{ "Event": { "analysis": "1", "date": "2026-07-14", "extends_uuid": "", "info": "[Threat Intel] 11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload", "protected": false, "publish_timestamp": "1784553522", "published": true, "threat_level_id": "3", "timestamp": "1784553522", "uuid": "45a5182a-d76b-47c4-b969-56ce23bdbcc7", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#d74cce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Upload Malware - T1608.001\"", "relationship_type": "" }, { "colour": "#bce57a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#280b0e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Proxy - T1090.002\"", "relationship_type": "" }, { "colour": "#ece0df", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Video Capture - T1125\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#d596aa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"", "relationship_type": "" }, { "colour": "#16ca73", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Location Discovery - T1614\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#fae37b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"", "relationship_type": "" }, { "colour": "#1a8d0c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Time Discovery - T1124\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"37ebf9d7-5e9a-466f-a42c-6e60313db868\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784170845", "to_ids": false, "type": "link", "uuid": "2e20159f-3955-4832-a375-14fc9f44f9da", "value": "https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats", "Tag": [ { "colour": "#af005e", "local": true, "name": "workflow:todo=\"additional-task\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784170845", "to_ids": false, "type": "text", "uuid": "f04b6abf-9717-4157-9e36-712e047d150b", "value": "Eleven malicious NuGet packages distributed as .NET command-line tools masquerade as game utilities and cheats for popular games including Albion Online, GTA5RP, GrandRP, and Throne and Liberty. Each package functions as a first-stage downloader that uses DNS-over-HTTPS to bypass local controls, requests UAC elevation to resync system time, and fetches a second-stage PyInstaller payload named pepesoft.exe from GitHub and Hugging Face under username pepegit666. The payload binds to hardware fingerprints, enforces licensing through Google Sheets telemetry, honors remote ban-lists, and in three variants exposes Telegram bot commands enabling screenshot capture and remote control. All packages share identical AWS credentials and mutex identifiers, linking them to a single Russian-speaking operator running a commercial game-automation service marketed through pepesoft.ru and Telegram channel pepesoft777." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784170845", "to_ids": false, "type": "text", "uuid": "f0d65102-4680-4969-ae3e-126409c8c498", "value": "Name: 11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload\nAuthor: AlienVault\nAdversary: \nTags: [\"telegram bot control\", \"hardware fingerprinting\", \"nuget supply chain\", \"google sheets telemetry\", \"pyinstaller payload\", \"screenshot exfiltration\", \"dns-over-https evasion\", \"game cheats\", \"pepesoft.exe\"]\nTgtd countries: []\nMlwr families: [\"pepesoft.exe\"]\nAttack_ids: [\"T1113\", \"T1033\", \"T1548.002\", \"T1082\", \"T1140\", \"T1608.001\", \"T1567\", \"T1112\", \"T1090.002\", \"T1125\", \"T1016\", \"T1497\", \"T1057\", \"T1059.001\", \"T1027\", \"T1195.002\", \"T1614\", \"T1518.001\", \"T1059.003\", \"T1070.004\", \"T1027.002\", \"T1071.001\", \"T1105\", \"T1569.002\", \"T1124\"]\nIndustries: []" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 19/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784463704", "to_ids": true, "type": "sha256", "uuid": "ba0f60c3-dd5b-4ef9-b5a5-462bc361814c", "value": "cc853b3e4504c890d275ac2327f18acd7e4c5b99ca056181f3f5694781f2cf45", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 19/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784463706", "to_ids": true, "type": "sha256", "uuid": "f10dcb02-9972-4cd2-bb55-5982d26d7fb1", "value": "95577498d23fe750221a5badfc25b5e9f020dcf4d80c79a019b090e3c3b0a32a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 