{ "Event": { "analysis": "1", "date": "2026-06-03", "extends_uuid": "", "info": "[Threat Intel] Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO", "protected": false, "publish_timestamp": "1780629657", "published": true, "threat_level_id": "3", "timestamp": "1780629656", "uuid": "3ddae69d-0e05-4def-81d3-aa7661d89c49", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#7223eb", "local": false, "name": "misp-galaxy:producer=\"Fortinet\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Password Guessing - T1110.001\"", "relationship_type": "" }, { "colour": "#7773ac", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#a4da83", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"", "relationship_type": "" }, { "colour": "#aad818", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#5affe5", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Remote Management - T1021.006\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#7adb57", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation of Remote Services - T1210\"", "relationship_type": "" }, { "colour": "#f07d7c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#7d37d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Python - T1059.006\"", "relationship_type": "" }, { "colour": "#37ffb5", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Denial of Service - T1498\"", "relationship_type": "" }, { "colour": "#c615e8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scanning IP Blocks - T1595.001\"", "relationship_type": "" }, { "colour": "#3335c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"RC Scripts - T1037.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#f055aa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"", "relationship_type": "" }, { "colour": "#50bd28", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#5887a6", "local": false, "name": "misp-galaxy:target-information=\"Japan\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Bashlite\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"Gafgyt\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570818", "to_ids": false, "type": "link", "uuid": "acc04725-86a8-4c9e-b184-9a006da95be3", "value": "https://www.fortinet.com/blog/threat-research/inside-cross-platform-propagation-of-new-gafgyt-variant-c0xmo" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780570818", "to_ids": false, "type": "text", "uuid": "f9049f34-2ecc-4858-b15d-d85ce4632aff", "value": "A new Gafgyt botnet variant named C0XMO has been discovered that spreads by exploiting a stack buffer overflow vulnerability in DD-WRT router firmware. Unlike earlier versions, this malware separates its lateral movement capabilities into a standalone Python script, enabling more efficient targeting of various system architectures including ARM, MIPS, PowerPC, and x86. The malware establishes persistence through cron jobs and shell profile modifications, eliminates competing botnets, and supports 19 different DDoS attack methods. Its scanner component performs weak-credential brute-force attacks on Telnet and SSH services while also exploiting multiple HTTP-based vulnerabilities and Android Debug Bridge unauthorized access. The malware connects to command-and-control infrastructure and demonstrates significantly more sophisticated architecture compared to traditional IoT botnets." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780570818", "to_ids": false, "type": "text", "uuid": "2cfb1c5f-0b7b-49ac-8448-e4953d6ea743", "value": "Name: Inside the Cross-Platform Propagation of a New Gafgyt Variant C0XMO\nAuthor: AlienVault\nAdversary: \nTags: [\"gafgyt\", \"botnet\", \"python scanner\", \"c0xmo\", \"ddos\"]\nTgtd countries: [\"Japan\"]\nMlwr families: [\"C0XMO\", \"Gafgyt\"]\nAttack_ids: [\"T1110.001\", \"T1133\", \"T1543.003\", \"T1053.003\", \"T1021.004\", \"T1082\", \"T1106\", \"T1190\", \"T1021.006\", \"T1057\", \"T1210\", \"T1571\", \"T1486\", \"T1059.006\", \"T1498\", \"T1595.001\", \"T1037.004\", \"T1071.001\", \"T1136\", \"T1046\"]\nIndustries: [\"Technology\"]" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570818", "to_ids": false, "type": "vulnerability", "uuid": "01aee10b-bca3-4e27-9354-4998a9edd8dc", "value": "CVE-2015-2051" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570818", "to_ids": false, "type": "vulnerability", "uuid": "1c55da0e-f064-4700-9136-86c910d7c00b", "value": "CVE-2022-35914" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570818", "to_ids": false, "type": "vulnerability", "uuid": "4d97abae-d96d-4536-afe3-64fc7769ee8b", "value": "CVE-2021-27137" }, { "category": "Network activity", "comment": "IOC-description:CC=ES ASN=AS8560 1&1 ionos se", "deleted": false, "disable_correlation": false, "timestamp": "1780624151", "to_ids": true, "type": "ip-dst", "uuid": "ab5b7412-25a6-49d3-ba00-7c9e85f16e00", "value": "217.160.125.125", "Tag": [ { "colour": "#f3fcab", "local": false, "name": "asn:asn=\"8560\"", "relationship_type": "" }, { "colour": "#97689f", "local": false, "name": "asn:as-owner=\"IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE.\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624172", "to_ids": true, "type": "ip-dst", "uuid": "7df26b2a-bf2b-4418-a5c4-c5c4fce42009", "value": "176.100.37.91", "Tag": [ { "colour": "#3b7a3d", "local": false, "name": "asn:asn=\"58087\"", "relationship_type": "" }, { "colour": "#516ddb", "local": false, "name": "asn:as-owner=\"FLORIANKOLB\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS6724 strato ag", "deleted": false, "disable_correlation": false, "timestamp": "1780624193", "to_ids": true, "type": "ip-dst", "uuid": "1cfae50d-37a9-4274-a86e-59b7a0382913", "value": "85.215.131.70", "Tag": [ { "colour": "#f3fcab", "local": false, "name": "asn:asn=\"8560\"", "relationship_type": "" }, { "colour": "#97689f", "local": false, "name": "asn:as-owner=\"IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE.\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570818", "to_ids": false, "type": "vulnerability", "uuid": "36406a91-008e-4149-b14b-9f7568219167", "value": "CVE-2016-15047" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570818", "to_ids": false, "type": "vulnerability", "uuid": "ce41493b-e6a9-4bac-b452-4633c3590e6c", "value": "CVE-2025-34054" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623479", "to_ids": true, "type": "sha256", "uuid": "58b9d08c-433f-4f2c-b507-fc9713404d1e", "value": "450ea44da0c9d96a2e8f4d6bad34f1c35cd35743295b8cd2defa9f7a9884685d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623480", "to_ids": true, "type": "sha256", "uuid": "83f4f954-fe81-460b-93fb-3943a827c397", "value": "7413cbb6eab4d6b10346f71be5dd76d7cf2f4817f7776367b162f83755aefa1f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623481", "to_ids": true, "type": "sha256", "uuid": "d784b7e6-2960-440f-9192-64aba13a7683", "value": "8fc2d35b66c692d37a85ae9d30dc5c7f06f0b3eaf01112a5a6398a1a0feb3aee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623482", "to_ids": true, "type": "sha256", "uuid": "2faa2acd-64a4-47f7-8c61-c8d8528588e2", "value": "b6f835ced11059d341222eba11fff3a4672f4de47a3a4d791fad86059a2b06d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623483", "to_ids": true, "type": "sha256", "uuid": "cd4f8db5-5cff-4b88-a2dd-0e5523dbadbc", "value": "dff0edae6e8854ddd3e617054ee0bd74c696c91411f704dff60aabaec839bec9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623484", "to_ids": true, "type": "sha256", "uuid": "1cf46018-0da4-436a-8624-92469f3c5ebf", "value": "f02b1d8010dac35b007796def0cbd5d0c9414df790e2b55b105c95df2f2ffa91", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624218", "uuid": "fe98ddca-a766-4182-9553-92c1c654d6e5