{ "Event": { "analysis": "1", "date": "2026-06-24", "extends_uuid": "", "info": "[Threat Intel] StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them", "protected": false, "publish_timestamp": "1782459190", "published": true, "threat_level_id": "3", "timestamp": "1782459190", "uuid": "3504a3dc-43fa-49ec-8bfe-e452d73b60d6", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#96f4f6", "local": false, "name": "misp-galaxy:producer=\"Microsoft\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#ecc598", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#d82db7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Query Registry - T1012\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#370063", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Amadey\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Stealc\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Cybercrime\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782356416", "to_ids": false, "type": "link", "uuid": "47f2cdfb-56eb-42c8-b6e3-7549caaa0124", "value": "https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782356416", "to_ids": false, "type": "text", "uuid": "c59765bc-4b9d-4cc7-a18e-e50474fc1586", "value": "Infostealers remain among the most pervasive cybercrime threats, silently harvesting passwords, cookies, and session tokens that enable enterprise breaches. StealC is a malware-as-a-service infostealer written in C++ that collects credentials from browsers, cryptocurrency wallets, messaging applications, email clients, and gaming platforms while functioning as a secondary loader. Amadey operates as a modular backdoor loader active since 2018, delivering downstream payloads including StealC, Lumma Stealer, and ransomware through various backdoor commands. Both operate on commodity rental models where stolen credentials flow through underground markets to access brokers who resell enterprise access. On June 24, 2026, Microsoft's Digital Crimes Unit coordinated with Europol to disrupt over 200 malicious command-and-control domains supporting these operations, using AI-assisted analysis tools including Microsoft Copilot for binary analysis and configuration extraction." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782356416", "to_ids": false, "type": "text", "uuid": "e4de3dd4-9c01-47eb-9cec-9f476200cfbe", "value": "Name: StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them\nAuthor: AlienVault\nAdversary: \nTags: [\"lumma stealer\", \"redline\", \"vidar\", \"access broker\", \"session token\", \"stealc\", \"amadey\", \"credential theft\", \"cybercrime\", \"infostealer\", \"malware-as-a-service\", \"raccoon\"]\nTgtd countries: []\nMlwr families: [\"StealC\", \"Amadey - S1025\", \"Lumma Stealer\", \"RedLine\", \"Raccoon\", \"Vidar\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1033\", \"T1539\", \"T1573.001\", \"T1543.003\", \"T1082\", \"T1005\", \"T1140\", \"T1555\", \"T1055\", \"T1112\", \"T1555.003\", \"T1136.001\", \"T1083\", \"T1057\", \"T1041\", \"T1059.001\", \"T1027\", \"T1012\", \"T1059.003\", \"T1071.001\", \"T1018\", \"T1105\", \"T1021.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457235", "to_ids": true, "type": "domain", "uuid": "8136df8f-a613-452f-89a8-9723502466be", "value": "microsoft-telemetry.at", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457256", "to_ids": true, "type": "url", "uuid": "099cf15d-22eb-4c09-b7aa-3122d6613412", "value": "http://microsoft-telemetry.at/cvdfnaFJBmC0/index.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457277", "to_ids": true, "type": "domain", "uuid": "509f54d0-639a-4d03-81ed-e69bbcb6a829", "value": "svclsc.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457298", "to_ids": true, "type": "url", "uuid": "2fd980b4-eef6-43ad-a2da-02748607c8e4", "value": "http://svclsc.com/ms/index.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457319", "to_ids": true, "type": "domain", "uuid": "8dac1dab-21cc-4fd5-a06b-926b7993cb9a", "value": "goodpanelforgoodjob.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457342", "to_ids": true, "type": "url", "uuid": "61441baa-cd76-4850-bc6b-c7d991064cdd", "value": "https://bartsen284.online/39d9612df78e45b5a4bb.