{ "Event": { "analysis": "1", "date": "2026-06-03", "extends_uuid": "", "info": "[Threat Intel] Argamal: Malware hidden in hentai games", "protected": false, "publish_timestamp": "1780629606", "published": true, "threat_level_id": "3", "timestamp": "1780629606", "uuid": "3d73990f-7cf6-48cf-91e6-3ae67ec56bf5", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#177fb7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#82a529", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Shortcut Modification - T1547.009\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#7e341c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Users - T1564.002\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#15cd0b", "local": false, "name": "misp-galaxy:target-information=\"Russia\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#5ed128", "local": false, "name": "misp-galaxy:target-information=\"Germany\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Vietnam\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570806", "to_ids": false, "type": "link", "uuid": "d2062a7c-3ba5-43d4-9f4a-339629870cbd", "value": "https://securelist.com/argamal-rat-distributed-with-hentai-games/119999/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780570806", "to_ids": false, "type": "text", "uuid": "79c5e33b-5155-4c8b-849d-f4fec406e87b", "value": "In April 2026, researchers discovered a malware campaign targeting players of adult-themed games. The infected games install a previously unknown implant called Argamal that downloads and executes a RAT after several days, resulting in full system compromise. The malware uses COM hijacking to persist, replacing the InprocServer32 entry for Windows Color System Calibration Loader DLL. Delivery occurs through trojanized games distributed via dedicated websites and torrent trackers, containing modified FFmpeg DLLs that load malicious components. The RAT provides broad functionality including system control, surveillance, file operations, and reconnaissance capabilities. Hundreds of victims have been identified primarily in Russia, Brazil, Germany, and Vietnam. Attribution suggests a Spanish-speaking developer, with infrastructure pointing to ASN 11664 and multiple C2 domains." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780570806", "to_ids": false, "type": "text", "uuid": "e51f49a8-089f-4e23-96e5-ac4fe329b253", "value": "Name: Argamal: Malware hidden in hentai games\nAuthor: AlienVault\nAdversary: \nTags: [\"credential theft\", \"powershell\", \"pixeldrain\", \"argamal\", \"termixia\", \"adult gaming\"]\nTgtd countries: [\"Russian Federation\", \"Brazil\", \"Germany\"]\nMlwr families: [\"Argamal\", \"Termixia\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1218.011\", \"T1056.001\", \"T1036.005\", \"T1204.002\", \"T1573.001\", \"T1497.001\", \"T1082\", \"T1106\", \"T1140\", \"T1547.009\", \"T1112\", \"T1564.002\", \"T1041\", \"T1059.001\", \"T1027\", \"T1071.001\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780623588", "to_ids": true, "type": "hostname", "uuid": "4a28446d-dd5d-4361-8671-ec7eca1c8226", "value": "asper1.freeddns.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570806", "to_ids": false, "type": "vulnerability", "uuid": "8e27c0b2-f718-46e3-8318-8b9193355ea1", "value": "CVE-2026-3102" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623447", "to_ids": true, "type": "sha1", "uuid": "b6e8c3ec-4bcd-45cb-9676-fe2dea1202af", "value": "29f1d346a6e71774c7dad25b90f446b2974393df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623449", "to_ids": true, "type": "sha1", "uuid": "6a79d901-ceb5-405a-8da7-d7d6dcb164bd", "value": "5f1f3689bcf23de1b280b5f35712946da0f7978f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623450", "to_ids": true, "type": "sha1", "uuid": "9aa02b22-ea12-47a3-bd9a-315c7bc46a0f", "value": "69331cfdac792dc79240e6a6bb6e803eabd70beb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