{ "Event": { "analysis": "1", "date": "2026-07-09", "extends_uuid": "", "info": "[Threat Intel] Threat Insight: Cybercriminals Abusing Vercel to Deliver Remote Access Malware", "protected": false, "publish_timestamp": "1784407962", "published": true, "threat_level_id": "3", "timestamp": "1784407961", "uuid": "381153e4-8871-4f8a-bc63-1312f03752aa", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#e1210d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Mark-of-the-Web Bypass - T1553.005\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#0aebeb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"LogMeIn\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"vercel\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783681221", "to_ids": false, "type": "link", "uuid": "dd4f2a70-bb68-4aed-b9df-b3622f9e51d1", "value": "https://www.cyberarmor.tech/blog/threat-insight-cybercriminals-abusing-vercel-to-deliver-remote-access-malware", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783681221", "to_ids": false, "type": "text", "uuid": "1577ad14-d924-49aa-aa9e-a542f487214c", "value": "Cybercriminals are conducting phishing campaigns by hosting malicious pages on Vercel, a legitimate website hosting platform. The attack involves sending phishing emails with links to fake Adobe PDF viewer pages that prompt users to download executable files disguised as documents. The malware, distributed as Invoice06092025.exe.bin, automatically installs LogMeIn remote access software upon execution, enabling attackers to remotely control compromised machines. Over a two-month period, more than 28 distinct campaigns have been observed targeting over 1,271 users. The attackers leverage trusted platforms to disguise their malicious activity, making detection more challenging and increasing the likelihood of successful compromise." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783681221", "to_ids": false, "type": "text", "uuid": "e4f292bb-401c-4b70-afde-e9ad602f57c5", "value": "Name: Threat Insight: Cybercriminals Abusing Vercel to Deliver Remote Access Malware\nAuthor: AlienVault\nAdversary: \nTags: [\"trusted platform exploitation\", \"logmein\", \"vercel abuse\", \"executable disguise\", \"email campaign\", \"pdf impersonation\", \"remote access\", \"phishing\"]\nTgtd countries: []\nMlwr families: [\"LogMeIn\"]\nAttack_ids: [\"T1204.002\", \"T1566.002\", \"T1082\", \"T1106\", \"T1219\", \"T1059\", \"T1083\", \"T1553.005\", \"T1547.001\", \"T1203\", \"T1071.001\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784377909", "to_ids": true, "type": "hostname", "uuid": "fecbd736-d896-4030-a9e4-57d1cf5cc3e6", "value": "unpaidinvoiceremitaath.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784377930", "to_ids": true, "type": "hostname", "uuid": "e0687682-7317-43c5-9b6a-d81ecd7f9b79", "value": "waybill-deliveryticket.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784377951", "to_ids": true, "type": "hostname", "uuid": "9d0007bb-7ce8-495e-9ae5-904b80ae5479", "value": "invstatement2025.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784377972", "to_ids": true, "type": "hostname", "uuid": "98c55a5c-74a2-4c37-9fb4-15edca99922c", "value": "invstatement.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784377993", "to_ids": true, "type": "hostname", "uuid": "02aaef05-d105-4a79-bd5b-99313ae06c88", "value": "windowscorps.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378015", "to_ids": true, "type": "hostname", "uuid": "911b1587-d57d-4fc4-9836-42501ad84a42", "value": "mail.blta.ro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378036", "to_ids": true, "type": "hostname", "uuid": "f166126f-31b4-4a76-b3d6-afbc1b4dc356", "value": "invoices-attachedpdf.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378057", "to_ids": true, "type": "hostname", "uuid": "7f40b545-0957-4a08-b9ab-b00de2cd6528", "value": "dhl-delivery-report.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378078", "to_ids": true, "type": "hostname", "uuid": "9444e669-c447-49c5-b748-066caa4f251e", "value": "hoferunpaidinvoicestatementinvds.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378099", "to_ids": true, "type": "hostname", "uuid": "64f7750d-cac5-4342-960b-74a2e764bf23", "value": "dhl-shipment-detail.