19/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784463707", "to_ids": true, "type": "sha256", "uuid": "9ea4c19a-a865-4237-bb25-6bab70cfc4bf", "value": "7e42d25e707d29d5d185a4c5dc71019f744e88a30b66bbf06949194ff32dbc48", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784465072", "to_ids": true, "type": "hostname", "uuid": "dfaccae8-b4bd-4e38-ba3c-b26e440db5d1", "value": "s3.ru-3.storage.selcloud.ru", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784465093", "to_ids": true, "type": "hostname", "uuid": "d8c1de02-538f-4a4c-bf29-8e075a6b8024", "value": "bots.pepesoft.ru", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 19/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784463707", "to_ids": true, "type": "md5", "uuid": "be89b10b-461a-4a30-aa49-40272cc85b12", "value": "21b4be57bd3743738393f44d9464e212", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 19/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784463708", "to_ids": true, "type": "md5", "uuid": "ce4cf878-15e7-404c-bffb-850bb769aa76", "value": "5bd610283d9c4b4ead45ca4f1b35d0f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784465114", "to_ids": true, "type": "url", "uuid": "f6cf1bb5-06ea-475e-8e69-8a98997cb973", "value": "https://s3.ru-3.storage.selcloud.ru", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784465135", "to_ids": true, "type": "domain", "uuid": "a17df421-a43a-45c1-8d3f-ac707744153c", "value": "grandrp.su", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465156", "uuid": "d47b884e-1d98-4ea7-baaf-a6b558ef7308", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "md5", "timestamp": "1784465156", "to_ids": true, "type": "md5", "uuid": "a2fde56b-041a-480c-8b41-7d72bde40526", "value": "918a380d16aa9b2d7b38b1c368a340df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "sha1", "timestamp": "1784463669", "to_ids": true, "type": "sha1", "uuid": "907ffb9c-cc1f-4576-bb97-9fdd5019f05e", "value": "70cb8e857ba0753b748aa63ed5b763d2812365b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "sha256", "timestamp": "1784463669", "to_ids": true, "type": "sha256", "uuid": "8dccbd75-fe37-4dea-bb41-0d3191dc88f2", "value": "d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "text", "timestamp": "1784461434", "to_ids": false, "type": "text", "uuid": "efebc21a-7f59-40ce-918a-c054340f0395", "value": "Type Description: Win32 EXE\nOriginal name: albion.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 12/74\nFirst Submission: 2026-07-14T11:45:37+00:00\nLast Submission: 2026-07-14T11:45:37+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "creation-time", "timestamp": "1784461434", "to_ids": false, "type": "datetime", "uuid": "d6934d74-b3e5-44e5-a264-288f705da16a", "value": "2059-01-06T02:55:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "ssdeep", "timestamp": "1784461434", "to_ids": true, "type": "ssdeep", "uuid": "b79ac71b-dc80-4320-93e4-a9ef2f1843f4", "value": "768:kuRyuvr5Jy4Bz60uICeYoLsbqGVUQv5BN8uPPcUcOZAMzGR6u2M+utEV9zKI4lCl:kWo5INLsbqGVdiOZAu4y2lCOoX6/fm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461434", "to_ids": false, "type": "size-in-bytes", "uuid": "b9807d96-1f6b-4ea8-95f3-31da5dcde7fc", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "vhash", "timestamp": "1784461434", "to_ids": true, "type": "vhash", "uuid": "6baceca5-3535-4446-b4ea-1839d7612601", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:45:37+00:00", "last_seen": "2026-07-14T11:45:37+00:00", "object_relation": "filename", "timestamp": "1784461434", "to_ids": true, "type": "filename", "uuid": "0b9c520c-84e8-4e7b-a174-76d01b90a1a9", "value": "albion.