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457363", "to_ids": true, "type": "domain", "uuid": "b02cf307-3b69-4fa7-a6e4-8c2d393a6982", "value": "bartsen284.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457384", "to_ids": true, "type": "hostname", "uuid": "a01844be-6855-45f7-b4fd-1be11017c7ef", "value": "secure.controlpanel.asia", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457405", "to_ids": true, "type": "url", "uuid": "9dd9009d-121d-4f2a-9fd3-4a16fd0b41d8", "value": "http://secure.controlpanel.asia/330311481fe14ab99814.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457426", "to_ids": true, "type": "url", "uuid": "29c9b2f3-a086-41cb-a37b-a3d687c95b0c", "value": "http://cdntestconnect.com/ed54b97a570943999715.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457448", "to_ids": true, "type": "domain", "uuid": "70bff6f7-f292-484c-affe-a3f39772e80b", "value": "cdntestconnect.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457469", "to_ids": true, "type": "url", "uuid": "05d9ea0b-934c-4a02-a794-d311c36bd637", "value": "http://spasopro.at/Lsge63sd3/index.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457490", "to_ids": true, "type": "domain", "uuid": "4f59f91a-12dc-4d43-8a22-6b70738118d4", "value": "spasopro.at", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:26/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782456072", "to_ids": true, "type": "sha256", "uuid": "b5f52673-99e0-42b2-94aa-4f1c2260a428", "value": "30cef3d3d956e83e2c50579cfbe57a49159cccbcc8b0b0422f27d55e1c401ad9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:26/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782456073", "to_ids": true, "type": "sha256", "uuid": "09ee6e9b-e63f-481f-a85b-441b4c944dbd", "value": "43455f1ff4a623b783da670d052eb77eaaacb0c66a9f1e8508f802bf22e8129e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:26/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782456074", "to_ids": true, "type": "sha256", "uuid": "9947c8cc-75ce-4537-a5ad-abd0079bab92", "value": "9383572a30ae5b76fadd0700fbd7a1aa7b05d0b6c8f9cdaef9b30a3e1f65d57d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:26/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782456075", "to_ids": true, "type": "sha256", "uuid": "53c89734-be9b-4fb7-bb77-8cb7f9ce3960", "value": "977b33a9b481cf714946b7d386865cd5d284312aa5ecfa0546c197b1003e1bde", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:26/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782456076", "to_ids": true, "type": "sha256", "uuid": "33613ed8-bc60-40d5-90ca-3627c85d4663", "value": "b7d1f172ff3feafe65d47fd1cbe0cc249316371ae0e1cbe3a7c741c738b3353d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:26/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782456078", "to_ids": true, "type": "sha256", "uuid": "9c0f91c0-2591-4090-a8b0-3d43faa4f9bf", "value": "ca4d4c4fc3e5d5cfa922b898f2d7411f03a446dddb139ba45dfd4f8f0018b64f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457512", "to_ids": true, "type": "url", "uuid": "535f0dda-8e2b-41a0-80cf-03dd0df814b8", "value": "http://bluescry.com/01f96fd710e905ca2326.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457533", "to_ids": true, "type": "url", "uuid": "af640db9-b9b3-4ce4-90f3-6dd32c87ccee", "value": "http://goodpanelforgoodjob.com/hg8jjfSr5hy/index.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457555", "to_ids": true, "type": "url", "uuid": "20113026-eadd-4eb7-bb1a-c27a764489cc", "value": "http://polse.us/62ea47cac2534aa18f74.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457576", "to_ids": true, "type": "url", "uuid": "c61ead75-54a7-4525-988c-9ed590e6e41c", "value": "http://rebustan.top/gd7djkDveE2/index.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457598", "to_ids": true, "type": "url", "uuid": "7c321e84-3083-4604-82d5-8f240a705028", "value": "http://roger99699.xyz/425f1faf4b214434b8a3.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457619", "to_ids": true, "type": "url", "uuid": "49f4e3eb-8d17-4d4a-8e3f-62cf9ebe4a74", "value": "https://neltron-geltron.shop/e396586b99ee49d19cc3.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457640", "to_ids": true, "type": "domain", "uuid": "e03ce95a-141e-44c0-850c-beea8740c42e", "value": "bluescry.