623451", "to_ids": true, "type": "sha1", "uuid": "e154b36d-d205-46c2-ab3c-0839bae9bf54", "value": "c2d9d48b3b10bd58cdf5df9463e3ffcd60533ff3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623451", "to_ids": true, "type": "sha1", "uuid": "c5386301-e30c-4a80-9167-79e11c15c5c7", "value": "e05f1767c2a337910ed75e90288838d6d0541164", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623452", "to_ids": true, "type": "sha1", "uuid": "9752e931-7c83-4087-a53c-14b4e62b482f", "value": "e815a9b418d09c2d4bcd074c2c0bc21406eeb22f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780623609", "to_ids": true, "type": "ip-dst", "uuid": "30148417-8360-4360-bb82-5d4f16af2cba", "value": "181.116.218.56", "Tag": [ { "colour": "#c880c6", "local": false, "name": "asn:asn=\"11664\"", "relationship_type": "" }, { "colour": "#1b8387", "local": false, "name": "asn:as-owner=\"Techtel LMDS Comunicaciones Interactivas S.A.\"", "relationship_type": "" }, { "colour": "#429a8a", "local": false, "name": "asn:as-country=\"AR\"", "relationship_type": "" }, { "colour": "#843623", "local": false, "name": "misp-galaxy:country=\"argentina\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780623631", "to_ids": true, "type": "ip-dst", "uuid": "bbc252c0-9e0c-4708-9535-4e06bc314849", "value": "186.158.223.35", "Tag": [ { "colour": "#ea09ac", "local": false, "name": "asn:asn=\"19037\"", "relationship_type": "" }, { "colour": "#537415", "local": false, "name": "asn:as-owner=\"AMX Argentina S.A.\"", "relationship_type": "" }, { "colour": "#429a8a", "local": false, "name": "asn:as-country=\"AR\"", "relationship_type": "" }, { "colour": "#843623", "local": false, "name": "misp-galaxy:country=\"argentina\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780623652", "to_ids": true, "type": "hostname", "uuid": "d235b85b-61e8-4806-8554-79eb74d838e3", "value": "country1.ignorelist.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780623673", "to_ids": true, "type": "hostname", "uuid": "a403205b-284b-4bce-825c-eefde5cd1772", "value": "winst0.kozow.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780609208", "to_ids": false, "type": "malware-type", "uuid": "4ce2d713-4aa4-4cf5-8578-dc52cda4c3c9", "value": "Argamal", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780623694", "to_ids": true, "type": "url", "uuid": "16169512-66ad-4558-b385-f9f5ed2cb3c5", "value": "https://github.com/gmz159/u", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780623715", "to_ids": true, "type": "url", "uuid": "05a64c9d-f3ca-4378-adf9-2758c36e899e", "value": "https://github.com/DnyP/files", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780623737", "to_ids": true, "type": "url", "uuid": "6dfbb072-3389-49a5-8706-0fe3d44501cd", "value": "https://github.com/mgzv/p", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623758", "uuid": "2c97c5c4-6736-40ce-a5e6-9f9bdd8349f7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623758", "to_ids": true, "type": "md5", "uuid": "a11f5678-1521-4d4d-ba7c-964fcf2cc51f", "value": "13f881e0784cc8402141d8848c0d6a6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623430", "to_ids": true, "type": "sha1", "uuid": "07e99305-59c4-409e-b50f-d3ca95dcbe85", "value": "02819d200d1424882af81cb504b3e8614b32397a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623430", "to_ids": true, "type": "sha256", "uuid": "ef342036-18bb-427e-b16c-fff32932714c", "value": "f8c860076d3191e4cb5ab1ca96ddad0b387c598d48260ce72c7fa0e93f4bea6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621321", "to_ids": true, "type": "ssdeep", "uuid": "203804c4-4c54-44cb-a8c2-6235c8e99046", "value": "12288:SZH7YwE4Ep7mn4hF3Gac2B9N1a55UU/zj1vPCr1bE1sK7sk9PW2TEqbcH0G6ixn:S5fxp4hF3c2BrdseK7skZWY20G/n" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621321", "to_ids": false, "type": "size-in-bytes", "uuid": "f72f8d41-1cd3-4a56-bcfe-0d35e7ea6485", "value": "1735944" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621321", "to_ids": true, "type": "vhash", "uuid": "e7829b3f-42e5-4918-9602-fb7a6f3457fa", "value": "1160a65d5c0d1d1515156118z5c1z23z40cbza03cz4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621321", "to_ids": true, "type": "filename", "uuid": "44f8e5e6-458c-4d4d-b9d7-76b69721ff04", "value": "libGLESv2.