{ "Event": { "analysis": "1", "date": "2026-06-17", "extends_uuid": "", "info": "[Threat Intel] From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware", "protected": false, "publish_timestamp": "1782352659", "published": true, "threat_level_id": "2", "timestamp": "1782352659", "uuid": "3b84c17c-e7c9-4b2f-89aa-2a39620d3f4c", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#e96364", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Adversary-in-the-Middle - T1557\"", "relationship_type": "" }, { "colour": "#f28fb8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"OS Credential Dumping - T1003\"", "relationship_type": "" }, { "colour": "#b2a633", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Stop - T1489\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#bce57a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#041edc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SMB/Windows Admin Shares - T1021.002\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#370063", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": "" }, { "colour": "#fae37b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"8545fbf3-a246-4938-96a9-85a24651ebde\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"inc ransom\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751616", "to_ids": false, "type": "link", "uuid": "9794cf49-81eb-435d-bc75-7de412f2a48e", "value": "https://www.acronis.com/en/tru/posts/from-emerging-threat-to-top-tier-ransomware-as-a-service-the-evolution-of-inc-ransomware/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781751616", "to_ids": false, "type": "text", "uuid": "2e58085a-9bea-4042-8478-2ff289bdb2c1", "value": "INC has evolved from an emerging ransomware-as-a-service operation into one of the most active groups in 2026, claiming over 800 victims since 2023. The disruption of LockBit and BlackCat's shutdown created opportunities for INC to expand as affiliates migrated. Both Windows and Linux/ESXi encryptors have been rewritten in Rust, enabling cross-platform development and increasing analysis complexity. Recent incidents reveal updated tooling, including a modified credential dumper targeting newer Veeam backup deployments with support for salted DPAPI encryption. INC's influence extends beyond its operations; following the 2024 source code sale for $300,000, related families like Lynx and Sinobi emerged. United States organizations account for over 65% of victims, with legal services, manufacturing, construction, technology, and healthcare among the most targeted sectors." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781751616", "to_ids": false, "type": "text", "uuid": "953a892c-ad5f-432d-8d39-6526791d6624", "value": "Name: From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware\nAuthor: AlienVault\nAdversary: INC\nTags: [\"cve-2025-5777\", \"encryption\", \"double-extortion\", \"lynx\", \"cobalt strike\", \"raas\", \"sinobi\", \"cve-2024-57727\", \"ransomware-as-a-service\", \"rust-based\", \"inc\", \"cve-2023-3519\", \"veeam-credential-dumping\", \"cve-2023-48788\", \"data-leak-site\", \"vmware-esxi\"]\nTgtd countries: []\nMlwr families: [\"Brave Prince - S0252\", \"Lynx\", \"Sinobi\", \"Cobalt Strike - S0154\"]\nAttack_ids: [\"T1557\", \"T1003\", \"T1489\", \"T1071\", \"T1190\", \"T1567\", \"T1219\", \"T1021.002\", \"T1112\", \"T1083\", \"T1566\", \"T1562.001\", \"T1078\", \"T1486\", \"T1027.002\", \"T1018\", \"T1021.001\", \"T1569.002\", \"T1490\"]\nIndustries: [\"Legal\", \"Manufacturing\", \"Technology\", \"Healthcare\", \"Construction\", \"Education\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1781751616", "to_ids": false, "type": "threat-actor", "uuid": "52fd7868-536f-4dad-9cbf-f604d413895e", "value": "INC" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751616", "to_ids": false, "type": "vulnerability", "uuid": "56d8081e-d919-496e-9974-08657b51bd9c", "value": "CVE-2023-3519" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751616", "to_ids": false, "type": "vulnerability", "uuid": "3cee477d-928a-4d93-90e6-f37a1d7aa1ff", "value": "CVE-2023-48788" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348445", "to_ids": true, "type": "domain", "uuid": "f090c680-e103-45c0-90d9-a91acd75fcbf", "value": "incblog.su", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751616", "to_ids": false, "type": "vulnerability", "uuid": "4b684f38-bed1-43a0-b73c-7eaf63630d51", "value": "CVE-2024-57727" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348466", "to_ids": true, "type": "domain", "uuid": "fe3ee702-4dae-4143-9d4f-0a40ff24fdd7", "value": "incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348487", "to_ids": true, "type": "domain", "uuid": "48ad5a66-8556-40fc-af67-0e3d8a118f3f", "value": "incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751616", "to_ids": false, "type": "vulnerability", "uuid": "01bcd4f3-ebe1-4b28-8da2-f29c753f1abe", "value": "CVE-2025-5777" } ], "Object": [ { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782343315", "uuid": "49ee9f3b-a64c-4715-aee5-3cad1cc9d584", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782343315", "to_ids": false, "type": "text", "uuid": "a43056dc-6e03-40c8-8fad-b19fb948a928", "value": "MAL_RANSOM_INC_WINDOWS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782343315", "to_ids": false, "type": "comment", "uuid": "3a5715eb-1edf-48e9-82e7-c88a35afa139", "value": "Matches INC Ransomware Rust-compiled samples for Windows" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782343315", "to_ids": true, "type": "yara", "uuid": "fbd3c280-67f0-45d0-a5fb-21b1c5b80245", "value": "rule MAL_RANSOM_INC_WINDOWS\r\n{\r\nmeta:\r\n\tdescription = \"Matches INC Ransomware Rust-compiled samples for Windows\"\r\n\tauthor = \"Acronis Threat Research Unit (TRU)\" \r\nstrings:\r\n $a1 = \"[INC-README.txt..