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465177", "uuid": "fc0ab6b2-1afc-4fa6-b627-6145a7465e90", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "md5", "timestamp": "1784465177", "to_ids": true, "type": "md5", "uuid": "b147f3f6-2939-4bd7-9048-2c8baf007a1a", "value": "609c75ea11376b4e92f18f96640c524b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "sha1", "timestamp": "1784463670", "to_ids": true, "type": "sha1", "uuid": "d1b406c1-4df4-433d-8c87-7c4b213832ba", "value": "b044ad72f04eb4473cbb22af956c77e6581fccaa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "sha256", "timestamp": "1784463670", "to_ids": true, "type": "sha256", "uuid": "915fdbd5-74aa-420a-9356-88299087c562", "value": "9a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "text", "timestamp": "1784461455", "to_ids": false, "type": "text", "uuid": "43b4ec30-04b0-4e1b-919b-f661be121d26", "value": "Type Description: Win32 EXE\nOriginal name: amazingrp.dll\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-07-14T11:47:32+00:00\nLast Submission: 2026-07-14T11:47:32+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "creation-time", "timestamp": "1784461455", "to_ids": false, "type": "datetime", "uuid": "027d7006-eec7-4a6f-be99-1e712503bede", "value": "2052-07-07T14:29:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "ssdeep", "timestamp": "1784461455", "to_ids": true, "type": "ssdeep", "uuid": "8e234dd6-a0d7-4c2f-ad6e-2b4fd65634de", "value": "768:QfuRyuvr5Jy4BjColWhesmM2sbqGFUQvDBN8uzXqpCjjoVLcs+v/1X2M+utEV9zy:6Wo752sbqGFfMVLeH1U2lCOoX69Lh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461455", "to_ids": false, "type": "size-in-bytes", "uuid": "6585f8e9-9109-4a9b-962f-f36543489e83", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "vhash", "timestamp": "1784461455", "to_ids": true, "type": "vhash", "uuid": "c26391b3-32a0-4ca5-a9af-73d0284495a9", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:47:32+00:00", "last_seen": "2026-07-14T11:47:32+00:00", "object_relation": "filename", "timestamp": "1784461455", "to_ids": true, "type": "filename", "uuid": "d7e37cd1-7dd8-4719-9fa8-abc02560cfcf", "value": "amazingrp.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465198", "uuid": "2a7cb1d8-81d6-445d-bc4c-0b20b22ca368", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "md5", "timestamp": "1784465198", "to_ids": true, "type": "md5", "uuid": "def43af3-084a-4cd1-900e-aa7f4a02ef8c", "value": "8e1efe19132e40ecce8acf604d15c6d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "sha1", "timestamp": "1784463672", "to_ids": true, "type": "sha1", "uuid": "41ea391d-1b3b-4367-be07-768eefe5da18", "value": "fea65e024147d3b685114b47e81beb92a879a0d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "sha256", "timestamp": "1784463672", "to_ids": true, "type": "sha256", "uuid": "78d05a27-af21-4e2e-afc9-21169d14f2c4", "value": "900ddb81d27e03967209fee4d17d13deb68eef0e1f10936eb520ca10575cb49e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "text", "timestamp": "1784461476", "to_ids": false, "type": "text", "uuid": "6df3543d-313f-49cf-bfb5-453b090a748b", "value": "Type Description: Win32 EXE\nOriginal name: calculator.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2026-07-14T12:26:50+00:00\nLast Submission: 2026-07-14T12:26:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "creation-time", "timestamp": "1784461476", "to_ids": false, "type": "datetime", "uuid": "a13b746e-de5f-4447-bb18-92776ff7a4bb", "value": "2095-03-09T07:54:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "ssdeep", "timestamp": "1784461476", "to_ids": true, "type": "ssdeep", "uuid": "4e473a56-ccc1-49f7-8e73-fa817f93fad1", "value": "768:n2kRofsQ2qCwDqTkwGRafNL7KmLj9vhq5eNQkEBgrtp2M+utEV9zKI4lCOoXnm7e:n/9qb9wGRoX2om1+O2lCOoX6Arh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461476", "to_ids": false, "type": "size-in-bytes", "uuid": "92c4a302-0d0c-461f-b201-ca3a735e0e48", "value": "64512" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "vhash", "timestamp": "1784461476", "to_ids": true, "type": "vhash", "uuid": "924693b6-c09c-4725-ba9d-54da1ece8cd1", "value": "2640366575116061b281200414" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:26:50+00:00", "last_seen": "2026-07-14T12:26:50+00:00", "object_relation": "filename", "timestamp": "1784461476", "to_ids": true, "type": "filename", "uuid": "0ec262a3-bbcc-4215-97d4-af5c8443c6ea", "value": "calculator.