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457661", "to_ids": true, "type": "domain", "uuid": "de8be60d-3be0-415a-8ede-bc215b0cd044", "value": "neltron-geltron.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457682", "to_ids": true, "type": "domain", "uuid": "43156ac4-7a28-4384-9a74-c1f6fa7b4799", "value": "polse.us", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457704", "to_ids": true, "type": "domain", "uuid": "42c4a8eb-21ad-40aa-aa93-612d31ab002c", "value": "rebustan.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782457725", "to_ids": true, "type": "domain", "uuid": "4678a522-f68d-4850-b4da-f12087f5cabd", "value": "roger99699.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457746", "uuid": "790b6c84-26c0-4913-a559-9a439dce5121", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457746", "to_ids": true, "type": "md5", "uuid": "b5e9f28e-6b7f-4557-9a5d-62017d823d74", "value": "f89ad7e92c7de6945ce0878e470e388b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456060", "to_ids": true, "type": "sha1", "uuid": "556ea5d8-23c2-40c3-aa95-f189218392f7", "value": "d4f8f562b4a109cccbc0dbdf28bc6d033d7891fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456060", "to_ids": true, "type": "sha256", "uuid": "c792e32f-3c7f-40a7-a1d5-8b8a26be3ed8", "value": "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455114", "to_ids": true, "type": "ssdeep", "uuid": "3d9361a9-7bd2-4ed4-9733-4c7b46d1de66", "value": "24576:nf5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVI1w:nf5xVaU24WGmhkXzFU1w" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455114", "to_ids": false, "type": "size-in-bytes", "uuid": "13f28972-47f6-4b44-963b-bdea0b4bed21", "value": "1087488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455114", "to_ids": true, "type": "vhash", "uuid": "5dd6ac7d-d1e1-4e80-a8b1-890bdc1e523a", "value": "116056655d151560d3z12z97hz27zbaz2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455114", "to_ids": true, "type": "filename", "uuid": "bd3a4a4f-e866-439c-8d81-9db481334df8", "value": "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea.dll" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455114", "to_ids": false, "type": "text", "uuid": "435cf8c3-1669-4fed-926b-df1dc20fc8a6", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Amadey.SGJP!MTB\nVT Total Detection:59/71\nFirst Submission:2026-01-12T12:09:33.000000+00:00\nLast Submission:2026-03-12T12:29:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457768", "uuid": "39bfa372-deba-4e8e-9658-1e0e059908f1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457768", "to_ids": true, "type": "md5", "uuid": "a664a456-c133-4de0-8e27-14af70b3aefd", "value": "a025b901a7979bff2a6c6e4e74c7c76a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456062", "to_ids": true, "type": "sha1", "uuid": "724368ae-0ce0-4789-a029-3ef134cd185d", "value": "72cab50156ba4e2d5f4de97f672d4635e98ddacc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456062", "to_ids": true, "type": "sha256", "uuid": "313c583c-cd6c-48d5-96a1-0f5151d6b8eb", "value": "98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455135", "to_ids": true, "type": "ssdeep", "uuid": "514f2648-4231-4d31-a223-add5dc70f7c7", "value": "6144:j9n6rEDxy8DR5N2TaxKF+C7YYboMB+qTd0/bkmZKfmWGTiFpM6iAOCpvztp4:j9n6rEDx3DoFJ9gqTdkWBiMtp4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455135", "to_ids": false, "type": "size-in-bytes", "uuid": "2f01e099-971e-4dc6-8bb6-e27a0f6ad482", "value": "421888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455135", "to_ids": true, "type": "vhash", "uuid": "d9f23722-c075-468f-81ac-d4dd19fad01c", "value": "045056655d155560c5z5007c7z37z33z31zc1za7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455135", "to_ids": true, "type": "filename", "uuid": "37d6c8f8-9a9b-4ad0-a20f-436992d952af", "value": "98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455135", "to_ids": false, "type": "text", "uuid": "0d4fe43e-2d25-4c3b-b1cf-3e772c45d891", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Amadey.AC!AMTB\nVT Total Detection:55/71\nFirst Submission:2026-03-22T15:58:21.000000+00:00\nLast Submission:2026-03-23T22:10:20.