\" ascii wide\r\n $a2 = \"Successfully added file to queue:\" ascii wide\r\n $a3 = \"while deleting shadow copies from\" ascii wide\r\n $a4 = \"Successfully deleted shadow copies from\" ascii wide\r\n $a5 = \"while killing processes by mask\" ascii wide\r\n $a6 = \"while killing services by mask\" ascii wide\r\n $a7 = \"Successfully killed processes by mask\" ascii wide\r\n $a8 = \"while encrypting file:\" ascii wide\r\n $a9 = \"INCdirectory(ies)dirEncryption directory(ies)\" ascii wide \r\ncondition:\r\n\t(uint16(0) == 0x5A4D) and (uint32(uint32(0x3C)) == 0x00004550) and all of ($a*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1782343349", "uuid": "4000ac54-cbf2-4af1-b44d-baf763be9eef", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1782343349", "to_ids": false, "type": "text", "uuid": "f0ee17ba-d53b-4bff-ba4b-7c7ce17927b0", "value": "MAL_RANSOM_INC_LINUX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1782343349", "to_ids": false, "type": "comment", "uuid": "72baf833-951d-44d6-9143-4ae8511361fb", "value": "Matches INC Ransomware Rust-compiled samples for Linux/ESXi" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1782343349", "to_ids": true, "type": "yara", "uuid": "b52a42c7-b05c-4e62-aecd-1efacdd6585d", "value": "rule MAL_RANSOM_INC_LINUX\r\n{\r\nmeta:\r\ndescription = \"Matches INC Ransomware Rust-compiled samples for Linux/ESXi\"\r\nauthor = \"Acronis Threat Research Unit (TRU)\" \r\nstrings:\r\n $a1 = \"[INC-README.txtINC\" ascii wide\r\n $a2 = \"while running as a daemon\" ascii wide\r\n $a3 = \"while stopping ESXi machines\" ascii wide\r\n $a4 = \"while removing ESXi snapshots\" ascii wide\r\n $a5 = \"while setting motd\" ascii wide\r\n $a6 = \"fn5+fiBJTkMgUmFuc29tIH5+fn4\" ascii wide \r\ncondition:\r\n(uint32(0) == 0x464C457F) and all of ($a*)\r\n}" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348508", "uuid": "7dbd19ed-2eb4-4b42-838f-1044bc240532", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348508", "to_ids": true, "type": "md5", "uuid": "4b886277-fec5-48db-a702-5836d71fceca", "value": "03dd0efa84d145d7d4ed8e240267e5c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346092", "to_ids": true, "type": "sha1", "uuid": "8865da70-44af-46c6-9cd2-4969092f6068", "value": "265a8e89464e32b22553ef16edbab703da7176a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346092", "to_ids": true, "type": "sha256", "uuid": "687672d7-8c48-4bde-9427-0a13ea711911", "value": "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345288", "to_ids": true, "type": "ssdeep", "uuid": "cd526f0e-87ad-463f-bee3-fd552ace5a9a", "value": "24576:eqy4VsWHgFJ2EdXFzP+8JpnwBj7AXHTIa+pP9yBn+I:eqy4aWHgFJ2EdXFzP+8JpwBj7A3TIa+i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345288", "to_ids": false, "type": "size-in-bytes", "uuid": "f8525b78-1da9-4f51-af4e-b8c03d2b6aaa", "value": "870920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345288", "to_ids": true, "type": "filename", "uuid": "259d78f5-8d95-42c8-9d31-d4de8c551153", "value": "x86_64-unknown-linux-esxi.elf" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345288", "to_ids": false, "type": "text", "uuid": "a9f00887-1416-4906-93cd-8324c12ad3ba", "value": "Type Description: ELF\nMicrosoft: Ransom:Linux/Inc.B!MTB\nVT Total Detection:34/63\nFirst Submission:2025-07-18T11:42:11.000000+00:00\nLast Submission:2025-10-20T09:16:46.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348529", "uuid": "c7b0fae4-fa4f-43be-9d62-e02908663ed1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348529", "to_ids": true, "type": "md5", "uuid": "35c4be7f-a176-4c70-a146-a9f413773554", "value": "dce9ad6317ce147f1f3f74bc93d9252a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346093", "to_ids": true, "type": "sha1", "uuid": "60b49bce-c406-4844-be3d-dd4c2b45a2a3", "value": "16bad42a397db2e075e09b5b9dd53aaa67b495a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346093", "to_ids": true, "type": "sha256", "uuid": "1d17710a-fa8a-408b-a115-726d2e6be68c", "value": "acce811c4fc2a6e3fddd4231e386f1648ca44f039d2d275316bc0a0fc96e0af4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345309", "to_ids": true, "type": "ssdeep", "uuid": "7d4555c0-654f-420a-a18c-53ca1781b876", "value": "49152:/z7mF4kwsjcks87ZSqKOO6H94dD1rWJjnQEEMQp0:77Zp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345309", "to_ids": false, "type": "size-in-bytes", "uuid": "8b418dda-436f-44a5-ac2f-fbaba8f8df06", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345309", "to_ids": true, "type": "vhash", "uuid": "69a0d4a7-2181-4c81-9d48-10ba1497bcb8", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345309", "to_ids": true, "type": "filename", "uuid": "bf95c729-f3d7-4658-a9fe-f14d2879b6b3", "value": "h3odp7l2u.