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621321", "to_ids": false, "type": "text", "uuid": "da673e55-01d0-4193-8e2f-2db9ef930a10", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:36/71\nFirst Submission:2026-04-26T15:19:08.000000+00:00\nLast Submission:2026-05-02T13:39:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623779", "uuid": "bd45f3fa-3387-4c79-9d57-b99db3c15de8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623779", "to_ids": true, "type": "md5", "uuid": "6ab0bc03-62ba-40fb-84ec-7cb521d373d4", "value": "91ab2788b4eb71d1edc9475e47befabe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623431", "to_ids": true, "type": "sha1", "uuid": "0ad7cd61-5bfd-4d31-a93a-19ce4963dc03", "value": "1405a3c5e0aeb08012484134e16cdec4ab29b4a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623431", "to_ids": true, "type": "sha256", "uuid": "722a1483-7eb9-4b01-bb31-ce95bf409e15", "value": "c3b66295b863cd195a7207af8d21db4f608e4c19a1ad1a084f388f076a5a99f9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621343", "to_ids": true, "type": "ssdeep", "uuid": "8f0525c0-f1f9-4197-96d7-4b8b2af81ff2", "value": "3072:tyXdjKuu4SkLkvAk1cD6sQDnicJq7bzlHLuAdGPh1ttXCWnYlhmhcB:iKd3UkvED6DebZHLuHh1L/lA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621343", "to_ids": false, "type": "size-in-bytes", "uuid": "a143f165-bc63-4dc8-bb7c-c8fe808ca55f", "value": "254216" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621343", "to_ids": true, "type": "vhash", "uuid": "a2b5efe8-fafb-44c6-b2da-d0fbfe8f9e12", "value": "1250a65d5c0d1d1515155az41nzaez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621343", "to_ids": true, "type": "filename", "uuid": "e25a3add-b3ac-423b-988d-c9095fda4ff4", "value": "usshyn.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621343", "to_ids": false, "type": "text", "uuid": "9f396887-2e13-49c8-b3d3-b023abd9e062", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:45/71\nFirst Submission:2026-03-11T13:06:51.000000+00:00\nLast Submission:2026-03-14T07:22:01.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623800", "uuid": "1482d934-7900-4497-995f-97527dfcfb3a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623800", "to_ids": true, "type": "md5", "uuid": "e76e3ca4-3bc6-4fea-a9f9-a43a8316249d", "value": "ee5283d511467d64e93ff6c798dfded6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623433", "to_ids": true, "type": "sha1", "uuid": "a4e1163e-d6af-4009-98f9-459a3b718556", "value": "17f8f8f34dfa737f36182fed7ff9e9814a114058", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623433", "to_ids": true, "type": "sha256", "uuid": "4459de95-3def-498d-910c-7e06e66186fa", "value": "a2672f435e61fa2d9a3d3850cd45e76cd027e997af69773f5d570d81adb6b270", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621365", "to_ids": true, "type": "ssdeep", "uuid": "cd4b6ceb-4846-4be7-bc42-3695f45604d3", "value": "3072:AyXojKKK9oUe64uFMJVfRD2KSJG+XU5GXS4nz39Df2ICPhuqjksFVcaQ/:MKJ9264rD257XDJDfvNqj3dM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621365", "to_ids": false, "type": "size-in-bytes", "uuid": "3f0b085e-8537-45f9-885b-e4a0373db7a8", "value": "245760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621365", "to_ids": true, "type": "vhash", "uuid": "ca314325-2940-4f02-988f-9d47ec61e70b", "value": "1250a65d5c0d1d1515155az3enzaez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621365", "to_ids": true, "type": "filename", "uuid": "141a6031-19bd-49fb-88da-f4f29837bd24", "value": "jhmdzx.