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457789", "uuid": "cfa5418b-cb63-443d-b80a-d2d58eb04064", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457789", "to_ids": true, "type": "md5", "uuid": "06bf498a-1110-4041-bd3a-73e11e468acf", "value": "b1ed5ba271ab4cbb5a0c5121dfce2405", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456063", "to_ids": true, "type": "sha1", "uuid": "4b97a01d-9d09-46e5-8d7e-5f7734242204", "value": "553d38ad0f09e10d20e42d38a71d787f40b415c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456063", "to_ids": true, "type": "sha256", "uuid": "80625bec-8133-4255-bdd0-bba260d16e26", "value": "0215f734867bd71c57ff5c524d8cc670be5b4f1861b2c390cf46d18784a53624", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455157", "to_ids": true, "type": "ssdeep", "uuid": "1fccda5c-6b42-4696-8070-659a3b476249", "value": "12288:TrHqQr5XgvVozsROaYzPIP17vMKrNhYyxBlDetAqxSv:nPgvVqsI0d70eXYyb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455157", "to_ids": false, "type": "size-in-bytes", "uuid": "cc03907b-9c43-4e89-bc55-6677e192db9e", "value": "785920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455157", "to_ids": true, "type": "vhash", "uuid": "59e8301f-f353-4000-a55d-c00aa87b7197", "value": "075066655d555d055az61!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455157", "to_ids": true, "type": "filename", "uuid": "907cbf83-6ebd-4d5e-85a3-fa2e8a4fdeb5", "value": "0215f734867bd71c57ff5c524d8cc670be5b4f1861b2c390cf46d18784a53624.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455157", "to_ids": false, "type": "text", "uuid": "2fcaba26-0264-4eef-830f-d1d098b97ef1", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/StealC.DA!MTB\nVT Total Detection:57/71\nFirst Submission:2026-04-15T14:55:10.000000+00:00\nLast Submission:2026-06-11T23:30:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457811", "uuid": "c9958403-e9bf-4190-9d22-6cced6fbac22", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457811", "to_ids": true, "type": "md5", "uuid": "7a1cceca-a478-48c3-ab00-67af9253a940", "value": "349c233c4e1b6c0724e5ec84df16188d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456065", "to_ids": true, "type": "sha1", "uuid": "dcb104f6-585a-466b-b931-8a7afbce8bb2", "value": "7493c316df2727dd19ef14593fcc014bdb2a0d4b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456065", "to_ids": true, "type": "sha256", "uuid": "21402fa7-7874-4556-828b-b90fd6ae1ddd", "value": "5f5b25b2e35d404034d0d60975cf1ffbc6f141761ec3f4f15d6f7c6213a056f6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455179", "to_ids": true, "type": "ssdeep", "uuid": "1551f346-b13f-496e-b94a-80de89c08b0d", "value": "6144:lRN3057x7t5hvzmYDCnKM/moHc7D6avnEhuY094DcYm3EFmynQOAOZ2KavA5mSd8:lRN3057x7InfAOavnjbO1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455179", "to_ids": false, "type": "size-in-bytes", "uuid": "a69616fa-ea9c-47c8-a02b-8ee631ebc7f7", "value": "473088" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455179", "to_ids": true, "type": "vhash", "uuid": "cb7a843a-8ccc-43d2-b22f-81613e277443", "value": "045036671d1\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455179", "to_ids": true, "type": "filename", "uuid": "089d7ac5-1c91-4597-bf43-97a47e9a4cae", "value": "mkjaegfc.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455179", "to_ids": false, "type": "text", "uuid": "0505e8e5-daa2-431a-b623-fe735163a38b", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Amadey.DC!MTB\nVT Total Detection:49/71\nFirst Submission:2026-05-07T17:19:11.000000+00:00\nLast Submission:2026-05-09T07:26:47.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457832", "uuid": "2e05b3c9-43e3-4a52-b29a-02b7b6278b0c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457832", "to_ids": true, "type": "md5", "uuid": "1f76a180-a968-4498-b185-f8ae9b7395c7", "value": "95b318d953fd939f284efe2be78fe95b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456066", "to_ids": true, "type": "sha1", "uuid": "6e4d51cf-437c-4fd2-a0a8-0d402245911b", "value": "2f3d86e77248b23ef93b7b8c2a9915b2eace5d46", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456066", "to_ids": true, "type": "sha256", "uuid": "04eae94c-47b7-4a0b-9e61-68ac369fcc2d", "value": "2a0f053855da59b3b56812e580d7baeba59fc9493694722aa9e3f121ee3363f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455200", "to_ids": true, "type": "ssdeep", "uuid": "e931ab6d-5b35-43a5-91e3-7d78ed34b5b0", "value": "12288:cAXUMRGu4T4r7O6a9fiCVYuyxBlDetAqxSv+8:cEUPu4qy6kqsYuybX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455200", "to_ids": false, "type": "size-in-bytes", "uuid": "e4b603f1-0322-49ab-8216-8c39d4c0ba8c", "value": "785408" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455200", "to_ids": true, "type": "vhash", "uuid": "36134f75-ea7c-4b19-9bdb-1fdbb7364baf", "value": "075066655d555d055az5f!