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345309", "to_ids": false, "type": "text", "uuid": "cb5ec71a-ea39-475a-b70c-fca41aad8eb2", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:53/70\nFirst Submission:2026-02-25T15:04:43.000000+00:00\nLast Submission:2026-02-27T05:05:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348550", "uuid": "c32696a7-0b8a-4ce7-9765-19d1add94c77", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348550", "to_ids": true, "type": "md5", "uuid": "1168fbc0-f9e4-4332-b09c-d98f8624aa63", "value": "eb37c4fcfc00d3813ab94f4d59378b47", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346094", "to_ids": true, "type": "sha1", "uuid": "52d240a7-24b2-442c-abfd-1c9b4dde6a38", "value": "70331fdf528f4f5b75b5e30427e379bc88aa05b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346094", "to_ids": true, "type": "sha256", "uuid": "bcf0f954-3306-499d-9236-ac6bb05b6d6c", "value": "31800380c359143ae82c4f9011eee653dd22443d03d6a499148203bbfc275502", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345331", "to_ids": true, "type": "ssdeep", "uuid": "dabdd22a-f1b0-4bb7-8280-5ca10dd48228", "value": "49152:/z7mp4kwsjcks87ZSqKOO6H94dD1rWJjnQErMQp0:772p0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345331", "to_ids": false, "type": "size-in-bytes", "uuid": "062e0ab5-c639-4236-afdf-f1f49f7747e1", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345331", "to_ids": true, "type": "vhash", "uuid": "7dfca17e-3f46-4102-88b4-e361d91550c8", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345331", "to_ids": true, "type": "filename", "uuid": "d4f41950-c73e-45da-a930-067cf055b1f7", "value": "hi9lezv.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345331", "to_ids": false, "type": "text", "uuid": "c2e512f3-426c-4742-ba21-5751919e4e4d", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:55/70\nFirst Submission:2026-04-24T20:27:28.000000+00:00\nLast Submission:2026-04-24T20:27:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348571", "uuid": "6a72c873-0e04-49ea-b8ff-c49b3b57f357", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348571", "to_ids": true, "type": "md5", "uuid": "1de08a14-c5b5-4cf0-a8c6-496be016c517", "value": "6d28d0ad4c7192bf8fccd1be1e10d5d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346095", "to_ids": true, "type": "sha1", "uuid": "f0b4df04-15fe-47a1-b8c3-5e05e0610740", "value": "4f04f2c98ae0dccf842bd1ab0971b5bd39a7f97a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346096", "to_ids": true, "type": "sha256", "uuid": "ae478bf1-a2b3-450f-9e48-ba2c0e181da6", "value": "1898d056463284d849801cbdea6a3dec6c9f568f01569912c3868a5eea9a5449", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345353", "to_ids": true, "type": "ssdeep", "uuid": "249d09b4-69bd-4a1e-8932-13ee323cbf4b", "value": "49152:/z7md4kwsjcks87ZSqKOO6H94dD1rWJjnQE2MQp0:77zp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345353", "to_ids": false, "type": "size-in-bytes", "uuid": "968257e8-4fbc-4d8b-b1dd-2b86b3146757", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345353", "to_ids": true, "type": "vhash", "uuid": "fb71c317-6ef8-4928-96b7-8d556b7ec148", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345353", "to_ids": true, "type": "filename", "uuid": "90d5c71d-632e-43ed-9a1d-432983a92346", "value": "072wiof7.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345353", "to_ids": false, "type": "text", "uuid": "17ef543c-49e7-4aa4-93fe-5c79a6ec1cde", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:55/69\nFirst Submission:2026-03-27T17:14:52.000000+00:00\nLast Submission:2026-04-01T13:08:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348592", "uuid": "11947a14-06e0-47ec-b506-f0a797f3205c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348592", "to_ids": true, "type": "md5", "uuid": "44387a32-f1a0-4a68-a915-b3f12c171475", "value": "10d6e04270806d8547a5a03a912a5dd9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346097", "to_ids": true, "type": "sha1", "uuid": "31433b5d-cda6-4212-9b04-ce18459f65f8", "value": "03f94497683ba6db6ba98cbe8070684eb9ebcd13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346097", "to_ids": true, "type": "sha256", "uuid": "2b737e6a-3414-43be-b202-a01aa55d4957", "value": "1d10d8f5a420d0e4683b4cb40bcf0c984d1e7ea1f3b4442a00a525584632ac11", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345374", "to_ids": true, "type": "ssdeep", "uuid": "3f438985-0265-46d4-a80b-430488b773a8", "value": "49152:/z7mR4kwsjcks87ZSqKOO6H94dD1rWJjnQE6MQp0:77Pp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345374", "to_ids": false, "type": "size-in-bytes", "uuid": "03876036-b56c-466a-829f-656e032dac4e", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345374", "to_ids": true, "type": "vhash", "uuid": "52d52760-95b5-41bb-91a2-579d648aa798", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345374", "to_ids": true, "type": "filename", "uuid": "3b57bd92-08da-4448-905f-eb4c81f4c52e", "value": "k0d649u.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345374", "to_ids": false, "type": "text", "uuid": "d87b912c-de9b-4783-9eac-c4820aaed391", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:56/70\nFirst Submission:2026-01-22T20:22:54.000000+00:00\nLast Submission:2026-01-26T03:09:49.