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621365", "to_ids": false, "type": "text", "uuid": "bdd6355a-2099-4071-a28b-7c933dc5fc8d", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Phonzy.A!ml\nVT Total Detection:42/71\nFirst Submission:2026-01-31T19:45:31.000000+00:00\nLast Submission:2026-03-20T01:24:19.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623822", "uuid": "ffa8f742-24f6-4f74-83f4-6aa968ec80e9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623822", "to_ids": true, "type": "md5", "uuid": "792a8c07-a15e-48eb-af2a-2a4cff73eb95", "value": "40af12f7c4bf2ab5218939cdfbc1bcaa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623433", "to_ids": true, "type": "sha1", "uuid": "4911d755-d2a8-4eed-8895-48324bcfc69a", "value": "2423a5bf0fa7cb9ec09211630a5488629499691b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623434", "to_ids": true, "type": "sha256", "uuid": "15a622c2-2a4f-4ed0-827d-781d570a7600", "value": "3cc8656b95665f8f8fcd91b0b7923a0984633160d49cf297e2aced40ea5260dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621387", "to_ids": true, "type": "ssdeep", "uuid": "6763b485-3262-4906-bc8f-b699be07f955", "value": "3072:IyxMcXKqu0jff77mn1bPtm6+DQqbPxAZazA6D8Bdh7Q7e6LYWgJ9Wnu0XeZ7Mj18:LKuW1BmZDQqNrD8re9LYWk9Whty" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621387", "to_ids": false, "type": "size-in-bytes", "uuid": "14d4f80e-27a7-4ba9-9244-0d294829b0bf", "value": "251904" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621387", "to_ids": true, "type": "vhash", "uuid": "ae57139c-85e3-4cb7-a7c6-52cd636dadf2", "value": "1250a65d5c0d1d1515155038z41nzaez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621387", "to_ids": true, "type": "filename", "uuid": "7e187145-6632-4634-a155-ddafc0d9b0a1", "value": "zpihvf.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621387", "to_ids": false, "type": "text", "uuid": "9df9f94e-d353-431c-a59c-6ab30095e62f", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:43/71\nFirst Submission:2026-04-30T16:00:23.000000+00:00\nLast Submission:2026-05-03T11:48:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623843", "uuid": "97de1695-f631-48e3-ae9a-ddd1a30a2cbd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623843", "to_ids": true, "type": "md5", "uuid": "75f2be8e-0b55-4ba9-83bd-0245bef9e1c7", "value": "a2d1147b09c486ff7286f88662637e73", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623435", "to_ids": true, "type": "sha1", "uuid": "374e5b28-4060-406c-9829-04fccf1bdb9e", "value": "42add9475e67a1ccc6a6af94b5475d3defc01b85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623435", "to_ids": true, "type": "sha256", "uuid": "021d48bf-4392-490e-b445-b38ae016e491", "value": "aeade40c6f10d36da826b4c811bcfeeeccf8df84c5344f31de018ea4802ebf2a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621429", "to_ids": true, "type": "ssdeep", "uuid": "40ca783f-8e67-499c-9455-0b3ff045d460", "value": "49152:kzm0doVVHQqVwPvPIfWj3uRUcGXoDRGiMYuCz:wm0ddqVovPJeRUcGZquCz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621429", "to_ids": false, "type": "size-in-bytes", "uuid": "58dc42b4-ae0c-4b46-ba37-026a73e00acf", "value": "2058752" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621429", "to_ids": true, "type": "vhash", "uuid": "7a01faa9-1eb0-470a-937c-3a6d26b37f04", "value": "1260566d6d155d6038z58=z32" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621429", "to_ids": true, "type": "filename", "uuid": "89543bd6-9eac-4d08-bd8c-d0ff5e3dfe6f", "value": "ffmpeg.