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378121", "to_ids": true, "type": "hostname", "uuid": "7ba548b7-9d94-43c3-a0a1-02144bad8ad8", "value": "statementpaysundrreviewdfg.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378142", "to_ids": true, "type": "hostname", "uuid": "f3693e41-130b-4242-9255-e5ebacf0fdc2", "value": "express-delivery-note.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378163", "to_ids": true, "type": "hostname", "uuid": "eb8a3388-e6bb-43ac-8bf2-264728609ef0", "value": "dhl-shipment-document.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378184", "to_ids": true, "type": "hostname", "uuid": "b1760363-2534-4bd7-9471-8095fb355d2b", "value": "invoice-statement-overdue.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378205", "to_ids": true, "type": "hostname", "uuid": "b86ddd8f-c3b6-44b3-8b1a-d6f3d3d9267d", "value": "statementinfromcrllc.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378228", "to_ids": true, "type": "hostname", "uuid": "245814fb-c62d-4f7d-bf4e-fa52b42f11a7", "value": "attached-documentation-sent.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378249", "to_ids": true, "type": "hostname", "uuid": "80fa5004-a1cd-4e91-9022-47653396be5c", "value": "findhome.clpeacepaymentsettlementsinvs.vercel.app", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378270", "to_ids": true, "type": "hostname", "uuid": "4420f7db-6999-458a-9eb3-edc5aead5768", "value": "invoicereunpaiadinv-beta.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378291", "to_ids": true, "type": "hostname", "uuid": "67802ab5-e19a-4dcf-b3a7-97e9f84debe1", "value": "statementinvs.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378312", "to_ids": true, "type": "hostname", "uuid": "c7b364f9-1336-434a-adf2-9f24d499f03a", "value": "docreview-rho.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378333", "to_ids": true, "type": "hostname", "uuid": "28830ec8-3dd9-4e2c-8785-e6a57203f61c", "value": "docsignstatements.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378354", "to_ids": true, "type": "hostname", "uuid": "d3b1db91-375a-4b65-8b50-305b4828f776", "value": "invoices-overdues100.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378375", "to_ids": true, "type": "hostname", "uuid": "614107f1-2845-4eef-89f0-132259a50b35", "value": "waybill-directory-express.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378396", "to_ids": true, "type": "hostname", "uuid": "19605def-506b-4091-a771-9cb013a51ac2", "value": "statment-inv.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378417", "to_ids": true, "type": "hostname", "uuid": "67825814-1a9c-4512-86b5-7b188dbaca21", "value": "statment-two.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378438", "to_ids": true, "type": "hostname", "uuid": "1d2c243e-7c80-4283-9275-ec8d6defbd22", "value": "shipment-docspdf.surge.sh", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784378459", "to_ids": true, "type": "hostname", "uuid": "96d84175-b4d0-44f3-9bba-94d9c5f25f3f", "value": "pastduefromhomi.vercel.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784407947", "uuid": "8b9549c4-2444-40c4-ad0e-4e036ff73e09", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "md5", "timestamp": "1784407947", "to_ids": true, "type": "md5", "uuid": "3374a649-5753-4d89-a2d1-edaee1064f68", "value": "322a92b443faefe48fce629e8947e4e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "sha1", "timestamp": "1784407947", "to_ids": true, "type": "sha1", "uuid": "bd09c631-8d16-4051-a75a-d494aa98ee9c", "value": "6fa2dd3d3f4e486788b5c37abaa8a6a040bbb518", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "sha256", "timestamp": "1784407947", "to_ids": true, "type": "sha256", "uuid": "34e7ccd0-b2dd-4006-81a6-ae4cac41d536", "value": "9bde904a892ebb8db95040cbf793a585704063c7656ece6186486752f68b8a6b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 27/03/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "text", "timestamp": "1784366840", "to_ids": false, "type": "text", "uuid": "5fa9f6a1-863e-4eb3-87ac-41b585e62530", "value": "Type Description: Win32 EXE\nOriginal name: GoToResolveUnattendedUpdater.exe\nVerified: Signed\nSigning date: 11:25 AM 03/14/2025\nSigners: GoTo Technologies USA, LLC; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 27/75\nFirst Submission: 2025-04-23T20:03:10+00:00\nLast Submission: 