{ "Event": { "analysis": "1", "date": "2026-05-26", "extends_uuid": "", "info": "[Threat Intel] From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities", "protected": false, "publish_timestamp": "1780368419", "published": true, "threat_level_id": "3", "timestamp": "1780368418", "uuid": "375002f5-d1e7-4371-93ed-5a833e8595b0", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#96f4f6", "local": false, "name": "misp-galaxy:producer=\"Microsoft\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#7eb739", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Msiexec - T1218.007\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#82a529", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Shortcut Modification - T1547.009\"", "relationship_type": "" }, { "colour": "#f4b62b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#4bc785", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#1a0065", "local": false, "name": "rectifyq:topic=\"crypto-related\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1779937212", "to_ids": false, "type": "link", "uuid": "171ca9f6-6d1d-4af0-aaa5-6411ed4a2a09", "value": "https://www.microsoft.com/en-us/security/blog/2026/05/26/poisoned-search-results-gpu-mining-cryptojacking-campaign-abusing-screenconnect-microsoft-net-utilities/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1779937212", "to_ids": false, "type": "text", "uuid": "742cd4de-034a-4005-9490-010052312f93", "value": "Microsoft Defender Experts identified an active cryptojacking campaign leveraging AI-assisted delivery mechanisms alongside traditional SEO poisoning. Attackers create fake download sites impersonating trusted utilities like CrystalDiskInfo, HWMonitor, and FurMark, targeting users with high-performance GPUs. Victims download ZIP archives containing legitimate executables bundled with malicious DLLs that establish persistence via ScreenConnect remote access tools. The operation employs sophisticated techniques including DLL sideloading, process hollowing into Microsoft-signed .NET binaries, and comprehensive defense evasion. Beyond cryptocurrency mining, the campaign establishes persistent remote access that could enable data theft, lateral movement, or ransomware deployment. The threat actors deliberately target PC enthusiasts and hardware-focused users most likely to own discrete GPUs suitable for profitable mining operations." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1779937212", "to_ids": false, "type": "text", "uuid": "baff5bdb-1a97-4cc0-bb33-d205d4d864d7", "value": "Name: From poisoned search results to GPU mining: A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities\nAuthor: AlienVault\nAdversary: \nTags: [\"process hollowing\", \"cryptojacking\", \"seo poisoning\", \"screenconnect abuse\", \"gpu mining\", \"simplerunpe\", \"dll sideloading\"]\nTgtd countries: []\nMlwr families: [\"SimpleRunPE\", \"RuntimeHost\"]\nAttack_ids: [\"T1053.005\", \"T1036.005\", \"T1497.001\", \"T1082\", \"T1218.007\", \"T1140\", \"T1219\", \"T1547.009\", \"T1497.003\", \"T1112\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1055.012\", \"T1027\", \"T1573\", \"T1189\", \"T1071.001\", \"T1574.002\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "Hosts malicious ZIP files", "deleted": false, "disable_correlation": false, "timestamp": "1780299929", "to_ids": true, "type": "hostname", "uuid": "e514f408-ca88-4671-828e-c0d7a1f19eb6", "value": "direct-download.gleeze.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "ScreenConnect client communicates to this attacker controlled IP", "deleted": false, "disable_correlation": false, "timestamp": "1780299950", "to_ids": true, "type": "ip-dst", "uuid": "322bbd97-884d-41d3-b7c6-5a94cc4f6fca", "value": "193.42.11.108", "Tag": [ { "colour": "#a6d82c", "local": false, "name": "asn:asn=\"58212\"", "relationship_type": "" }, { "colour": "#9bbf19", "local": false, "name": "asn:as-owner=\"DATAFOREST\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 from hollowed binary", "deleted": false, "disable_correlation": false, "timestamp": "1780299972", "to_ids": true, "type": "hostname", "uuid": "1e692ab0-f75e-4e4c-b855-745eb8028118", "value": "minemine.gleeze.