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624218", "to_ids": true, "type": "md5", "uuid": "dc9350c8-15b3-48b4-a7e3-d056e15b2be1", "value": "1cd9eccc8e73d60164390beddf4cdc48", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623468", "to_ids": true, "type": "sha1", "uuid": "8b94c5f8-83c8-4c85-ba0b-623b69dcbbed", "value": "28f871af1833935beba160b51e4a732c43a5dde5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623468", "to_ids": true, "type": "sha256", "uuid": "8ad868e6-4c0d-4403-b21e-efc2627f4df9", "value": "20042f1efb59c99e3addf822a3e9e5a496f0b701362df038a50a32a9f504a136", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621947", "to_ids": true, "type": "ssdeep", "uuid": "ba456227-2f07-4bf7-8800-0b0fc7f9ba45", "value": "1536:xZdaYwD3+W0YdTd4mOXU5315U5oPpAJx9kyt0Er+fDHxLJZABpFnE:xZdaYmuW0YP4wrZPA4yhgF+FE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621947", "to_ids": false, "type": "size-in-bytes", "uuid": "5cbd6f2b-c68d-42ed-b91a-6c8135715842", "value": "98482" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621947", "to_ids": true, "type": "vhash", "uuid": "745c55df-2e14-47c9-a663-02b66d3037c9", "value": "4d297f73b459f4c552f025a1f91cb73b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621947", "to_ids": true, "type": "filename", "uuid": "0d072c8d-1cb5-4cc1-b03d-2cd905b1fbed", "value": ".sys" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621947", "to_ids": false, "type": "text", "uuid": "383ba080-41ce-43f4-bf58-575933657f1f", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:34/64\nFirst Submission:2026-03-23T22:55:11.000000+00:00\nLast Submission:2026-03-23T22:55:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624241", "uuid": "3e663ea4-14be-4848-9ae9-3510761834a1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624241", "to_ids": true, "type": "md5", "uuid": "3c9c5b58-b0ab-467c-962b-4f24f9324efa", "value": "703a8383a3df68abce59b02fcd0b5678", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623469", "to_ids": true, "type": "sha1", "uuid": "16d6f4d4-6071-4a57-8e6f-7c27deddc07e", "value": "ca9d7aaff7c636120149168e2bbb509c10544993", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623469", "to_ids": true, "type": "sha256", "uuid": "d526bd4a-81f9-47f4-aab2-bdc89e5b5634", "value": "eead44c0af7ddb12cece1a6125cf213bab3c22511cd59aff9d63dcfddb7d4386", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621968", "to_ids": true, "type": "ssdeep", "uuid": "9d81353a-7781-46de-8251-b166649babd0", "value": "3072:PoJ+ufj++NJn63BjX8n1fr4cnBortNu8mfYwlnsmmWZJo7smtf+c0TvhU3:PQI69BLsmmWZJo7smtf+c0TvhU3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621968", "to_ids": false, "type": "size-in-bytes", "uuid": "b4e68526-56a6-403e-836c-f1a46f067088", "value": "210201" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621968", "to_ids": true, "type": "vhash", "uuid": "24e321b7-274c-4644-88bc-e56c2bbf14e3", "value": "c0215d02c2b33e5c2822e494c94c976a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621968", "to_ids": true, "type": "filename", "uuid": "e54edabb-661b-474d-b4e5-9197d372c554", "value": "bot.x86_64" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621968", "to_ids": false, "type": "text", "uuid": "31f85f1a-aaa4-41c6-a285-861458b2bb74", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Gafgyt.BF!MTB\nVT Total Detection:37/64\nFirst Submission:2026-03-23T10:04:47.000000+00:00\nLast