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348613", "uuid": "b3e42202-8f04-4302-a165-5e020ee70e4a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348613", "to_ids": true, "type": "md5", "uuid": "f97e2743-342d-473a-9c44-24fab0bcc963", "value": "ec37a6c4866b7324fce2f11b0e89c4c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346098", "to_ids": true, "type": "sha1", "uuid": "72d6ca09-9054-4f08-971b-f4d7492c0218", "value": "6c6f13872bb7d18692bfc04757302f98d951217b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346099", "to_ids": true, "type": "sha256", "uuid": "ad983c5d-de49-4a99-aba6-349d575e3290", "value": "24f6c0ca39b2a5593086ff56d818ddfbde121f8e44d54faa762e510397dc9db7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345396", "to_ids": true, "type": "ssdeep", "uuid": "6c022b9c-fa9a-4d96-9e80-85ab9e4c9516", "value": "49152:/z7md4kwsjcks87ZSqKOO6H94dD1rWJjnQExMQp0:770p0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345396", "to_ids": false, "type": "size-in-bytes", "uuid": "f445d09a-345a-4f33-8311-47e29146673b", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345396", "to_ids": true, "type": "vhash", "uuid": "4f66364c-73fd-4665-8e13-dab3f90f93ad", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345396", "to_ids": true, "type": "filename", "uuid": "359022ff-31a1-4548-a75f-c74a8be931fa", "value": "2026-03-08_ec37a6c4866b7324fce2f11b0e89c4c2_akira_cobalt-strike_glassworm_poet-rat" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345396", "to_ids": false, "type": "text", "uuid": "380621ff-fccf-4f11-9c02-cda052b8d668", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:53/70\nFirst Submission:2026-03-07T06:59:59.000000+00:00\nLast Submission:2026-03-08T03:06:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348634", "uuid": "ff43374c-d78d-4a1f-b95a-0aa1e75b4d60", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348634", "to_ids": true, "type": "md5", "uuid": "7d507ff2-82ee-412a-a8d6-e34eb0777669", "value": "e7288f4e4cf20e219a0394d5dabb82b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346100", "to_ids": true, "type": "sha1", "uuid": "334618eb-403b-4b18-9bf3-8b89dbfafb8a", "value": "abbd165dab5580e1905e87a8ac5139a4232fd908", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346100", "to_ids": true, "type": "sha256", "uuid": "33d7c50d-1d3f-4e9e-9d8f-ce2c28b6dd27", "value": "589d9480fbfec2d8e61638eb0b537183d0f9977411fd1d2c0f8eb611feebe880", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345418", "to_ids": true, "type": "ssdeep", "uuid": "c5a632e8-523f-4e83-b4d7-b96c4ba47ce7", "value": "24576:Gqy4/fatd8Dk/Hj7POo6NSoiBjLee6XPTH/I5UFdy82eI:Gqy4/Ctd8Dk/Hj7P16NSdjLee6fTH/In" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345418", "to_ids": false, "type": "size-in-bytes", "uuid": "69a8ed44-5b0d-4da7-9406-42affd6e7ed7", "value": "870920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345418", "to_ids": true, "type": "filename", "uuid": "db09a755-9483-4211-9607-fd64d11916cf", "value": "2qfguc.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345418", "to_ids": false, "type": "text", "uuid": "3d32758c-da01-4f5e-a41c-8826b4a87fe2", "value": "Type Description: ELF\nMicrosoft: Ransom:Linux/Inc.B!MTB\nVT Total Detection:31/62\nFirst Submission:2026-03-30T11:27:51.000000+00:00\nLast Submission:2026-03-30T11:27:51.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348655", "uuid": "72d47658-7253-4625-b766-0854fba055a8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348655", "to_ids": true, "type": "md5", "uuid": "dcbca602-ceab-4fea-9fa9-0207ef93171c", "value": "efbeeb7c816919d729b74a2ecb909bb6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346101", "to_ids": true, "type": "sha1", "uuid": "00b1bc7c-b856-4eb8-bcf5-659eb378d4ae", "value": "44af7a778a0089836625b10df1ae91c99a984170", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346101", "to_ids": true, "type": "sha256", "uuid": "a0a5d9e0-070f-4235-8581-67b3da37c338", "value": "5cc212f84d2bf3fbab165aaf09b16e00fcf2f1ccd880d24b14404c53dcdbf241", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345440", "to_ids": true, "type": "ssdeep", "uuid": "a105fb4d-916d-4133-8c9a-654e72a944b6", "value": "24576:eqy4VsWHgFJ2EdXFzP+8JpnwBj7gXHTIa+pP9yBn+I:eqy4aWHgFJ2EdXFzP+8JpwBj7g3TIa+i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345440", "to_ids": false, "type": "size-in-bytes", "uuid": "72a5aade-6a70-4f7c-9e92-20570e26ba28", "value": "870920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345440", "to_ids": true, "type": "filename", "uuid": "2a8762cd-a4c6-4fdd-8ca7-580e49626da5", "value": "7hhel.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345440", "to_ids": false, "type": "text", "uuid": "2aa7ec84-bde3-44ed-833c-4d08407cf869", "value": "Type Description: ELF\nMicrosoft: Ransom:Linux/Inc.B!MTB\nVT Total Detection:34/63\nFirst Submission:2025-09-22T04:37:31.000000+00:00\nLast Submission:2025-09-22T04:50:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348676", "uuid": "6d0d76dc-3a05-44ef-936b-8dafff13b78c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348676", "to_ids": true, "type": "md5", "uuid": "29ee8d64-c6bd-4d18-86cd-02b7cbf0e1b7", "value": "ef88cf8a71b4dfca2c46cc3fedf70246", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346102", "to_ids": true, "type": "sha1", "uuid": "48094007-8505-441f-a92d-1a35b70240f2", "value": "073bb9994c0688aa092ce81b077199088c9353ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346102", "to_ids": true, "type": "sha256", "uuid": "2f5014cc-02fa-4f9a-9042-6ea24315d52c", "value": "60aeb9f7bccf377ff02ed64783e66a62c0f976878d9729b067bc7e5b0b9da9d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345462", "to_ids": true, "type": "ssdeep", "uuid": "985da2d2-5381-4e46-8ef9-670b01d0d77a", "value": "24576:eqy4VsWHgFJ2EdXFzP+8JpnwBj7rXHTIa+pP9yBn+I:eqy4aWHgFJ2EdXFzP+8JpwBj7r3TIa+i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345462", "to_ids": false, "type": "size-in-bytes", "uuid": "7449180b-9d87-4b2f-96a1-9f20ba3dec46", "value": "870920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345462", "to_ids": true, "type": "filename", "uuid": "0943a52c-e397-4ab5-9649-138654c4ceeb", "value": "3ctjhm3.