2026-01-27T19:25:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "creation-time", "timestamp": "1784366840", "to_ids": false, "type": "datetime", "uuid": "6ea5682b-6b28-4a21-80bd-2342806efe2e", "value": "2025-03-14T11:18:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "ssdeep", "timestamp": "1784366840", "to_ids": true, "type": "ssdeep", "uuid": "2382596c-ea30-4814-bd50-89261cd8a49c", "value": "393216:o6GG9Ob7uz2MG+SYyuc0niurBDTOKSKvZn1XuBErd9k6fKtXrkp99mhUZBKHBze:a/6DG+SiiiTOyABngKtYooBKFe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784366840", "to_ids": false, "type": "size-in-bytes", "uuid": "9aa6fe85-3370-43eb-868c-08b984ccffa0", "value": "24242552" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "vhash", "timestamp": "1784366840", "to_ids": true, "type": "vhash", "uuid": "9150a736-36a8-4fa3-834f-75606dca1a9d", "value": "027056655d557561f011za2zb27z1015z3021z75z47z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-23T20:03:10+00:00", "last_seen": "2026-01-27T19:25:06+00:00", "object_relation": "filename", "timestamp": "1784366840", "to_ids": true, "type": "filename", "uuid": "63787447-b6fb-4edd-8568-9c5a1f6ccd9d", "value": "GoToResolveUnattendedUpdater.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784407950", "uuid": "368114c3-257c-4423-a58d-a2e1d55fa5de", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "md5", "timestamp": "1784407950", "to_ids": true, "type": "md5", "uuid": "73509ba7-5919-426f-9ce3-7328c84ad3bd", "value": "e230bf859e582fe95df0b203892048df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "sha1", "timestamp": "1784407950", "to_ids": true, "type": "sha1", "uuid": "166af79a-762f-4bb9-a312-2be080d0d443", "value": "e3d61b0604672843cf07344f4db56fb955e43105", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "sha256", "timestamp": "1784407950", "to_ids": true, "type": "sha256", "uuid": "f02c29f0-0dd1-4d84-82cf-2fe52457f88e", "value": "f4db2e1b718dcfa1181ebb685d43740ecbff32b33ad0ca720810a1b7ef50bdd7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 27/03/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "text", "timestamp": "1784366862", "to_ids": false, "type": "text", "uuid": "2ff9717f-6f7f-4421-9a7b-8f27491ef9ed", "value": "Type Description: Win32 EXE\nOriginal name: GoToResolveUnattendedUpdater.exe\nVerified: Signed\nSigning date: 11:25 AM 03/14/2025\nSigners: GoTo Technologies USA, LLC; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 22/75\nFirst Submission: 2025-06-16T13:34:58+00:00\nLast Submission: 2026-01-27T19:23:51+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "creation-time", "timestamp": "1784366862", "to_ids": false, "type": "datetime", "uuid": "7504d6ad-8a61-47b9-8f06-e02da7cd68bf", "value": "2025-03-14T11:18:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "ssdeep", "timestamp": "1784366862", "to_ids": true, "type": "ssdeep", "uuid": "e4784dea-b326-48d3-a9a9-d27eec829aba", "value": "393216:o6GG9Ob7uz2MG+SYyuc0niurBDTOKSKvZn1XuBErd9k6fKtXrkp99mhUZBKHBzy:a/6DG+SiiiTOyABngKtYooBKFy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784366862", "to_ids": false, "type": "size-in-bytes", "uuid": "568ba7fd-0b5a-425f-b838-a37fc84f49f3", "value": "24242552" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "vhash", "timestamp": "1784366862", "to_ids": true, "type": "vhash", "uuid": "7b876f72-9044-4dfd-a5c4-e5773036f1c4", "value": "027056655d557561f011za2zb27z1015z3021z75z47z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-16T13:34:58+00:00", "last_seen": "2026-01-27T19:23:51+00:00", "object_relation": "filename", "timestamp": "1784366862", "to_ids": true, "type": "filename", "uuid": "b5d1f4fc-8d5d-44df-b8df-55829e5adaed", "value": "GoToResolveUnattendedUpdater.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784407953", "uuid": "1a91435c-7b40-4659-929f-8b79e0257dec", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "md5", "timestamp": "1784407953", "to_ids": true, "type": "md5", "uuid": "f1f3e8c2-7288-4973-8183-1b46fa0121f7", "value": "f3f8379ce6e0b8f80faf259db2443f13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "sha1", "timestamp": "1784407953", "to_ids": true, "type": "sha1", "uuid": "35b5a3c9-7826-47c4-9997-ee7d70b4dff7", "value": "5fd4bcca28553ebe759ec97fcbc3a2a732268f85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "sha256", "timestamp": "1784407953", "to_ids": true, "type": "sha256", "uuid": "ec7bc70c-2049-4592-9885-fc9abcc2ff07", "value": "0a1a85a026b6d477f59bc3d965b07d0d06e6ff2d34381aff79ea71c38fed802b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 