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455200", "to_ids": true, "type": "filename", "uuid": "953ae5ae-fb72-436d-a630-cb33357df726", "value": "amadey_x64.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455200", "to_ids": false, "type": "text", "uuid": "9b6558b1-d264-4d6c-a355-7d51a9532a50", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/StealC.DA!MTB\nVT Total Detection:53/71\nFirst Submission:2026-06-05T15:17:52.000000+00:00\nLast Submission:2026-06-07T09:39:53.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457853", "uuid": "b81abf37-ee17-43aa-b0fc-b159730606df", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457853", "to_ids": true, "type": "md5", "uuid": "db4d8783-fe13-46dd-b991-beef9fe7aed0", "value": "865b8b893187a33eed58e16b0c63317c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456067", "to_ids": true, "type": "sha1", "uuid": "2612a2db-58db-4e18-b168-b434e9aa782f", "value": "6802522ff06414974d1842d952c6a2dc6db74b93", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456068", "to_ids": true, "type": "sha256", "uuid": "fe10c1c3-2a1e-4436-a0cb-6a27a3e04060", "value": "1246c5b89ab668c1137f377507bc3e266a98e93248382aa026610ae1e764a497", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455222", "to_ids": true, "type": "ssdeep", "uuid": "99941c2b-a0e1-4aa4-b0bc-99c606303a8f", "value": "12288:hP137F+nTlTrtLAyughxRJ2vX8KNvvNG5k5sm3/IDWM7:6TBe8wVGKum3mJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455222", "to_ids": false, "type": "size-in-bytes", "uuid": "52f73bbf-6bc4-4e92-927d-59ca9937bfd9", "value": "421376" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455222", "to_ids": true, "type": "vhash", "uuid": "7c7b3cb6-235c-4c84-b312-5105514963ae", "value": "045056655d155560c5z500827z37z33z31zc1za7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455222", "to_ids": true, "type": "filename", "uuid": "c952733f-8d1c-4815-951d-fe7b8593ec0a", "value": "localfile~" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455222", "to_ids": false, "type": "text", "uuid": "45d791bb-1ef7-42b8-a5fa-220ed07b310b", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Amadey.NMP!MTB\nVT Total Detection:56/71\nFirst Submission:2025-10-19T22:49:08.000000+00:00\nLast Submission:2025-10-21T13:06:32.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457874", "uuid": "bad0ec9b-d954-4145-beb9-20967d1d4052", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457874", "to_ids": true, "type": "md5", "uuid": "30637ce9-c871-4e6f-8179-136bd6961b50", "value": "4cc4a7debf16b064f2151c4593ea5f65", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456069", "to_ids": true, "type": "sha1", "uuid": "43635110-3490-4d23-be1d-5a60d21d8c03", "value": "642aa97b5b3e344ac72ee5de01a304aa69b7ec77", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456069", "to_ids": true, "type": "sha256", "uuid": "6918a90b-a316-4cd3-b27c-d41f048986ec", "value": "8f32456359f209a63adfd24b94235e1727382ac7f7bb7f2bcaf754e721925b64", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455286", "to_ids": true, "type": "ssdeep", "uuid": "dba52ce3-a825-41db-b738-1ee5b29985a4", "value": "12288:TzvOznjd7Dkqya3OJXJyZzNP8GTop8mWwU8yxBlDetAqxSva:GXOqyzJXIPkEWRVnybS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455286", "to_ids": false, "type": "size-in-bytes", "uuid": "74d8a2c2-a7dd-46d9-83d0-cdba328e6201", "value": "779264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455286", "to_ids": true, "type": "vhash", "uuid": "3aefa340-9178-41d0-be25-6f18f5ae6d9f", "value": "0750666d5d555d055018z61jz1jz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455286", "to_ids": true, "type": "filename", "uuid": "bb7926fa-7ab4-4831-bb99-13b0cd908021", "value": "b6rzu5tgc.