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621429", "to_ids": false, "type": "text", "uuid": "8817e822-f634-4b91-b1fa-8e9edbb2cb68", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:1/71\nFirst Submission:2026-02-08T17:28:00.000000+00:00\nLast Submission:2026-05-26T15:01:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623864", "uuid": "bad7957e-e96b-4f61-aa6c-c2f051c56251", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623864", "to_ids": true, "type": "md5", "uuid": "c975b53b-40b2-404d-9143-f29be7dbf9e6", "value": "26ecba7545b09b7f7e5b1e8a0f93121c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623436", "to_ids": true, "type": "sha1", "uuid": "17d0df04-fddb-466e-a8f1-a9c24cce3936", "value": "535f4337f261b6da20a3c614eb13270bed2d533a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623436", "to_ids": true, "type": "sha256", "uuid": "d3ce5620-ec62-4788-9188-bae99a123bc3", "value": "7d57f570d7e5f95bcde7c9f379ccc71a41a7b4b0624ed3740e0aff0208bba3c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621451", "to_ids": true, "type": "ssdeep", "uuid": "190de112-1aba-4b69-ac4d-96e9276ce00a", "value": "3072:4ynKjKyFInc+x688DwMH+/UcsHy2GopptsG5nsjk0ZXYLu2vJBAXcCK5:KKmBDwbYyRopptsWsjkov8y8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621451", "to_ids": false, "type": "size-in-bytes", "uuid": "a2fdc132-e456-49da-903d-161a45c26708", "value": "246784" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621451", "to_ids": true, "type": "vhash", "uuid": "2ff7da93-ddb2-4718-a4af-9883561b5505", "value": "1250a65d5c0d1d1515155az4ozaez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621451", "to_ids": true, "type": "filename", "uuid": "bf305f05-d839-4ab9-9d10-6128a726f182", "value": "253grw.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621451", "to_ids": false, "type": "text", "uuid": "d32e916c-3c14-425b-a72d-756f71e4c3a8", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:43/71\nFirst Submission:2026-03-16T16:01:15.000000+00:00\nLast Submission:2026-03-16T16:01:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623885", "uuid": "50608a98-2511-4dcd-a72c-b23cfa99ffc8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623885", "to_ids": true, "type": "md5", "uuid": "5bdc15cd-74b7-4c4d-aec7-17729f01c698", "value": "c097362d3833fd42007ccc4bd16fe40b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623437", "to_ids": true, "type": "sha1", "uuid": "11eb605e-0dcf-4459-a02d-476bbaa210b2", "value": "76253fb55aed707440e808ea78e7101318436b1c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623437", "to_ids": true, "type": "sha256", "uuid": "10efcabd-833e-4bfb-861c-7c437f09ab79", "value": "c7dddfd432828722f13b0d68b54357a59c366640628918368d3a4fedb16adeaa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621515", "to_ids": true, "type": "ssdeep", "uuid": "f3d7769e-8bd6-4f62-a50f-a8b9e4d5e031", "value": "6144:P1lrhzDtchWs7+DRpKfrWVPYhIMzxLK6KAuGf5A4UNq:P1lrlDaWs7+9pKfrWc46xnfTU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621515", "to_ids": false, "type": "size-in-bytes", "uuid": "d92608dc-54c6-44c4-b9a8-3fee6c3d26ff", "value": "250368" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621515", "to_ids": true, "type": "vhash", "uuid": "a9bb27e5-5b14-4c33-9799-8af69c79e69d", "value": "1250ae7d5c0d1d1515155az3enz8ez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621515", "to_ids": true, "type": "filename", "uuid": "6b6d0c87-67a2-46d5-9c7e-b1962fe2569f", "value": "is7avoo64.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621515", "to_ids": false, "type": "text", "uuid": "0b151d5c-94f6-4aa0-87f2-2727155352ac", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:50/71\nFirst Submission:2026-04-20T00:29:57.000000+00:00\nLast Submission:2026-04-20T00:29:57.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623909", "uuid": "fa3ed9c6-f1e5-4914-a907-e348c93b4a22", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623909", "to_ids": true, "type": "md5", "uuid": "397564bc-a166-48a4-b196-0c093827e8b4", "value": "97667b59d9540765782d9ea5da7629a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623438", "to_ids": true, "type": "sha1", "uuid": "4a513bc4-c4cf-4edd-95aa-5d352d6265a8", "value": "901cfa97b1baaf908fd4a02bb52d970f576c4193", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623438", "to_ids": true, "type": "sha256", "uuid": "a9b0fc6b-d82f-45a2-8203-224649