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Hosts malicious ZIP files", "deleted": false, "disable_correlation": false, "timestamp": "1780299993", "to_ids": true, "type": "hostname", "uuid": "fe210692-afcb-4526-9b39-7de87c55e04f", "value": "start-download.gleeze.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 from hollowed binary", "deleted": false, "disable_correlation": false, "timestamp": "1780300014", "to_ids": true, "type": "url", "uuid": "ee8f7637-59c4-4ef5-b5da-fd20a0155ae4", "value": "http://minemine.gleeze.com:8443/ws", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Hosts malicious ZIP files", "deleted": false, "disable_correlation": false, "timestamp": "1780300035", "to_ids": true, "type": "hostname", "uuid": "c56d73a6-babb-4607-bf05-a03578edbf29", "value": "direct-downloads.giize.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Hosts malicious ZIP files", "deleted": false, "disable_correlation": false, "timestamp": "1780300056", "to_ids": true, "type": "hostname", "uuid": "01b9aec9-5727-44cf-b4a9-562aacf15c6c", "value": "free-download.giize.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Host that ScreenConnect client connects to", "deleted": false, "disable_correlation": false, "timestamp": "1780300077", "to_ids": true, "type": "domain", "uuid": "266b30ee-6db2-44fd-be90-2cc565d37c78", "value": "directdownload.icu", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 from hollowed binary", "deleted": false, "disable_correlation": false, "timestamp": "1780300099", "to_ids": true, "type": "url", "uuid": "ad66a43a-215a-4a51-81f7-a259be9ec2bf", "value": "wss://minemine.gleeze.com:8443/ws", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300121", "uuid": "118a7fce-2fd6-4e17-a896-25c67234601a", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300121", "to_ids": true, "type": "md5", "uuid": "5c74d308-8039-4980-b866-53ae67bfca30", "value": "661d4551df34661f3ffc565e2f4ecdbc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298385", "to_ids": true, "type": "sha1", "uuid": "51d2c356-a6f0-45bb-988a-42ab162d8ff8", "value": "017830597704acd90fb171f3025bc6f28745da57", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298385", "to_ids": true, "type": "sha256", "uuid": "66345141-2caf-40e0-b3bc-0991a083e622", "value": "1b2555b09ac62164638f47c8272beb6b0f97186e37d3a54cb84c723ff7a2eee5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295792", "to_ids": true, "type": "ssdeep", "uuid": "991f0a9d-9269-4572-8f08-bd7340e5c77b", "value": "384:WUe4BoTNOSlV9E6IoGyL1zscjCAplEnQRaRPOPrbikBXQ3hUlUw/URgVFfPO:8AjPlaQcDmPOPFBXQRUB/r" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295792", "to_ids": false, "type": "size-in-bytes", "uuid": "44416094-31c8-487a-958b-af233c82120b", "value": "31744" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295792", "to_ids": true, "type": "vhash", "uuid": "e69521c5-f34b-4aee-a2d7-eafbe83e884c", "value": "1340a66d1515151c05151az111d&z6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295792", "to_ids": true, "type": "filename", "uuid": "727f25ce-b06b-43d9-ad98-3fe8a58dfd64", "value": "autorun.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295792", "to_ids": false, "type": "text", "uuid": "06b3f53c-c58e-4cea-ac65-84a0d3db9067", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLSideLoad.MKE!MTB\nVT Total Detection:36/71\nFirst Submission:2026-03-21T14:36:28.000000+00:00\nLast Submission:2026-04-24T22:49:08.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300142", "uuid": "f2bdd768-b9e4-48fd-8b29-876096d088ae", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300142", "to_ids": true, "type": "md5", "uuid": "7dd83215-a193-4ace-a1d7-aa1244e58c94", "value": "2e452c60147ab699f596e92fdbc24279", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298387", "to_ids": true, "type": "sha1", "uuid": "9e589248-9eea-4464-b858-40b0076768f3", "value": "4c2c8b00b2fe2aaa51dd224281e3909740c8bbe7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298387", "to_ids": true, "type": "sha256", "uuid": "d01130d3-5c17-4e92-a349-8dbcf546ae4d", "value": "062bb28765fbaa11f8cc341fa16e2c7