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345462", "to_ids": false, "type": "text", "uuid": "7a11427d-d5a4-4231-9369-7550df6a681a", "value": "Type Description: ELF\nMicrosoft: Ransom:Linux/Inc.B!MTB\nVT Total Detection:27/64\nFirst Submission:2025-08-21T20:47:19.000000+00:00\nLast Submission:2025-08-21T20:47:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348698", "uuid": "c2bcb064-214b-4f8c-8384-daac01fdba29", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348698", "to_ids": true, "type": "md5", "uuid": "651b3399-826a-4419-a14a-2191bed0ffe9", "value": "78d359a87ae75ece08976e8b14d877fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346104", "to_ids": true, "type": "sha1", "uuid": "e01d3c79-154f-405f-96ca-ce881d7f0de6", "value": "2c1dc7f4f97ea6a9e4d0a2e69aea849655bfc9d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346104", "to_ids": true, "type": "sha256", "uuid": "ba3f40b8-b297-42cf-a472-9451f887c7d6", "value": "6bf155b269d452f3c3b62832b27bbebe4da436e228dbf521155b1d5989e3743f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345484", "to_ids": true, "type": "ssdeep", "uuid": "9cda8fbb-e077-46d9-8d36-8c543945643f", "value": "49152:/z7mt4kwsjcks87ZSqKOO6H94dD1rWJjnQEZMQp0:77cp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345484", "to_ids": false, "type": "size-in-bytes", "uuid": "252e2534-bfef-4cf6-a52e-65f11a49c3a7", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345484", "to_ids": true, "type": "vhash", "uuid": "f675512c-c5bc-4994-a723-204749eaa638", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345484", "to_ids": true, "type": "filename", "uuid": "859c3fab-e947-4a06-9a35-8ac4d49ea8ad", "value": "2026-04-08_78d359a87ae75ece08976e8b14d877fe_akira_cobalt-strike_glassworm_poet-rat" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345484", "to_ids": false, "type": "text", "uuid": "49851a19-5c52-4c70-9d57-bd49f1872c25", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:54/70\nFirst Submission:2026-04-06T16:28:44.000000+00:00\nLast Submission:2026-04-08T06:08:53.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348719", "uuid": "688081f8-c037-4ecd-8b21-541163a68ced", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348719", "to_ids": true, "type": "md5", "uuid": "5f9491e7-5b84-4060-8ff5-449e4c605d77", "value": "8875172a0977677ce6e30277ef6fea79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346105", "to_ids": true, "type": "sha1", "uuid": "4fdaadc5-3e78-4dae-aaed-6381bfeb3d33", "value": "8bd32c26db7ebd8d0764a8292d536a76fd8b1d5e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346105", "to_ids": true, "type": "sha256", "uuid": "41aab134-fb51-44a0-b9ad-321be38384dc", "value": "765508aa2ec6a1b73a76a23f4fa559d32355622748c91a46ed7b315eae2ee60a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345505", "to_ids": true, "type": "ssdeep", "uuid": "a41f75ea-5597-49df-92b0-de4a19de267f", "value": "49152:/z7ml4kwsjcks87ZSqKOO6H94dD1rWJjnQEAMQp0:77lp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345505", "to_ids": false, "type": "size-in-bytes", "uuid": "08fa7eb5-76d1-46f8-b774-72255ffe63ce", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345505", "to_ids": true, "type": "vhash", "uuid": "0443ee20-a6a6-43d6-be06-f7545108eb74", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345505", "to_ids": true, "type": "filename", "uuid": "075f0dd4-6852-4220-99bd-78968a4a92a1", "value": "bjiw49.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345505", "to_ids": false, "type": "text", "uuid": "2070122b-2c66-476e-b064-8009caf88820", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:54/69\nFirst Submission:2026-01-02T10:37:12.000000+00:00\nLast Submission:2026-01-03T04:08:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348739", "uuid": "2f9a50f2-0e97-4805-8d18-ea00a863d6dc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348739", "to_ids": true, "type": "md5", "uuid": "59286447-2948-4984-93e2-832bcf9c5d52", "value": "0ed1f07b1eec40b0452316c842ab3182", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346106", "to_ids": true, "type": "sha1", "uuid": "3412cac5-1879-4c7c-b019-7ff682c6b00f", "value": "81b41cf5effc3b259436d9864e8e2db703ad3743", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346106", "to_ids": true, "type": "sha256", "uuid": "b599e2a9-addc-4fe0-a75f-cdc1b7a05412", "value": "7f37351979c249417cb180b4ede0ed17e5fe2a1f08add4d72606b589f8fdb245", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345527", "to_ids": true, "type": "ssdeep", "uuid": "7398aafd-3167-43c7-a847-a0fac5a5feae", "value": "24576:eqy4VsWHgFJ2EdXFzP+8JpnwBj7QXHTIa+pP9yBn+I:eqy4aWHgFJ2EdXFzP+8JpwBj7Q3TIa+i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345527", "to_ids": false, "type": "size-in-bytes", "uuid": "9a6da21e-bebd-4a19-a4d5-55407c5f7970", "value": "870920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345527", "to_ids": true, "type": "filename", "uuid": "9a264766-a049-464e-8784-109753901490", "value": "7l73h.