fee071", "value": "003954fefc61f2d2056b752df28d9b2332557810468b4e4f13ce54e0dcadd582", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621537", "to_ids": true, "type": "ssdeep", "uuid": "5e910d82-ebed-4921-8c99-40dba40dbc8f", "value": "3072:PyvAjKFL7GYGEh7sDwtmJu6EqSv0ca4hAeQKA16c9BqxtgPMGXkZXYkATA5ZdcR:nKF2XDwgF47hAeO16c9Bq/gPMGkolTWc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621537", "to_ids": false, "type": "size-in-bytes", "uuid": "7f8d2f0b-397e-46e0-b8cc-873785d23ead", "value": "245760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621537", "to_ids": true, "type": "vhash", "uuid": "4e0594f6-7850-4a0d-8793-9502173e8c87", "value": "1250a65d5c0d1d1515155az3fnzaez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621537", "to_ids": true, "type": "filename", "uuid": "d2cfee3b-d25b-493d-8415-aacc1eb55776", "value": "pvlkgq.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621537", "to_ids": false, "type": "text", "uuid": "15c2f067-71b3-4e49-ac25-30bc9039467d", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:44/71\nFirst Submission:2026-02-15T06:43:49.000000+00:00\nLast Submission:2026-03-11T21:30:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623930", "uuid": "2682e52d-5653-4a96-9eaa-f8cc4671f104", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623930", "to_ids": true, "type": "md5", "uuid": "30d4ee95-d60e-48c7-a13a-ce7fd65aab97", "value": "95a8cc341aa081df4d5fd79d431921ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623439", "to_ids": true, "type": "sha1", "uuid": "c9042983-9967-47b0-9c05-7dcbac1edfcd", "value": "954722b0c9c678b1313d1f8b204e102842dc5889", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623440", "to_ids": true, "type": "sha256", "uuid": "1fc2a4cf-303d-4801-aa1e-dbd002ab1673", "value": "b77714a803976a1ba110d2651f77a9d9f26ed3f4c1c67a128f06971bd1a41ff7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621558", "to_ids": true, "type": "ssdeep", "uuid": "beffcc6c-71bc-4288-9cd6-5ada55cbba04", "value": "3072:oyXojKKK9oUe64uFMsVfRD2KSJG+XU5GXS4nz39DfxICPhuqjksFVca:EKJ9264AD257XDJDfqNqj3d" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621558", "to_ids": false, "type": "size-in-bytes", "uuid": "cbd266e0-aed4-4737-88c2-e7a8a2786fc6", "value": "245248" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621558", "to_ids": true, "type": "vhash", "uuid": "5dd3743f-faa6-4493-a9c0-4d11f814b97b", "value": "1250a65d5c0d1d1515155az3enzaez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621558", "to_ids": true, "type": "filename", "uuid": "9c15b6f1-fa6b-4309-952a-662ab54160b2", "value": "mjyhpu.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621558", "to_ids": false, "type": "text", "uuid": "d3af6713-956e-4641-9056-69a4fa94c241", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Kepavll!rfn\nVT Total Detection:44/71\nFirst Submission:2026-02-05T06:42:52.000000+00:00\nLast Submission:2026-02-09T21:11:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623952", "uuid": "25a75026-0ee9-4c7a-8432-c541dce113e0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623952", "to_ids": true, "type": "md5", "uuid": "45b98baa-b277-4919-8882-aed1bcc450cd", "value": "a194f3742c5a175c08aa1aed4d659279", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623441", "to_ids": true, "type": "sha1", "uuid": "790c7c09-e7a6-4b88-8dc7-6fbe28220e92", "value": "9803604ec45f31f9ef75bcca1e1310d8ac1fc3a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623441", "to_ids": true, "type": "sha256", "uuid": "eae7a0e9-8d7d-4dca-9f06-85a2c5e2b3fb", "value": "16f5c086a694a3300c20b12d99815ffc3de62acc118af53da88fec767a79e10c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621580", "to_ids": true, "type": "ssdeep", "uuid": "d908ce94-ad9f-4f47-b5e2-cff661835caa", "value": "12288:bDuUFtgtaRR5656y7hWETr7XJoF3nkcWlzYaLcJFvoEiyv1O:XuKtgtc/6kytWETr7XJoO7LcJFFiU8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621580", "to_ids": false, "type": "size-in-bytes", "uuid": "9a5fd569-f600-424c-b2b7-6c3cdef1f7b3", "value": "1070592" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621580", "to_ids": true, "type": "vhash", "uuid": "479dbdf3-04aa-4f40-afbb-feb86ebfaecf", "value": "1160a6666d5c0d5d15151118z5b1z23z40cbza03cz4" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621580", "to_ids": true, "type": "filename", "uuid": "d44eb967-a388-4f4d-b285-01fd6063a205", "value": "libGLESv2.