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455286", "to_ids": false, "type": "text", "uuid": "39cecc2b-e9f1-4a05-a333-a7c556d46287", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Stealc.AI!AMTB\nVT Total Detection:60/71\nFirst Submission:2026-03-25T01:55:56.000000+00:00\nLast Submission:2026-03-25T03:07:06.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457895", "uuid": "bad475c1-a661-4698-b675-3f49cae9bd53", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457895", "to_ids": true, "type": "md5", "uuid": "536525ad-937e-4435-8edc-3e087b607827", "value": "fd946bf4e8ff800f3cff9a4121496bd5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456070", "to_ids": true, "type": "sha1", "uuid": "4d2fa951-b641-4bd7-ae6e-7ee7b380a0df", "value": "2ecdc15e43f091cfe6760a2839856ce2658c29cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456070", "to_ids": true, "type": "sha256", "uuid": "34208626-fab3-49df-96bc-3b735ab44c05", "value": "99507f18c4e61fdb109805404bf6a79ea8ce2fddc590ce48d717e97516ab7e8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455350", "to_ids": true, "type": "ssdeep", "uuid": "760f7d7c-bee2-423b-936b-5f7754eef423", "value": "6144:clIcaE8nTEyaZLw75vfp7/5TfPIS0VXOaWAoLdlUU7evRjsd8lfj1ohUAgLb4fxg:claVaORfp7/lnI0MoLCJAdGoiz4R+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455350", "to_ids": false, "type": "size-in-bytes", "uuid": "4a69ea74-70a2-4790-96e4-e92538bf1053", "value": "530432" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455350", "to_ids": true, "type": "vhash", "uuid": "99881f00-e2ca-41ac-8452-6277a74ca0bc", "value": "055076655d1555155550c5z500877z37z33z31zc1za7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455350", "to_ids": true, "type": "filename", "uuid": "7a17253e-3baf-4b0b-9623-e8aa2ed5f1f4", "value": "uxivvs9.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455350", "to_ids": false, "type": "text", "uuid": "61fa13a5-384a-4ddb-9c67-0e0100bd5864", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Amadey.CCN!MTB\nVT Total Detection:61/71\nFirst Submission:2026-04-30T05:04:44.000000+00:00\nLast Submission:2026-04-30T06:08:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782457916", "uuid": "b309ae91-1178-43fc-b96c-f55e2ba121e0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782457916", "to_ids": true, "type": "md5", "uuid": "f45070ba-1e3f-4713-8b44-9631aa2a4e0c", "value": "ec0638fc550543a12648877d2f97a946", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782456071", "to_ids": true, "type": "sha1", "uuid": "fde071a9-5066-4485-ad10-35ca0797ab0d", "value": "db371a36ff6987d7a12dad85f974e14fa9e55681", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782456071", "to_ids": true, "type": "sha256", "uuid": "bbbe8242-71de-43d1-99aa-2f5b15b3c71e", "value": "d43c988d6f9cb355497696b580621fb1bdb7b6ed6d90f97520ecf6da5a1a41ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782455414", "to_ids": true, "type": "ssdeep", "uuid": "72bd4c6e-db9d-45b4-ba23-a5e3da979abe", "value": "12288:svEoPukV5RUlsvQSaM2Dh3l9lt5/mH3GLkTrk7mOv4F:4503GXGI/kCz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782455414", "to_ids": false, "type": "size-in-bytes", "uuid": "f06bcc45-6262-43e7-aa2b-57ca389102c2", "value": "454656" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782455414", "to_ids": true, "type": "vhash", "uuid": "27b80beb-4535-449b-8111-a7f685a5f0fa", "value": "045056655d151550c5z5007c7z37z33z31zc1za7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782455414", "to_ids": true, "type": "filename", "uuid": "9374c4f1-ca04-4600-a515-be8c996b244c", "value": "d43c988d6f9cb355497696b580621fb1bdb7b6ed6d90f97520ecf6da5a1a41ff.exe" }, { "category": "Other", "comment": "Checked: 26/06/2026\nLast-scan\t: 26/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782455414", "to_ids": false, "type": "text", "uuid": "be18173a-507d-48fe-818f-ebc74a4e632f", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Amadey.AMI!MTB\nVT Total Detection:53/71\nFirst Submission:2025-10-17T16:24:32.000000+00:00\nLast Submission:2025-10-19T01:57:35.000000+00:00" } ] } ] } }