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345527", "to_ids": false, "type": "text", "uuid": "2c9c1a5f-072f-4b60-8635-060c87507003", "value": "Type Description: ELF\nMicrosoft: Ransom:Linux/Inc.B!MTB\nVT Total Detection:32/63\nFirst Submission:2025-11-12T09:28:10.000000+00:00\nLast Submission:2025-11-12T09:28:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348763", "uuid": "d2f2c22b-0b63-4383-b656-4de0c592892d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348763", "to_ids": true, "type": "md5", "uuid": "29a8fd7d-5de6-4ff9-aad9-f30e4dc49875", "value": "a9bc032353bd246ba50af1b8d4849bfd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346107", "to_ids": true, "type": "sha1", "uuid": "568d0192-2f37-49a0-9fce-c6a0ff45613f", "value": "9dcfffc9f252189a4ad9d144ccdc8048a4382828", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346107", "to_ids": true, "type": "sha256", "uuid": "0c664cdd-2212-41d9-9ff5-d55f0c5a5221", "value": "8d1a22c430252f29611766b8e4a82af0fba60d609246463466b384d6d4793df4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345549", "to_ids": true, "type": "ssdeep", "uuid": "05953e05-1c10-4476-b496-9093fac25ea0", "value": "49152:/z7mV4kwsjcks87ZSqKOO6H94dD1rWJjnQEJMQp0:770p0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345549", "to_ids": false, "type": "size-in-bytes", "uuid": "dd568857-fa3f-4945-a4f7-c700dfa52f59", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345549", "to_ids": true, "type": "vhash", "uuid": "e45b7ef6-7ad6-4d27-a7d7-0fd50813c2e5", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345549", "to_ids": true, "type": "filename", "uuid": "cbd9674c-a1f5-4b32-bbaf-84861c439c89", "value": "2026-04-11_a9bc032353bd246ba50af1b8d4849bfd_akira_cobalt-strike_glassworm_poet-rat" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345549", "to_ids": false, "type": "text", "uuid": "18a32218-7c8f-4996-9363-e50ae297b36b", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:53/70\nFirst Submission:2026-04-10T19:48:10.000000+00:00\nLast Submission:2026-04-11T03:34:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348784", "uuid": "f0ebb933-4f5e-4d29-b061-40f33f0c2d7d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348784", "to_ids": true, "type": "md5", "uuid": "e4356d65-f1b4-477c-bc8f-4bf1e698bb9c", "value": "3511a9aa2acae34aaadd03073fe09e39", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346108", "to_ids": true, "type": "sha1", "uuid": "7ea5cb93-437a-4796-9b99-3d643a08bf63", "value": "02d75d08c89c100685ccb5a72605a22a3cf2460a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346108", "to_ids": true, "type": "sha256", "uuid": "4629f691-ed06-4f45-ac5e-92b0f55308cf", "value": "90e46e89fec2108a1cb4850bb33e3563e92a14d04e1e613ac8c9311f152d294c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345571", "to_ids": true, "type": "ssdeep", "uuid": "85e72e94-54b7-4f89-a205-c02cc1c0fefc", "value": "49152:/z7mB4kwsjcks87ZSqKOO6H94dD1rWJjnQEpMQp0:77Yp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345571", "to_ids": false, "type": "size-in-bytes", "uuid": "1ef1195b-2726-4568-898d-51de7d0c0983", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345571", "to_ids": true, "type": "vhash", "uuid": "367cfe96-1683-40b4-9603-7122cd093dc1", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345571", "to_ids": true, "type": "filename", "uuid": "c7b0749e-82e8-4f54-8edf-0d698517b8d2", "value": "0m6m882x2.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345571", "to_ids": false, "type": "text", "uuid": "ecdb0f80-d343-4b64-a86f-f0b54609103c", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:55/69\nFirst Submission:2026-01-31T17:47:09.000000+00:00\nLast Submission:2026-02-02T09:59:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348805", "uuid": "5a764b9c-daa1-4ba5-9764-d75b2fd5319a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348805", "to_ids": true, "type": "md5", "uuid": "3a967df5-2367-4300-8e9d-d058aacac580", "value": "2de9c6065dd5c0bcd67cc4d90c10788a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346109", "to_ids": true, "type": "sha1", "uuid": "b491e6c7-8c7b-4d55-b10f-776631a2183b", "value": "ec5366d5b9e6ef094c1583170c85f4fe4f38e1e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346109", "to_ids": true, "type": "sha256", "uuid": "6e16bc1c-e254-465d-bcce-27b9a9725a9f", "value": "97aebda5482899fef84a24e456bff055acaa47e5ab4029f768d9e0c62a660ce2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345592", "to_ids": true, "type": "ssdeep", "uuid": "7922ca1f-c134-44ff-bbc8-c42101c05010", "value": "49152:/z7mJ4kwsjcks87ZSqKOO6H94dD1rWJjnQEkMQp0:775p0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345592", "to_ids": false, "type": "size-in-bytes", "uuid": "df4e8941-52ec-485e-b68d-e3ca802d5b56", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345592", "to_ids": true, "type": "vhash", "uuid": "bbaff3b7-665e-49f3-8316-6cac53243813", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345592", "to_ids": true, "type": "filename", "uuid": "45eb1004-6692-41be-aaf6-2dbf0e75046d", "value": "inc.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345592", "to_ids": false, "type": "text", "uuid": "c80c9b31-bf4b-4a6b-9289-bd9db710c18a", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:55/70\nFirst Submission:2026-01-23T13:09:12.000000+00:00\nLast Submission:2026-02-13T05:42:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348826", "uuid": "81266269-0549-4b9f-b725-0a42b4690f40", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348826", "to_ids": true, "type": "md5", "uuid": "95ed22ce-433a-412c-be44-33ebd73c227f", "value": "fcc3cbe8bfe18f08eadda3acd4258369", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346111", "to_ids": true, "type": "sha1", "uuid": "26dd2334-67ec-4291-92b2-16632b400478", "value": "f155e31fdde0c66200b717335038faee161c2812", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346111", "to_ids": true, "type": "sha256", "uuid": "ce930583-01e8-492c-84c3-1bb5e11ad937", "value": "bf8c45e5aa9551a17eefbd1d179422c32b4309c47ee9a3f315bb80ed6d4f7efc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345614", "to_ids": true, "type": "ssdeep", "uuid": "2613143e-8dda-4eb4-9249-e72e803092a5", "value": "49152:/z7mp4kwsjcks87ZSqKOO6H94dD1rWJjnQEhMQp0:77sp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345614", "to_ids": false, "type": "size-in-bytes", "uuid": "e6e9f251-be1e-43a6-bdec-94f6b34dd4f6", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345614", "to_ids": true, "type": "vhash", "uuid": "f8df0f58-35bb-4f2d-bbc7-d97b1d453d73", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345614", "to_ids": true, "type": "filename", "uuid": "1af51bf7-c12a-4fcd-8120-9ec6316bb20d", "value": "61pd6n3t.