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465219", "uuid": "0b5ecd63-2a11-4d3a-844d-7f6ecfc97710", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "md5", "timestamp": "1784465219", "to_ids": true, "type": "md5", "uuid": "a72670d4-61d6-4f79-ba37-4857d7336df7", "value": "2a05f3663de644266398f3414a3977f9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "sha1", "timestamp": "1784463673", "to_ids": true, "type": "sha1", "uuid": "dc60a437-8cc1-41b8-98e0-2269cc1c7395", "value": "e2800e6a83f5c3a3b423fb11ae1e7292b2208376", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "sha256", "timestamp": "1784463673", "to_ids": true, "type": "sha256", "uuid": "e5f4a20c-0af9-4976-a148-f6a575e2b17b", "value": "ab58a90eb3682c6dc3389cd700a64f68a19c0dac3d0fa8e3df97ae041f96d4e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "text", "timestamp": "1784461498", "to_ids": false, "type": "text", "uuid": "2c937629-999f-4dd3-93bb-2ca62f4c4a8f", "value": "Type Description: Win32 EXE\nOriginal name: grandrp.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2026-07-14T12:37:51+00:00\nLast Submission: 2026-07-14T12:37:51+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "creation-time", "timestamp": "1784461498", "to_ids": false, "type": "datetime", "uuid": "dc092d3c-ecea-49aa-b7e8-8a0fd0a6d0ac", "value": "2098-05-17T00:52:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "ssdeep", "timestamp": "1784461498", "to_ids": true, "type": "ssdeep", "uuid": "9bfb6a98-7648-4368-a1e7-6a8ce962eac9", "value": "1536:hWo2tBZmQsbqGjEIKvhoZdB41LhmJ2lCOoX63ch:ht2HZmQsbqGjtKZ+h2gX63+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461498", "to_ids": false, "type": "size-in-bytes", "uuid": "1b76dcef-c3cf-4fc2-8312-1555a7a86cb3", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "vhash", "timestamp": "1784461498", "to_ids": true, "type": "vhash", "uuid": "f948c28f-8af1-45d3-b725-1ff338b8ef9d", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:37:51+00:00", "last_seen": "2026-07-14T12:37:51+00:00", "object_relation": "filename", "timestamp": "1784461498", "to_ids": true, "type": "filename", "uuid": "6f916c26-0a0b-4809-bcbb-5cfb9c54df94", "value": "grandrp.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465240", "uuid": "7f9cdb29-406e-4f1d-9f39-947904396de9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "md5", "timestamp": "1784465240", "to_ids": true, "type": "md5", "uuid": "f8d72ef9-1741-43fc-9677-eb0ca0ce4b24", "value": "6d6e4bc6ba98cb9a0fb12c0202b2dd3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "sha1", "timestamp": "1784463674", "to_ids": true, "type": "sha1", "uuid": "b5a4e573-0f56-41cf-8dcc-ba2902681cfe", "value": "bee39383ad82fd6603d4eee0524e1069fea2eade", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "sha256", "timestamp": "1784463674", "to_ids": true, "type": "sha256", "uuid": "aca79ed0-fd9d-4765-803a-cb711acc05bf", "value": "e6e1049158ceb1971c61388349c81fa6047a7aecb4ff2089ef54a50dcc35dbc0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "text", "timestamp": "1784461519", "to_ids": false, "type": "text", "uuid": "8f66aa7a-9328-4b64-bce6-353ac908245d", "value": "Type Description: Win32 EXE\nOriginal name: gta5rp.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2026-07-14T12:28:40+00:00\nLast Submission: 2026-07-14T12:28:40+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "creation-time", "timestamp": "1784461519", "to_ids": false, "type": "datetime", "uuid": "2502314b-5937-4217-95c0-b546f53de2d0", "value": "2093-06-21T17:20:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "ssdeep", "timestamp": "1784461519", "to_ids": true, "type": "ssdeep", "uuid": "ee843530-7cc4-4073-9418-7e9d930be711", "value": "1536:RWolJwysbqGr5dU6vWQVipTC2lCOoX6MGn:RtvwysbqGr5dU6uQVeC2gX6M+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461519", "to_ids": false, "type": "size-in-bytes", "uuid": "b804a383-6791-44f3-a2d2-48aa6e3c1b34", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "vhash", "timestamp": "1784461519", "to_ids": true, "type": "vhash", "uuid": "e96796cf-fceb-4792-af3c-9a03cc4ef190", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:28:40+00:00", "last_seen": "2026-07-14T12:28:40+00:00", "object_relation": "filename", "timestamp": "1784461519", "to_ids": true, "type": "filename", "uuid": "aa1fc5ab-6176-484e-a31e-ec3173b8ee39", "value": "gta5rp.