f942a122d929cb41f4a0f755b4429f246", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295814", "to_ids": true, "type": "ssdeep", "uuid": "9c0651d2-bcd7-4d85-bf9a-7b312ad2cdb4", "value": "768:XHABkO9TFcxiwgLPOPNOBXQhb3sfSr9i88:3ABDTasPTBXQhwSj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295814", "to_ids": false, "type": "size-in-bytes", "uuid": "d76af7ad-908c-44d6-9822-fb7fb8511203", "value": "31744" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295814", "to_ids": true, "type": "vhash", "uuid": "a96adcef-8afc-4bd0-b847-468845addc20", "value": "1340a66d1515151c05151az121a&z6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295814", "to_ids": true, "type": "filename", "uuid": "c9b99d11-fb59-41e3-af91-44387e7e17f1", "value": "autorun_new.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295814", "to_ids": false, "type": "text", "uuid": "8d895c3f-188c-488b-8331-3ac38f5cad2c", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLSideLoad.MKE!MTB\nVT Total Detection:37/71\nFirst Submission:2026-03-21T22:03:35.000000+00:00\nLast Submission:2026-03-21T22:03:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300163", "uuid": "12dad182-cf9d-43b9-ae06-a6a9a8b9e7f3", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300163", "to_ids": true, "type": "md5", "uuid": "a1910540-4664-4794-9991-53fbd3ba41a4", "value": "9bfbf2a722983e831e1893a8a548db2f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298388", "to_ids": true, "type": "sha1", "uuid": "59b94aff-d1c5-481d-8483-e8c5d23d8b4e", "value": "d134ebf3501bbb4eeeca49c325f7fb85aaaacf3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298388", "to_ids": true, "type": "sha256", "uuid": "a9830ad2-c9cc-4a0f-9c75-3898c65309cd", "value": "16562974deec80e41ef57a71a6de8c03ceb393005fb1432f8d9d82c61294ef8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295836", "to_ids": true, "type": "ssdeep", "uuid": "d9c62062-c2b3-4f83-900e-4dc569e394b6", "value": "768:ooABkO9TFcxiwgLPOPNOBXQhbGsfSW9iHs:fABDTasPTBXQhLSh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295836", "to_ids": false, "type": "size-in-bytes", "uuid": "982f5498-84cb-4179-a5aa-643b53708abf", "value": "31744" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295836", "to_ids": true, "type": "vhash", "uuid": "434f2a3b-31a4-43f0-963e-799356b168d8", "value": "1340a66d1515151c05151az121a&z6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295836", "to_ids": true, "type": "filename", "uuid": "db726302-3dc0-49be-b391-0d6a0d2c2ee5", "value": "autorun.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295836", "to_ids": false, "type": "text", "uuid": "c19e24af-9630-4621-b940-a5154652f81d", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLSideLoad.MKE!MTB\nVT Total Detection:34/71\nFirst Submission:2026-03-20T23:42:01.000000+00:00\nLast Submission:2026-03-21T03:13:20.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300185", "uuid": "7357f370-1a93-4d85-8d77-2a68b66e2efc", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300185", "to_ids": true, "type": "md5", "uuid": "34fb224e-07ac-4c5b-b998-311f4b8d5bf1", "value": "4125681f9276487f4318c7ce9c8b6786", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298389", "to_ids": true, "type": "sha1", "uuid": "3293c4cd-50ed-40b0-a320-ad4b9b3eba11", "value": "bbeaac7ef00268bd5cc583e26624e760085581dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298389", "to_ids": true, "type": "sha256", "uuid": "0f9922f9-93c7-48aa-806c-7de71b9830e9", "value": "2ee93ccbcd49ed94c65dcf52e7dcb8f0fa0a443ca24c0e0c7f79152efba657b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295857", "to_ids": true, "type": "ssdeep", "uuid": "51b2f37c-c3d8-4c83-aa65-b8f5722d7f05", "value": "48:q/sQiksOsIASKXhYhDGVcv9YCySGTYNPihRM+l8cp4upyVI:a1JKYGJSpNPiHnl7NyVI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295857", "to_ids": false, "type": "size-in-bytes", "uuid": "104358b7-6d96-4d51-aaa8-b97e6fcd9c9a", "value": "4096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295857", "to_ids": true, "type": "vhash", "uuid": "4dc10eb9-0f58-4d8a-9642-08cf54e18811", "value": "1430465d05151bz7?z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295857", "to_ids": true, "type": "filename", "uuid": "73cfffed-7662-43e6-86e5-8de5419354b4", "value": "autorun.