Submission:2026-03-24T05:22:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624262", "uuid": "19a57479-6e2d-4094-9fe1-ea35029d93c0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624262", "to_ids": true, "type": "md5", "uuid": "6f8a36c2-7a56-47d3-8ecc-b448344f989d", "value": "952f53df54309c0d794c82040658fc07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623470", "to_ids": true, "type": "sha1", "uuid": "6d0cbe95-6bd7-42c8-b1d7-fa2c6395bd9a", "value": "45d03934bcebbf6f6690ec83d63bc31c69eabe63", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623470", "to_ids": true, "type": "sha256", "uuid": "238d1006-0cf5-4474-87e1-816715922457", "value": "3ddb67ab079509dd1e7ac77fc4cfed25a271526668c68f8a2221e96a4cc21812", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780621990", "to_ids": true, "type": "ssdeep", "uuid": "e50d2e3c-eb8d-4d52-8c89-2e5c1e894268", "value": "3072:tfbWeqxI5HQKG6mcDAMITFhiT6mp3mDprqGG1uK8vis4:tjWeqxKHQK5mcDAMOWOmp3mDprqGG1uQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780621990", "to_ids": false, "type": "size-in-bytes", "uuid": "8e955a45-90e5-41f5-a024-a9c8af6373ab", "value": "195045" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780621990", "to_ids": true, "type": "vhash", "uuid": "06a3e10d-eaed-4aa8-9e6f-7a83bf65a60c", "value": "3b60fb27c9823f2101feac0c38480d81" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780621990", "to_ids": true, "type": "filename", "uuid": "fc70369b-0e37-41b1-93d3-27e930f68dc4", "value": "njs6xyu.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780621990", "to_ids": false, "type": "text", "uuid": "a86bc0de-1889-4a6b-b7f6-f9f0e3609f3a", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:34/63\nFirst Submission:2026-03-24T07:41:38.000000+00:00\nLast Submission:2026-03-24T07:41:38.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624283", "uuid": "a7677295-68a5-4144-a0e9-85e6c1efa1b2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624283", "to_ids": true, "type": "md5", "uuid": "7b366ce0-45db-4a44-b93e-cc692c02b0ae", "value": "c5f2f8d4b48ed06ae8d03c71e9b9171e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623471", "to_ids": true, "type": "sha1", "uuid": "021dff30-58e0-4f9d-ad35-5bbfb162ce7b", "value": "e17d52998a954dceca97b64dc8038b1a510222ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623471", "to_ids": true, "type": "sha256", "uuid": "99f0a462-ef2d-4fb9-b8b5-e3bfde7425a4", "value": "41e8e327abbf2ba721be677ad8a416a7295708257b39688a0af03275fb199cec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622012", "to_ids": true, "type": "ssdeep", "uuid": "fe1529e3-5fc0-4766-91d6-f4d436b0df66", "value": "768:DkbGWnHDb2uBH9xRTxbDlvX3R7SYtX/SbhpU3OoQQuRQFVC1j3XSWXTvZT22jEiF:DkbGWnHDb2uBdxRTxbDlvX3R7SYtvS1n" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622012", "to_ids": false, "type": "size-in-bytes", "uuid": "eb9e2d2b-1cd3-4054-b895-6a337a480c25", "value": "47353" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622012", "to_ids": true, "type": "filename", "uuid": "cae56e10-088d-4d05-bbe7-5a00f83be41d", "value": "scanner.py" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622012", "to_ids": false, "type": "text", "uuid": "bb6e0deb-9cf5-4750-957d-c1d183045013", "value": "Type Description: Python\nMicrosoft: None\nVT Total Detection:4/62\nFirst Submission:2026-03-31T09:21:21.000000+00:00\nLast Submission:2026-03-31T09:21:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624306", "uuid": "31ebaf97-8c4d-4779-a823-7abdfde08305", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624306", "to_ids": true, "type": "md5", "uuid": "22215520-aa63-44b0-8906-2c06b70f60fc", "value": "b860c28c71f9960d5a9fade8a7f2a2b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623472", "to_ids": true, "type": "sha1", "uuid": "98cfb93e-157e-419f-8ab2-bee4765102bc", "value": "766bede97ebe4653fd88d86b4f7b9c68ec79f91b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623472", "to_ids": true, "type": "sha256", "uuid": "687ffb16-7057-4afa-a0d7-bff19837968e", "value": "444a9d34a9f59dc7975dfabefb47d789813a4497bbac9127c4806dd816e85211", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622034", "to_ids": true, "type": "ssdeep", "uuid": "a988c684-2f0d-418d-921e-2ae712323a1c", "value": "6144:fYs/4DkKbxQO9Hb80BWzBmm3JyOjZNmRLIOTk/G4://