7da967ef287c", "value": "Command line RAR" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785645119", "uuid": "87998ce7-06bd-4b72-b9f2-3d61acd3db3b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "md5", "timestamp": "1785645119", "to_ids": true, "type": "md5", "uuid": "e2df12d0-42f8-49ae-bbdd-f979a44c05e2", "value": "7c2f64461bb519c6cbf1fc687675514c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "sha1", "timestamp": "1785645119", "to_ids": true, "type": "sha1", "uuid": "1d0cc8ec-0f6e-46e4-bbf1-b692570f5309", "value": "a6b9e7721c6ee95be026054f5a62159329e80629", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "sha256", "timestamp": "1785645119", "to_ids": true, "type": "sha256", "uuid": "ece5efda-34b1-41cd-a696-dd4d478b677e", "value": "9ea2f55c1c91d04820f5082cf113c73c6320b157baa98d69654117cfc8458296", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 30/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "text", "timestamp": "1785645118", "to_ids": false, "type": "text", "uuid": "832503a8-1c3d-4229-98ba-706a45fbfa4c", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 44/75\nFirst Submission: 2026-06-18T12:59:57+00:00\nLast Submission: 2026-06-18T12:59:57+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "creation-time", "timestamp": "1785645118", "to_ids": false, "type": "datetime", "uuid": "8a644ff8-a21c-4e2b-873c-c0af63233b42", "value": "2023-10-30T06:42:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "ssdeep", "timestamp": "1785645118", "to_ids": true, "type": "ssdeep", "uuid": "20de4358-c836-4044-b372-3944b83ed4d2", "value": "3072:jRZjZErNWyWzX6fL0XBHig9AR0/izi7A3TjDhR27F2Ub/XoWchk:z9XBHid2/i3TjDz2C9k" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1785645118", "to_ids": false, "type": "size-in-bytes", "uuid": "1f804d31-a8b5-4dc2-a054-06dede319f76", "value": "208896" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "vhash", "timestamp": "1785645118", "to_ids": true, "type": "vhash", "uuid": "b7c2da91-045b-4534-8a8a-a9cced929dc2", "value": "125066655d1555155028z4cnz1ez2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-18T12:59:57+00:00", "last_seen": "2026-06-18T12:59:57+00:00", "object_relation": "filename", "timestamp": "1785645118", "to_ids": true, "type": "filename", "uuid": "4fafcdb3-ae3f-4b08-9d44-b5a178b742d4", "value": "mscastrac.dll" } ] } ] } }