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465263", "uuid": "66184ab4-8be9-4110-b2d0-9b143dfa8d2e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "md5", "timestamp": "1784465263", "to_ids": true, "type": "md5", "uuid": "75dd71d0-3a52-4791-b931-82895314f4ef", "value": "f37efd22149e361a94438ab1b8d12a45", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "sha1", "timestamp": "1784463675", "to_ids": true, "type": "sha1", "uuid": "5328e2f1-f0ea-416b-95a2-7a6e1ee005a8", "value": "e6b3c2eb6ea43592164d7cce6556a8718574de74", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "sha256", "timestamp": "1784463675", "to_ids": true, "type": "sha256", "uuid": "59fddc76-c80e-429f-a4fb-5e636c6caf9e", "value": "d9f7ca9f93a7d188d51db308877b15d0beae932ca0bf4705384fbedf54b454c1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "text", "timestamp": "1784461541", "to_ids": false, "type": "text", "uuid": "1aee0e71-cd7e-4e97-9376-7705100f513f", "value": "Type Description: Win32 EXE\nOriginal name: lineage2.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-07-14T11:49:26+00:00\nLast Submission: 2026-07-14T11:49:26+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "creation-time", "timestamp": "1784461541", "to_ids": false, "type": "datetime", "uuid": "9cac2d78-c8f7-4ffb-af3b-0b91ea907c8a", "value": "2100-07-31T17:44:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "ssdeep", "timestamp": "1784461541", "to_ids": true, "type": "ssdeep", "uuid": "3630d2f7-a2ca-4a4a-8b0d-a7b0affdf52b", "value": "1536:pWosrIsbqG2Ad7iAf/K1TG2lCOoX6adh:ptGIsbqG2Ad7iKSG2gX6ar" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461541", "to_ids": false, "type": "size-in-bytes", "uuid": "4964a5ea-8ae1-4efb-a88b-786598c427d7", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "vhash", "timestamp": "1784461541", "to_ids": true, "type": "vhash", "uuid": "ffc23ba9-7653-4a3f-97ae-aca271d072a5", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T11:49:26+00:00", "last_seen": "2026-07-14T11:49:26+00:00", "object_relation": "filename", "timestamp": "1784461541", "to_ids": true, "type": "filename", "uuid": "aac06804-1d5c-4134-8b18-c8996616f6d7", "value": "lineage2.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465284", "uuid": "b70cffd6-eda3-44de-9690-0e2c12128e22", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "md5", "timestamp": "1784465284", "to_ids": true, "type": "md5", "uuid": "0c588165-597f-4637-81ec-35fc0ada9c8e", "value": "599bf6683e0a735416ae54640b53ec6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "sha1", "timestamp": "1784463676", "to_ids": true, "type": "sha1", "uuid": "904eefc4-e3ed-4180-b6ab-c1f567c29ed8", "value": "3c38576ac515531d4e6a79b1245a2f5618315491", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "sha256", "timestamp": "1784463676", "to_ids": true, "type": "sha256", "uuid": "58a20822-5ace-421d-9bd7-21a6250287c9", "value": "4d13f1136b13c871c65141b77ec7208488334ac4be511800196adcd328666305", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "text", "timestamp": "1784461563", "to_ids": false, "type": "text", "uuid": "566fc186-842c-4c7a-bec4-9729d528c282", "value": "Type Description: Win32 EXE\nOriginal name: majestic.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-07-14T12:23:18+00:00\nLast Submission: 2026-07-14T12:23:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "creation-time", "timestamp": "1784461563", "to_ids": false, "type": "datetime", "uuid": "c226fd60-18e5-474b-9a44-edab58f98f4a", "value": "2074-11-25T01:15:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "ssdeep", "timestamp": "1784461563", "to_ids": true, "type": "ssdeep", "uuid": "2f5ba3be-ec68-4549-b421-9a61e5fd25ec", "value": "768:duRyuvr5Jy4brzzdflqcBgrsbqGrUQvz/N8uXfLaaAB7lKpnx0qqN2M+utEV9zKR:dWoQUrsbqGrZDaaBpyqP2lCOoX6Fth" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461563", "to_ids": false, "type": "size-in-bytes", "uuid": "2dd69753-9fed-4e11-9f04-89b8f1ee87a0", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "vhash", "timestamp": "1784461563", "to_ids": true, "type": "vhash", "uuid": "bbbfa8d6-a755-4937-b2de-d4a3ad31e4db", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:23:18+00:00", "last_seen": "2026-07-14T12:23:18+00:00", "object_relation": "filename", "timestamp": "1784461563", "to_ids": true, "type": "filename", "uuid": "5dec9d11-b833-45c1-a299-99b6dd6faf6d", "value": "majestic.