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621580", "to_ids": false, "type": "text", "uuid": "18afa542-0b4a-46ac-a08a-a275054ad17f", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:39/71\nFirst Submission:2026-05-02T12:04:33.000000+00:00\nLast Submission:2026-05-02T12:04:33.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623973", "uuid": "86d888f7-cb19-4018-ae13-dac2b0fcf05a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623973", "to_ids": true, "type": "md5", "uuid": "728c270f-02c2-4cee-954d-c9c9de6e6e08", "value": "9054499ba712b174f4f6e3c395dabd25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623442", "to_ids": true, "type": "sha1", "uuid": "73481578-3168-429e-99fa-6b575e22b06c", "value": "ae4601a19d28332a3ec6ac31b385cdf53be53450", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623442", "to_ids": true, "type": "sha256", "uuid": "c08f58ed-7953-456d-9376-310bb239de4e", "value": "b7801dc6e0c2e8490b272a7a39210f19a05e4428af3fd83c11c902f4438ca556", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621602", "to_ids": true, "type": "ssdeep", "uuid": "e4ad69d9-3a64-4414-894b-e18878b76e4c", "value": "3072:cyxMcXKquxjff77mn1bPAm6+DQqbPxAZazA6D8Bdh7Q7e6LYWoJ9Wnu0XeZ7Mj15:PKtW1UmZDQqNrD8re9LYWs9WhtJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621602", "to_ids": false, "type": "size-in-bytes", "uuid": "c674695b-4c40-455a-8f2b-66c84aefc083", "value": "251904" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621602", "to_ids": true, "type": "vhash", "uuid": "acc02c72-b8c0-4f0b-8a32-e6f5cc15edd7", "value": "1250a65d5c0d1d1515155038z41nzaez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621602", "to_ids": true, "type": "filename", "uuid": "03b332cf-d0fc-461e-b082-d3d5b881f0e8", "value": "e9qq6spz.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621602", "to_ids": false, "type": "text", "uuid": "92191db2-11a2-410c-a8fa-867aafbe34a4", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:44/71\nFirst Submission:2026-05-04T12:51:17.000000+00:00\nLast Submission:2026-05-04T12:51:17.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780623996", "uuid": "8c4295eb-0001-466e-9d7b-254d4a37734f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780623996", "to_ids": true, "type": "md5", "uuid": "107f65be-09d5-4a49-8d38-44754bd1852e", "value": "433bf091d234a5d1d14d002714a7da0e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623444", "to_ids": true, "type": "sha1", "uuid": "91badba7-91dd-4460-a68f-bbb037bb091a", "value": "d2cb0d7a9ad2b5d4ea7c2da8aec62beb37cf36d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623444", "to_ids": true, "type": "sha256", "uuid": "f9b29e14-804c-41f5-b377-2d9c11663d1c", "value": "3b22905136d890a2a38a8a00c57f8ccbed67c562ee0fc1198aebf7ec9828f1aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621645", "to_ids": true, "type": "ssdeep", "uuid": "1aee5c5e-735a-4cd0-86c8-3e173c794988", "value": "3072:XynKjKmVInjxJu1MDwafIvUc4oQBB93pptBEPTfsbTdAXu2vZUdicdB:VKGaDwP/QB/3pptBSrsbRr8hm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621645", "to_ids": false, "type": "size-in-bytes", "uuid": "9962b5e4-00a6-464c-b484-495dcf96e18c", "value": "246272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621645", "to_ids": true, "type": "vhash", "uuid": "dc94c95e-95cd-4e15-b939-de0ff262f9c3", "value": "1250a65d5c0d1d1515155az4ozaez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621645", "to_ids": true, "type": "filename", "uuid": "421375c7-c536-4926-b86b-8fb926dc36e8", "value": "krlbtd.