22/09/2025", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "text", "timestamp": "1784366883", "to_ids": false, "type": "text", "uuid": "2b5020ef-b937-4d51-b961-8e546451c896", "value": "Type Description: Win32 EXE\nOriginal name: GoToResolveUnattendedUpdater.exe\nVerified: Signed\nSigning date: 10:00 AM 04/23/2025\nSigners: GoTo Technologies USA, LLC; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/76\nFirst Submission: 2025-06-17T07:16:52+00:00\nLast Submission: 2025-07-05T17:02:22+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "creation-time", "timestamp": "1784366883", "to_ids": false, "type": "datetime", "uuid": "9b708687-4fd9-49b5-b86f-aa7a67df8b05", "value": "2025-04-23T09:54:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "ssdeep", "timestamp": "1784366883", "to_ids": true, "type": "ssdeep", "uuid": "aedfb429-240c-43b2-874c-1974f2dafda9", "value": "393216:bnHHlVm1qFiFJ7F91EZ42NtuL9ukh4goGFflbsOGtZDTe/2Ql2seRdR:rHMq8J7r1EfN4L9ukBvHbsO0ZDTe/2QG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784366883", "to_ids": false, "type": "size-in-bytes", "uuid": "e9d68919-7948-4534-b65b-95692aca7ac1", "value": "24415592" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "vhash", "timestamp": "1784366883", "to_ids": true, "type": "vhash", "uuid": "3996beb1-c164-48cb-9f22-10f6e8a803cd", "value": "027066655d5d157561f011z72zb4z41z1015z3021z75z47z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-17T07:16:52+00:00", "last_seen": "2025-07-05T17:02:22+00:00", "object_relation": "filename", "timestamp": "1784366883", "to_ids": true, "type": "filename", "uuid": "e44a2171-c2ba-4ef9-a99f-504954541954", "value": "GoToResolveUnattendedUpdater.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784407961", "uuid": "f1cb82d4-41ec-4197-a2b3-137375c76921", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "md5", "timestamp": "1784407961", "to_ids": true, "type": "md5", "uuid": "9cec3176-b616-4cf3-b683-199eb4c5c331", "value": "f782c936249b9786cc7fac580da3ae0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "sha1", "timestamp": "1784407961", "to_ids": true, "type": "sha1", "uuid": "9444dfc5-615e-4cf9-b537-3c29e179bc25", "value": "d1392dedfe3dcc1d3d1fb7cb01bf2b006d2804dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "sha256", "timestamp": "1784407961", "to_ids": true, "type": "sha256", "uuid": "3dc43dab-752c-4714-926e-fc537072d2dd", "value": "233e1eff3fa01631889529032b15cf7a2d686462e002b9a7b56355f93ab45e52", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 02/03/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "text", "timestamp": "1784366905", "to_ids": false, "type": "text", "uuid": "9161abcf-7b7e-4284-a122-a7b81d737c22", "value": "Type Description: Win32 EXE\nOriginal name: GoToResolveUnattendedUpdater.exe\nVerified: Signed\nSigning date: 10:00 AM 04/23/2025\nSigners: GoTo Technologies USA, LLC; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/76\nFirst Submission: 2025-04-28T19:22:15+00:00\nLast Submission: 2025-05-26T18:12:32+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "creation-time", "timestamp": "1784366905", "to_ids": false, "type": "datetime", "uuid": "975ac0f1-b28a-4da9-af12-fec2a61cf8ed", "value": "2025-04-23T09:54:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "ssdeep", "timestamp": "1784366905", "to_ids": true, "type": "ssdeep", "uuid": "11c2454c-41da-4db9-a56d-db59fc0d12f4", "value": "393216:bnHHlVm1qFiFJ7F91EZ42NtuL9ukh4goGFflbsOGtZDTe/2Ql2seRd9:rHMq8J7r1EfN4L9ukBvHbsO0ZDTe/2QK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784366905", "to_ids": false, "type": "size-in-bytes", "uuid": "55ff6b36-d44d-45eb-9de1-053f918ec41c", "value": "24415592" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "vhash", "timestamp": "1784366905", "to_ids": true, "type": "vhash", "uuid": "fb8ca53f-2864-43f3-bddf-8884ef0cf361", "value": "027066655d5d157561f011z72zb4z41z1015z3021z75z47z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-28T19:22:15+00:00", "last_seen": "2025-05-26T18:12:32+00:00", "object_relation": "filename", "timestamp": "1784366905", "to_ids": true, "type": "filename", "uuid": "cba0efe8-13e3-434f-a032-97515bd1506a", "value": "GoToResolveUnattendedUpdater.exe" } ] } ] } }