4Dk0yCUBmm3JyOjfmRLIOTk/G4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622034", "to_ids": false, "type": "size-in-bytes", "uuid": "1738834d-9208-4630-a4be-bc571a89a058", "value": "211588" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622034", "to_ids": true, "type": "vhash", "uuid": "c9aa63b4-9578-4407-8aa8-0d313f9de7b9", "value": "3c4e2ddd9f5a08d0bffa3d1dc3047f4c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622034", "to_ids": true, "type": "filename", "uuid": "8f07ff76-f6ec-435d-9f27-e42fdc79e8e2", "value": ".sys" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622034", "to_ids": false, "type": "text", "uuid": "d42d9a0c-d192-4072-988e-b3d6d76e1721", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:29/64\nFirst Submission:2026-03-24T16:55:49.000000+00:00\nLast Submission:2026-03-24T16:55:49.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624327", "uuid": "7567fd07-b3fb-4b0f-be2c-22d9b6ed64fa", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624327", "to_ids": true, "type": "md5", "uuid": "34a76bfe-a64c-4f25-abf5-0ba5f1029bef", "value": "5888ce371f79faf39c384b213951079c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623474", "to_ids": true, "type": "sha1", "uuid": "bfdc62b8-da46-4a20-ad2c-edf6bf53d5ee", "value": "b82e1233eda7a7c068d9b41f083d09592cf7b82e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623474", "to_ids": true, "type": "sha256", "uuid": "675c0546-4e59-40ec-9a8f-dcaa3fb31de4", "value": "9394666007fac4014a4641fdae150c1b969ed2bc4299876318a336fd386abf59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622120", "to_ids": true, "type": "ssdeep", "uuid": "102f1f22-c7d2-4b6d-b1e1-950305fe8344", "value": "6144:pDnt4Yq387rjTCwRwWB/JCmx3JYpGZdaYZXOi5yb4:Rt4YoqjlFwmx3JYpGraYZXOi5yb4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622120", "to_ids": false, "type": "size-in-bytes", "uuid": "b4582107-856c-4739-805a-815d9e1423b0", "value": "204074" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622120", "to_ids": true, "type": "vhash", "uuid": "86224591-8ec9-4dbd-a5d6-90f79c0f438b", "value": "3c4e2ddd9f5a08d0bffa3d1dc3047f4c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622120", "to_ids": true, "type": "filename", "uuid": "bf0f92be-065a-44c3-946d-42fbbbfd0a7a", "value": ".sys" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622120", "to_ids": false, "type": "text", "uuid": "499f16a1-2f2c-460a-8397-420f9ccea7e5", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:36/64\nFirst Submission:2026-03-24T07:45:22.000000+00:00\nLast Submission:2026-03-24T07:45:22.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624349", "uuid": "fa0b7fe3-1c73-400d-a989-99239ca6b39c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624349", "to_ids": true, "type": "md5", "uuid": "3b1736ec-179f-4bac-9c77-3ae4a052f24f", "value": "e60fe0453f0baa91b56e16320e0fa277", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623475", "to_ids": true, "type": "sha1", "uuid": "980e252e-f3fb-4b15-93f3-30f6bceb60a3", "value": "3b0774fc8ccdb45c918239aee5ec5d191487eef4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623475", "to_ids": true, "type": "sha256", "uuid": "4e0e44eb-f67e-491d-b034-f953881e42de", "value": "b61a5508847a2167b737d31193dc393e92c5be2aa5141bbe4b7ea6f440fd4799", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622141", "to_ids": true, "type": "ssdeep", "uuid": "76818b50-ba6c-4d5f-8b84-42eb9985cf02", "value": "6144:LbCcjMWhKjcLvyyQcLgvuLmp3JDprqGR1uK8viU4:1h0GLmp3JDprqGR1uK8viU4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622141", "to_ids": false, "type": "size-in-bytes", "uuid": "bae4c687-0686-4925-b03c-ac54e56d3ff8", "value": "212244" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622141", "to_ids": true, "type": "vhash", "uuid": "f9ebda5c-06dc-43f1-ab54-88948e7ab33f", "value": "c22d932801304ee0e6d5c136be9fbb92" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622141", "to_ids": true, "type": "filename", "uuid": "ef7def09-8132-411d-a4f1-87ebbf07af35", "value": "mcrvd1by.