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345614", "to_ids": false, "type": "text", "uuid": "fd5dbfcc-8151-4254-8b28-42d10830f1ec", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:56/70\nFirst Submission:2026-04-08T15:46:45.000000+00:00\nLast Submission:2026-04-10T03:21:06.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348848", "uuid": "d5e63dae-2ea1-4de8-8482-85cf27c294b9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348848", "to_ids": true, "type": "md5", "uuid": "e311da17-11e4-4fa3-b0e5-1dd924ced6eb", "value": "32827e9bdf630d974531c2f715d2426c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346112", "to_ids": true, "type": "sha1", "uuid": "056b7cd8-6e9d-4ca5-8a29-ff6beda982c3", "value": "266bab046cf4b7ddd9655416179f07bcab59d409", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346112", "to_ids": true, "type": "sha256", "uuid": "101b9be9-cad8-46bc-8d2e-3a9986ae292e", "value": "d26bfb0147f60dc6500a9298d521ee67b49daaf4b8f8be54e7cc8fd86a597570", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345636", "to_ids": true, "type": "ssdeep", "uuid": "d351937d-b822-428b-be28-876f87baa155", "value": "49152:/z7mR4kwsjcks87ZSqKOO6H94dD1rWJjnQEeMQp0:77bp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345636", "to_ids": false, "type": "size-in-bytes", "uuid": "cb15158a-5a3d-4675-898f-dffd0125b0e6", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345636", "to_ids": true, "type": "vhash", "uuid": "4237d2f4-98a9-422b-bf52-272a873f7d06", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345636", "to_ids": true, "type": "filename", "uuid": "7dc0de61-e6ec-45f4-87b7-d6d503ac46c5", "value": "mk1yd.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345636", "to_ids": false, "type": "text", "uuid": "c202846e-d06b-4c7b-b4b3-22ba2f2cd6cb", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:53/69\nFirst Submission:2026-01-01T23:29:43.000000+00:00\nLast Submission:2026-01-01T23:29:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348871", "uuid": "43fe0c0c-71fd-4701-8459-accc14ab50d5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348871", "to_ids": true, "type": "md5", "uuid": "46d965a5-cbbf-4e5e-8723-bfd7eedc16d4", "value": "aeebf82422b35c95eff9fe6c188b3044", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346113", "to_ids": true, "type": "sha1", "uuid": "c5f7a5ec-813b-4ad1-b9dd-14a255c4e3e2", "value": "66b4fe7c167799a53ec793f131a7e387216cc813", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346113", "to_ids": true, "type": "sha256", "uuid": "5ff3001d-a1fd-4718-96a9-d2f2aaa657fd", "value": "d65120291dee76c694f8bea54841f7f68329b499b28f4aee5ea5c9369a7432cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345658", "to_ids": true, "type": "ssdeep", "uuid": "5858e7b6-85bd-4595-89f0-aec6fc80d699", "value": "49152:/z7mt4kwsjcks87ZSqKOO6H94dD1rWJjnQETMQp0:77Op0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345658", "to_ids": false, "type": "size-in-bytes", "uuid": "e3695e83-fdb9-44d3-9c2d-7f3b74d92c12", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345658", "to_ids": true, "type": "vhash", "uuid": "d9ca6d1d-ef8a-48da-bf56-db089011b53c", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345658", "to_ids": true, "type": "filename", "uuid": "72bff60f-1ef7-4be7-9a3e-cdba1485cc10", "value": "a3mnw9.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345658", "to_ids": false, "type": "text", "uuid": "5f4a96b4-cc3c-4329-8582-ea9b4b4c4590", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:37/70\nFirst Submission:2026-01-13T10:58:44.000000+00:00\nLast Submission:2026-01-13T10:58:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348892", "uuid": "6ab67997-d883-4e49-9321-bd75d9c0a33b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348892", "to_ids": true, "type": "md5", "uuid": "432efb79-4174-4118-af9f-3bfec9346e38", "value": "85befc3111bc28dc9715570a068412ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346115", "to_ids": true, "type": "sha1", "uuid": "c520d19a-dd5b-46ae-bec8-db782fb9555c", "value": "a088e9ba0a9d8f33bfd8f6294188c58eb01b70d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346115", "to_ids": true, "type": "sha256", "uuid": "b196126a-3b3d-4745-b7a8-8df2abc7af80", "value": "dc9938f51150d13a69fc25f3f19052eacb1bf0a086fd5cf39762501fb3ddd7da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345679", "to_ids": true, "type": "ssdeep", "uuid": "4337af86-34b8-43dd-9e15-eed0363c264c", "value": "49152:/z7mh4kwsjcks87ZSqKOO6H94dD1rWJjnQEWMQp0:77Hp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345679", "to_ids": false, "type": "size-in-bytes", "uuid": "b3ae4ccb-24a0-4d09-b502-0c751574891d", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345679", "to_ids": true, "type": "vhash", "uuid": "1b488115-2a64-4793-9b7a-243c590abdfa", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345679", "to_ids": true, "type": "filename", "uuid": "c33f0575-a09e-4fa1-83cb-72dbe8af5522", "value": "win.bin" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345679", "to_ids": false, "type": "text", "uuid": "426685e7-f081-48dc-8539-049002d5aff8", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:38/70\nFirst Submission:2026-03-04T11:12:36.000000+00:00\nLast Submission:2026-03-12T20:00:36.