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295857", "to_ids": false, "type": "text", "uuid": "259ac3de-a1c3-4b6a-883c-3fb2918ef68e", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLSideLoad.MKE!MTB\nVT Total Detection:26/71\nFirst Submission:2026-04-28T11:23:15.000000+00:00\nLast Submission:2026-05-22T20:35:57.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300206", "uuid": "740ac595-7175-4263-9320-f5f19f01e7f5", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300206", "to_ids": true, "type": "md5", "uuid": "07dac944-b214-40c9-91f0-7e6f3e3f7fb4", "value": "e1dbc88ccd3da4337bdc2a2cf1acd25c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298390", "to_ids": true, "type": "sha1", "uuid": "aef3c28e-7806-4889-850d-0a53d22f8606", "value": "d7c18ebd1063e4b5ab4468d0d76be50e7778cc98", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298390", "to_ids": true, "type": "sha256", "uuid": "c45c9fe0-9836-4e09-a8a4-cdb0a35c5650", "value": "69077fcf940fc5852fb32beed15636756ebc04ac971b7ed71d36251e7ea70a20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295884", "to_ids": true, "type": "ssdeep", "uuid": "86d496a6-57fc-4b6d-bb83-b8be798fed99", "value": "3072:3CORkjVNwSPTGkrYshWQxiaKC/PxqXDJnc941mmz+:3f63rhWQwC/ZiFJ+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295884", "to_ids": false, "type": "size-in-bytes", "uuid": "b45f657b-4d0d-4934-b5b4-e7b42b769a41", "value": "130048" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295884", "to_ids": true, "type": "vhash", "uuid": "cf288dd9-8358-4f3f-a44d-a5d4b71df707", "value": "115056655d1d056az4e?z7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295884", "to_ids": true, "type": "filename", "uuid": "4cc43696-9a00-4f18-9471-920206fa9873", "value": "autorun_x86.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295884", "to_ids": false, "type": "text", "uuid": "1a66d2b5-d18b-4b1e-b51c-ba83ba6e4336", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLSideLoad.MKE!MTB\nVT Total Detection:35/71\nFirst Submission:2026-04-26T23:41:44.000000+00:00\nLast Submission:2026-04-26T23:41:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300228", "uuid": "e578e6c8-8b57-4bbb-8475-e7b58b0ea9b9", "Attribute": [ { "category": "Payload delivery", "comment": "SimpleRunPE.exe binary transferred by the attacker to the device during established ScreenConnect session", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300228", "to_ids": true, "type": "md5", "uuid": "8d99ec02-8ec1-4f31-890a-f7515ae29567", "value": "d58ce78503c60c19926ed642f0eb9d53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SimpleRunPE.exe binary transferred by the attacker to the device during established ScreenConnect session", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298392", "to_ids": true, "type": "sha1", "uuid": "901f7543-df12-44b7-912d-35ad8e75671b", "value": "f9ea4f4b636614226579ac6cbfc8abe21539a8da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SimpleRunPE.exe binary transferred by the attacker to the device during established ScreenConnect session", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298392", "to_ids": true, "type": "sha256", "uuid": "1b82cf3f-7473-43ac-bd7d-35623b94495b", "value": "7035c2abeb617e828dfda1b119b8544fa9ae15a1d263d18bc5506acaf381f496", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295906", "to_ids": true, "type": "ssdeep", "uuid": "497674ba-067c-4089-ac64-2131d79bf677", "value": "3072:6wb6G/E5danFwY3FNqB83imjIR0VJWta5V1XboBEcGmBIzZvoL67LwfSei:6wbsdanXN00/WtAfboBJB8oW2S" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295906", "to_ids": false, "type": "size-in-bytes", "uuid": "d9cbd9f0-1412-43aa-b527-b3c6dfdfd9dc", "value": "187392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295906", "to_ids": true, "type": "vhash", "uuid": "99d9163e-9281-4969-8cf9-d5c8f95d6d6e", "value": "2150365515129082c8429001046" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295906", "to_ids": true, "type": "filename", "uuid": "bb977750-417b-41a3-8b2a-2a5bb618b4a5", "value": "SimpleRunPE.exe" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295906", "to_ids": false, "type": "text", "uuid": "dcb8728a-fb7e-495f-9ee1-ce760c452b97", "value": "SimpleRunPE.exe