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621645", "to_ids": false, "type": "text", "uuid": "2e6ef329-01e2-47cc-84aa-dff4a3f2ed8b", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Phonzy.A!ml\nVT Total Detection:40/71\nFirst Submission:2026-05-10T12:22:40.000000+00:00\nLast Submission:2026-05-24T16:05:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624018", "uuid": "c6b6a5d1-9b34-4384-8052-2c63efd76c8a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624018", "to_ids": true, "type": "md5", "uuid": "2fd9ba5d-cf2b-48e3-b7c1-61c122f20b3f", "value": "f2fd713cc826b47e48be40e4c3d8a3f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623445", "to_ids": true, "type": "sha1", "uuid": "a7fb8373-782b-4f87-b548-f8083b801280", "value": "dad26f61da7b8bccc78364411812be74c025b475", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623445", "to_ids": true, "type": "sha256", "uuid": "b145526a-b8f4-4683-914b-432689f1253e", "value": "2c1fe90902a6d3e1e1ffb1ae89fb96adbb1d009b3db9864df01d256f350938bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621666", "to_ids": true, "type": "ssdeep", "uuid": "d2410b4b-477a-4e32-8d9d-fff0e5c61922", "value": "3072:Uyx0o0Dgb36UXwAPAON4MDGPab67/jNVi1Uwo2vCU0tymWYLoYhunkDY4QNvaTNN:EDcKaPh1DGzp2UwXm9Ak0LUNEk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621666", "to_ids": false, "type": "size-in-bytes", "uuid": "ed4ed34f-2e88-46cf-a2ae-be074411418e", "value": "248832" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621666", "to_ids": true, "type": "vhash", "uuid": "e10d4e53-6c18-48eb-80bd-ebb735193170", "value": "1250a65d5c0d1d1515155az3enz8ez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621666", "to_ids": true, "type": "filename", "uuid": "80dee7cf-282b-4c5f-8c2d-466fab46a637", "value": "zwyjxnab.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621666", "to_ids": false, "type": "text", "uuid": "c3345d3d-1d2c-411e-8fca-fc015ca42f91", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:46/71\nFirst Submission:2025-12-30T14:21:07.000000+00:00\nLast Submission:2025-12-30T14:21:07.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624039", "uuid": "9c0a3200-eac8-4ba0-8d76-fcffeb5808c8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624039", "to_ids": true, "type": "md5", "uuid": "7ee4def0-61f5-4daa-9953-a846e53cb5a8", "value": "9914db1c38b6712dea473d0131296178", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623446", "to_ids": true, "type": "sha1", "uuid": "b90bb9d0-445f-4d6a-a101-7ed0aae1b93f", "value": "edce72f59e4c1d136cd1946af70d334c19df858d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623446", "to_ids": true, "type": "sha256", "uuid": "2cb13938-2439-4cb5-88a3-af1ecc6fd954", "value": "c7aae70e9c3c68bdbce2e2f357be2bed887afb37ed8dfff2a5a18b715abc4f46", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621730", "to_ids": true, "type": "ssdeep", "uuid": "23904344-95ab-4b57-9340-cc6973f300ce", "value": "1536:VlUwtCkeqEBUVAJ9wWkeYtD7qZAFXP3qZAFR2XLhDxll:vUwtt4BbdBbl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621730", "to_ids": false, "type": "size-in-bytes", "uuid": "3a1e81c7-098b-4efb-a9d8-a56dd13b0c36", "value": "93184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621730", "to_ids": true, "type": "vhash", "uuid": "88070efa-0d84-45cf-9ff3-fcd6b3d51962", "value": "1940a6565d1c0d1d15151az269z1sz3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621730", "to_ids": true, "type": "filename", "uuid": "2636e318-9fed-471d-b91f-c6bdf0403bca", "value": "natives2_blob.bin" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621730", "to_ids": false, "type": "text", "uuid": "8c386984-a502-4faa-8196-6ec6437ddb05", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:44/71\nFirst Submission:2026-02-27T08:51:52.000000+00:00\nLast Submission:2026-05-26T15:01:55.000000+00:00" } ] } ] } }