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348913", "uuid": "38c25e67-41f9-4bab-ad21-86cc5f61243b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348913", "to_ids": true, "type": "md5", "uuid": "d599ee93-1b04-4c23-9dfd-73f749a9f151", "value": "be3d939747ad05764b2d9dd461697093", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346116", "to_ids": true, "type": "sha1", "uuid": "ef88301c-aed6-4508-801a-f6f24daea8fb", "value": "c192ef6c4143b8df43ea7855224e77ecd4f34080", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346116", "to_ids": true, "type": "sha256", "uuid": "2bf8f2f5-a748-4e74-b6fc-e295584a4015", "value": "ea721240c14e3d14f8d88e0020880448c6c602f1180a1e5dbe40871cfeedcc22", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345701", "to_ids": true, "type": "ssdeep", "uuid": "2be9bfd7-d9f8-4f22-867f-c963aa5b87e0", "value": "49152:/z7mh4kwsjcks87ZSqKOO6H94dD1rWJjnQEFMQp0:77kp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345701", "to_ids": false, "type": "size-in-bytes", "uuid": "06c3c53d-ba7f-4ae8-af6d-0f4ca5942064", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345701", "to_ids": true, "type": "vhash", "uuid": "d22523fa-ef64-4d4b-a282-7bd2aa5781cf", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345701", "to_ids": true, "type": "filename", "uuid": "c8467440-eac4-4b00-a3dc-f9ebd44f91a7", "value": "vw06lg0y.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345701", "to_ids": false, "type": "text", "uuid": "7cb05036-40bd-4c9a-9d6e-5d683667abb5", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:53/69\nFirst Submission:2026-04-11T21:02:13.000000+00:00\nLast Submission:2026-04-12T23:57:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348934", "uuid": "59cf1a07-8a45-49ac-bdec-c908f12ba48e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348934", "to_ids": true, "type": "md5", "uuid": "55a9a897-8fcb-4e47-b35b-8d4dee4a3ad1", "value": "ce0a95fb73a901a2e3a449e62850f4e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346117", "to_ids": true, "type": "sha1", "uuid": "af4c8c9e-e41b-4683-adc9-b13ecae213ec", "value": "5b63a1dc187670723d02b4b675255a20a70d10b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346117", "to_ids": true, "type": "sha256", "uuid": "4b3ceaa0-8818-4122-827a-83a3b565dfdb", "value": "f6a01d0246ce31faf6938ea488086d4358505405a4ef5c5faa482e79e92cb347", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345723", "to_ids": true, "type": "ssdeep", "uuid": "243ec5a0-bbfc-4c02-9edb-73f9b5a165ec", "value": "49152:/z7m54kwsjcks87ZSqKOO6H94dD1rWJjnQEDMQp0:77Kp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345723", "to_ids": false, "type": "size-in-bytes", "uuid": "329d3ba5-edc1-4025-8fe0-7ec8ca143ca4", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345723", "to_ids": true, "type": "vhash", "uuid": "ee22e58a-64f3-4611-98a8-6298d9e3e459", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345723", "to_ids": true, "type": "filename", "uuid": "13ed45b5-c031-4813-8762-4bfa5c9bb88d", "value": "qgp2s6z.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345723", "to_ids": false, "type": "text", "uuid": "6c545c8b-fc74-4a74-98fb-092ba25390b7", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:53/69\nFirst Submission:2026-01-21T21:44:26.000000+00:00\nLast Submission:2026-01-21T21:44:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348956", "uuid": "32fe4b12-077e-4c3f-9c03-a1e00cc794ad", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348956", "to_ids": true, "type": "md5", "uuid": "89a14a39-2a77-40e9-ab34-ac371774a554", "value": "a700329f65470db3b7489005218f3937", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346118", "to_ids": true, "type": "sha1", "uuid": "f6d80469-8b01-407d-8688-18fe3248c76d", "value": "7ff4e2df39af1f1b8e726e674e69fca7c280f06a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346118", "to_ids": true, "type": "sha256", "uuid": "5cb37480-5f03-4202-a405-009f68b1da74", "value": "ff5da8f0330a4c581c37284c74aae2683c007dc6e406e1e2e6803e7bb398b77b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782345745", "to_ids": true, "type": "ssdeep", "uuid": "3b4aab44-94a1-440d-a68e-70d74597f582", "value": "49152:/z7ml4kwsjcks87ZSqKOO6H94dD1rWJjnQECMQp0:77np0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782345745", "to_ids": false, "type": "size-in-bytes", "uuid": "83c30295-f85d-4056-8232-077c610cc8e5", "value": "2206208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782345745", "to_ids": true, "type": "vhash", "uuid": "c6e97955-76b1-49e7-bc9c-da8393de7c85", "value": "0260a76d1555655c0d5d1099za1e1z4hz14z197z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782345745", "to_ids": true, "type": "filename", "uuid": "5ef21715-e15e-42c3-a693-2fb3b22a51e1", "value": "tt24n8xsl.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782345745", "to_ids": false, "type": "text", "uuid": "97db619f-13aa-4412-857a-df3b784f8eae", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Inc.BAA!MTB\nVT Total Detection:53/70\nFirst Submission:2026-01-26T09:50:26.000000+00:00\nLast Submission:2026-01-26T09:50:26.000000+00:00" } ] } ] } }