binary transferred by the attacker to the device during established ScreenConnect session\r\nType Description: Win32 EXE\nMicrosoft: Trojan:MSIL/CoinMiner!MSR\nVT Total Detection:47/71\nFirst Submission:2026-03-30T04:15:47.000000+00:00\nLast Submission:2026-04-03T00:24:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300249", "uuid": "d151aae8-eb02-4bd9-b11c-007ee2a4cfff", "Attribute": [ { "category": "Payload delivery", "comment": "SimpleRunPE.exe binary transferred by the attacker to the device during established ScreenConnect session", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300249", "to_ids": true, "type": "md5", "uuid": "69fca85c-9ceb-45b3-ba42-81a371aebef7", "value": "56b75638beabd690f38de434f7efd623", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SimpleRunPE.exe binary transferred by the attacker to the device during established ScreenConnect session", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298392", "to_ids": true, "type": "sha1", "uuid": "da7a3d91-b3dd-41b1-b3a3-c9806885fed8", "value": "62d5e9ed6c1444469e4b89f3ca6c2047a5e8eb98", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SimpleRunPE.exe binary transferred by the attacker to the device during established ScreenConnect session", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298393", "to_ids": true, "type": "sha256", "uuid": "3b9a145e-d26e-47e9-ace3-38e1afe49aae", "value": "9ff07c9fafa9c03fdf69e4abf6806aa7c938b5480e7e258f227db0719ecd6386", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295927", "to_ids": true, "type": "ssdeep", "uuid": "fbea2f5c-835d-4b69-bb0d-0ea124dae14b", "value": "3072:xXl4dljUuedbaU+JiF7LcwzBZoooawGBSpCvXbRnBF2aWBLXIZvoLu7IwH2bv0:sdlkf+Jito4BZoooawGBucbRnByBkoq2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295927", "to_ids": false, "type": "size-in-bytes", "uuid": "f8d375c8-a325-41af-8f27-4dd854835d0f", "value": "196608" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295927", "to_ids": true, "type": "vhash", "uuid": "7efc9057-9bec-4656-a93f-f11a279117f8", "value": "2150365515129082d8729001047" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295927", "to_ids": true, "type": "filename", "uuid": "30ac11dc-ca96-4574-8f23-d2a03bc6629e", "value": "SimpleRunPE.exe" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295927", "to_ids": false, "type": "text", "uuid": "eef8d442-ea00-47cc-ac84-fc6eb6185407", "value": "SimpleRunPE.exe binary transferred by the attacker to the device during established ScreenConnect session\r\nType Description: Win32 EXE\nMicrosoft: Trojan:MSIL/CoinMiner!MSR\nVT Total Detection:57/71\nFirst Submission:2026-04-01T05:55:51.000000+00:00\nLast Submission:2026-04-01T16:05:14.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300270", "uuid": "200bd4dc-7b4e-43c9-b76d-86863d8164f0", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300270", "to_ids": true, "type": "md5", "uuid": "e46eb58e-fc1f-4ded-a326-a911f5c5a2e4", "value": "6ca9a835ce59c11c03f0b22c681aab46", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298393", "to_ids": true, "type": "sha1", "uuid": "762a9ae2-e559-4f16-8afc-1d7ecb5e56bf", "value": "49d437381b2892a8c33e99392ee5d939c09e1c4f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298393", "to_ids": true, "type": "sha256", "uuid": "9d325d7e-7bf1-4117-b016-14989fab83e4", "value": "a460d00ef93c8ce70d32e48e55781af66a53328fc2dde45519be196c265de074", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295949", "to_ids": true, "type": "ssdeep", "uuid": "fe3fc45a-fc18-47ec-9729-27c1a21813ce", "value": "384:WUe4BoTNOSlV9E6IoGyL1zscjCAplEnQRaRPOPrbikBXQ35UlUw/URgVFfPO:8AjPlaQcDmPOPFBXQJUB/r" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295949", "to_ids": false, "type": "size-in-bytes", "uuid": "7df1d0b5-9025-4308-b640-adbe4a44ff87", "value": "31752" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295949", "to_ids": true, "type": "vhash", "uuid": "dc881426-7d9a-41fb-9217-895af967466e", "value": "1340a66d1515151c05151\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295949", "to_ids": true, "type": "filename", "uuid": "6128a85e-48d2-431d-8163-47be243c11c7", "value": "kprke.exe" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295949", "to_ids": false, "type": "text", "uuid": "f775a6fb-a1bb-4da5-bcfc-21646c90b5bf", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLSideLoad.MKE!MTB\nVT