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622141", "to_ids": false, "type": "text", "uuid": "cacf1d07-6857-49cf-a67a-6417d6b0ede8", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.HF!MTB\nVT Total Detection:32/63\nFirst Submission:2026-03-24T00:30:13.000000+00:00\nLast Submission:2026-03-24T00:30:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624372", "uuid": "ad592fbb-fd58-4a5e-8f75-9bc6f7dca8e9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624372", "to_ids": true, "type": "md5", "uuid": "8f13e9d0-6594-4051-86b5-f7203518c418", "value": "e3f6533dc86654bd4e094c086e835f79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623476", "to_ids": true, "type": "sha1", "uuid": "a03b2953-f031-4a69-913c-cd6231d827ca", "value": "42b7b11424e38912d734c82a9acd74fe2bf218fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623476", "to_ids": true, "type": "sha256", "uuid": "92a3d310-7c5d-495c-83a3-212c66ea5aaa", "value": "d452f22dacab9785539484245c13e9cce58df23fc82eeef205684fcd196da20b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622185", "to_ids": true, "type": "ssdeep", "uuid": "c2db2d37-504a-475b-9057-e99fd956677b", "value": "6144:fGUGa/97pbWWa2LTBxgYCnMC/SzFM/RIDU3HN:fn97pbWWa2LTBx3DzO/+D2HN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622185", "to_ids": false, "type": "size-in-bytes", "uuid": "b919c157-04d1-41ec-bf82-7ca0c68f3905", "value": "212404" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622185", "to_ids": true, "type": "vhash", "uuid": "3f287ddd-3239-4d38-8267-ece061c051b8", "value": "170b69d092b98052f7b2f83675352d7a" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622185", "to_ids": false, "type": "text", "uuid": "ec8a3838-82c4-447c-a2d9-198976a91c19", "value": "Type Description: ELF\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:22/64\nFirst Submission:2026-06-04T13:40:32.000000+00:00\nLast Submission:2026-06-04T13:40:32.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624394", "uuid": "26e1ca8e-28b8-4c9d-aa9b-c9b3e1fcd47e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624394", "to_ids": true, "type": "md5", "uuid": "07cd1dc1-d2ec-40b8-a965-2707e4f2685b", "value": "3cfe410c317e266ad9577911c91ecb02", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623478", "to_ids": true, "type": "sha1", "uuid": "d683f0df-7359-4f90-9522-7bb5df1ebaab", "value": "337b376719a6264ad63aaadc0e0b3aaddafba0c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623478", "to_ids": true, "type": "sha256", "uuid": "d63d85c8-2a0e-434f-a539-ec33bdeb5a46", "value": "ea44138b9701fce1b2fe13de8f9e00681c007c9adc625edc9f507f177704c2e8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622227", "to_ids": true, "type": "ssdeep", "uuid": "7f189abb-8614-4062-9a6f-bc1d4866e432", "value": "6144:m5eg2Mym+2RLGN9jYmD5SoJaOsajxTz5eTj:myqJLWsmD5SoJaOsajxTz5eTj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622227", "to_ids": false, "type": "size-in-bytes", "uuid": "372ff0e9-da3d-4470-b471-dc4f0ff1b86f", "value": "264208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622227", "to_ids": true, "type": "vhash", "uuid": "a03088fb-467b-43c7-8fc0-0041ddd6d35e", "value": "813988f6c5d42b6d86a94d2978b73480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622227", "to_ids": true, "type": "filename", "uuid": "430bfceb-ce8a-48ed-8ae5-72200135b2f9", "value": "9fbapbet.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622227", "to_ids": false, "type": "text", "uuid": "4ae14588-5d3e-4957-894e-89ab98ec954c", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:34/64\nFirst Submission:2026-03-24T01:50:15.000000+00:00\nLast Submission:2026-03-24T01:50:15.000000+00:00" } ] } ] } }