Total Detection:40/71\nFirst Submission:2026-04-23T09:20:50.000000+00:00\nLast Submission:2026-04-23T09:20:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300291", "uuid": "b615a93a-ab79-42bf-925e-7b22cb425ce1", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300291", "to_ids": true, "type": "md5", "uuid": "5387ad9e-470b-4e00-88c0-63b312e2be17", "value": "512b49f441765698c679b5da5f0cc868", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298395", "to_ids": true, "type": "sha1", "uuid": "d5db9b2f-0e3f-42ef-9223-b496b19783f5", "value": "c27a1688fa5a4ec9497da0fc9bd88c8b362234c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298395", "to_ids": true, "type": "sha256", "uuid": "0e95c7c8-4cef-4eb4-bf97-e7864e0089f8", "value": "c7425fbe6c3a4937934215c54027d4b67202d12ab490682fae03498870d66d06", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295971", "to_ids": true, "type": "ssdeep", "uuid": "27bc062b-7b06-496a-8a2b-1f96fb8ceede", "value": "1536:gUbZ7DAl1rUEu24fn28C97FskZdm0YS7Go4ZmYvwkTHHScHT5CmvJPVeBIpPEFU7:H+rIK2odmVSmZmgnbzNJPVeiBLvYX/i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295971", "to_ids": false, "type": "size-in-bytes", "uuid": "3e98b676-a78d-45b2-a533-e0dd4690dc88", "value": "155648" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295971", "to_ids": true, "type": "vhash", "uuid": "363159f9-7317-46bd-9819-90644be44dd9", "value": "115066655d155d055az51?z7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295971", "to_ids": true, "type": "filename", "uuid": "527f8297-fc47-47e9-be30-861e9a562e2d", "value": "autorun.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295971", "to_ids": false, "type": "text", "uuid": "d177d8eb-5aa4-45a2-91cd-aad8c0905741", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: HackTool:Win64/Malgent!MSR\nVT Total Detection:36/71\nFirst Submission:2026-04-19T18:04:27.000000+00:00\nLast Submission:2026-04-26T23:38:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300312", "uuid": "ddeb0a69-db0b-4a4f-9ac8-ee9b222a9b5d", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300312", "to_ids": true, "type": "md5", "uuid": "b367bbcf-209c-41ae-bbe1-b633c231231a", "value": "c5c507895c6f01c558974812753ac89a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298396", "to_ids": true, "type": "sha1", "uuid": "e7725c93-5aa4-4682-bd54-7730ddc72fa0", "value": "f68593663b485682eea2a96b27b9701aa529ccd2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298396", "to_ids": true, "type": "sha256", "uuid": "5e7c016d-f03a-4d5e-a860-56a1d7b42ba6", "value": "cf3f8160eb5a5580e0c35054847e3ac4d01e9fe74fab8bc12bf6e8a40bf696b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780295992", "to_ids": true, "type": "ssdeep", "uuid": "584012ea-229a-4c8d-a3e1-6483aa43ea76", "value": "1536:gUbZ7DAl1rUEu24fn28C97FskZdm0YS7Go4ZmYvwkTHHScHT5CmvJPVeBIpPEFUT:H+rIK2odmVSmZmgnbzNJPVeiBLvYX/iv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780295992", "to_ids": false, "type": "size-in-bytes", "uuid": "4e5ee0b3-fcc7-4c95-84b5-855b548315ce", "value": "155649" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780295992", "to_ids": true, "type": "vhash", "uuid": "0e887295-dfd8-41f8-a7ba-893932d1825e", "value": "115066655d155d055az51?z7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780295992", "to_ids": true, "type": "filename", "uuid": "5c838724-a3a9-4c87-a230-737fe6ac4884", "value": "(new)autorun (1).dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780295992", "to_ids": false, "type": "text", "uuid": "bfa4635e-cba1-4729-8d66-b8d3908a2a34", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLSideLoad.MKT!MTB\nVT Total Detection:39/71\nFirst Submission:2026-04-26T23:39:19.000000+00:00\nLast Submission:2026-04-26T23:39:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300333", "uuid": "388020e5-088c-44d7-a59b-2a59289e060c", "Attribute": [ { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300333", "to_ids": true, "type": "md5", "uuid": "3097aa19-70ff-4463-bc9d-51c94662c5b1", "value": "10ad138b736d4e193ea69c1b8d67ee58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298397", "to_ids": true, "type": "sha1", "uuid": "87278aa5-3af9-4af4-b995-0e601a768561", "value": "ab44396e57b544984292622c744a2b607ef74e66", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "autorun.dll loaded by legit EXE via DLL sideloading", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298397", "to_ids": true, "type": "sha256", "uuid": "f878b318-6687-4889-af36-0612a3981d83", "value": "db2d33c4e6e4a5c2263b56e8303c343305a94dde1fc2968304ba260acbbd9f9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780296014", "to_ids": true, "type": "ssdeep", "uuid": "ddc8bf06-83d5-4155-baa9-48b12b258d3e", "value": "1536:aUbZ7DAl1rUEu24fn28C97FskZdm0YS7Go4ZmYvwkTHHScHT5CmvJPVeBIpPEFUd:x+rIK2odmVSmZmgnbzNJPVeiBLvuX/i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780296014", "to_ids": false, "type": "size-in-bytes", "uuid": "bc338994-1bd3-4a13-877d-8fad21150df0", "value": "155648" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780296014", "to_ids": true, "type": "vhash", "uuid": "335160b2-8245-4b99-aca4-d45d99b1b786", "value": "115066655d155d055az51?z7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780296014", "to_ids": true, "type": "filename", "uuid": "00fae03e-59b6-49a3-95db-efcee7ba76b6", "value": "autorun.dll" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780296014", "to_ids": false, "type": "text", "uuid": "db09c0c6-dac4-4148-a260-f056e2b58d89", "value": "autorun.dll loaded by legit EXE via DLL sideloading\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/DLLSideLoad.MKT!MTB\nVT Total Detection:38/71\nFirst Submission:2026-04-26T23:37:12.000000+00:00\nLast Submission:2026-04-26T23:43:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780300354", "uuid": "c645b32b-3e53-45b6-aec4-4fce3efce332", "Attribute": [ { "category": "Payload delivery", "comment": "ScreenConnect file masquerading as a DLL", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780300354", "to_ids": true, "type": "md5", "uuid": "1eeb055d-d763-4374-af51-807fb673379c", "value": "4b42cc57e13d9a8c8598199f30fa5282", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ScreenConnect file masquerading as a DLL", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780298398", "to_ids": true, "type": "sha1", "uuid": "69581903-e036-4260-8e56-6bedc1f6e6b8", "value": "5e6587b95fb3bde15a587d45c06329a5dc277952", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ScreenConnect file masquerading as a DLL", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780298398", "to_ids": true, "type": "sha256", "uuid": "7c83fbbd-247a-460e-8636-d773c91019ec", "value": "e021662a652ba95c8778b991056696ab3c9b0f60d5e23b1e6cf73c3847db6610", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780296036", "to_ids": true, "type": "ssdeep", "uuid": "da7f2e92-1402-42db-b559-668bb745d287", "value": "196608:SHxcp9ym3oltDUJVIHxcp9ym3jHxcp9ym3vHxcp9ym3OHxcp9ym3+Hxcp9ym3:gGpmpTGpNGp5GpcGpMGp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780296036", "to_ids": false, "type": "size-in-bytes", "uuid": "4cd86191-73c6-4eed-88fa-874811491315", "value": "11698176" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780296036", "to_ids": true, "type": "vhash", "uuid": "07ecd59a-0750-4c52-a9d0-bdd59248ade1", "value": "45155b83172cd3ff230fec9025027227" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780296036", "to_ids": true, "type": "filename", "uuid": "6fa53e22-8943-4f39-a3f9-320a9b60319c", "value": "94d7bdb.msi" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780296036", "to_ids": false, "type": "text", "uuid": "6bb29853-07d2-456d-b47b-d7575c609591", "value": "ScreenConnect file masquerading as a DLL\r\nType Descriptio%WINDIR%\\Installer\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:33/62\nFirst Submission:2026-03-25T02:02:51.000000+00:00\nLast Submission:2026-05-23T07:24:59.000000+00:00" } ] } ] } }