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465305", "uuid": "1b72cd22-c4bf-4051-baa0-440dc66bf60c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "md5", "timestamp": "1784465305", "to_ids": true, "type": "md5", "uuid": "85717269-834d-496d-bbff-bbaa18105804", "value": "f9f7c81f0952c1d1723ef466c2b32c0e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "sha1", "timestamp": "1784463678", "to_ids": true, "type": "sha1", "uuid": "ebb6d14a-ac47-4ecc-9d2a-7984f38216d2", "value": "b27838f3f237a76f1445f83e82d76b61bdffe74e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "sha256", "timestamp": "1784463678", "to_ids": true, "type": "sha256", "uuid": "2fea49d4-bb52-4d8c-820f-f154775aef3f", "value": "011926de3d0cc2b970627b9bf0de003e731f8576602dff756d2ab54a9de61972", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "text", "timestamp": "1784461584", "to_ids": false, "type": "text", "uuid": "e7c1a814-5e17-4da4-90f0-b98e155a5655", "value": "Type Description: Win32 EXE\nOriginal name: rmrp.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 10/74\nFirst Submission: 2026-06-25T15:30:54+00:00\nLast Submission: 2026-06-25T15:30:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "creation-time", "timestamp": "1784461584", "to_ids": false, "type": "datetime", "uuid": "8ad0fc45-1bb6-426b-b160-e2656dee9533", "value": "2082-02-22T20:49:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "ssdeep", "timestamp": "1784461584", "to_ids": true, "type": "ssdeep", "uuid": "05d8a572-176c-4919-8072-87ef49e6f063", "value": "768:yuRyuvr5Jy4b1EA+FvsKFQrsbqG7UQvhbN8uuHlI1gkeJdRl12M+utEV9zKI4lCE:yWoVUTrsbqG7KqsdO2lCOoX6TJh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461584", "to_ids": false, "type": "size-in-bytes", "uuid": "4f528038-4c2f-489e-846b-a1821101e679", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "vhash", "timestamp": "1784461584", "to_ids": true, "type": "vhash", "uuid": "3b4d9996-a3fc-4bf9-92de-e1b26e577f2b", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T15:30:54+00:00", "last_seen": "2026-06-25T15:30:54+00:00", "object_relation": "filename", "timestamp": "1784461584", "to_ids": true, "type": "filename", "uuid": "ef420d8e-0e19-4a67-a43c-6d295a1361c5", "value": "rmrp.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465326", "uuid": "3529ec49-669a-42a6-99c7-461b5f633113", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "md5", "timestamp": "1784465326", "to_ids": true, "type": "md5", "uuid": "413371a0-8dd4-4aa2-8d85-af7bfbf80aa1", "value": "af20c1b0d54067b5d4cd82f74bb60297", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "sha1", "timestamp": "1784463679", "to_ids": true, "type": "sha1", "uuid": "239e9b29-d541-4e37-aafe-ee266490560c", "value": "184a468f5ecc39656d8b8bfdb2e38f4fa4e51d56", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "sha256", "timestamp": "1784463679", "to_ids": true, "type": "sha256", "uuid": "e2a780e7-f17e-4fa1-a01b-c39210a75ce8", "value": "79c09e1ffb4804c14ff27d41ec08d4390455c92d65717be0aeeec2697297d76a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "text", "timestamp": "1784461606", "to_ids": false, "type": "text", "uuid": "8a592c5b-2feb-496b-8cd2-a81721ba185d", "value": "Type Description: Win32 EXE\nOriginal name: rusfish4.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2026-07-14T12:36:01+00:00\nLast Submission: 2026-07-14T12:36:01+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "creation-time", "timestamp": "1784461606", "to_ids": false, "type": "datetime", "uuid": "8eea654f-1b3d-43d5-abf7-6771403ea581", "value": "2055-02-06T12:59:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "ssdeep", "timestamp": "1784461606", "to_ids": true, "type": "ssdeep", "uuid": "3bcdb664-4c7b-42bf-9a01-1ec97a6bf84a", "value": "768:SuRyuvr5Jy4blvmMphltcBgQsbqGjUQvJlN8uxkODuZIVBQO2M+utEV9zKI4lCOX:SWoyBrQsbqGjjLSZIVc2lCOoX6vth" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461606", "to_ids": false, "type": "size-in-bytes", "uuid": "0e3714de-9732-4e59-9e47-cb5edcd05728", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "vhash", "timestamp": "1784461606", "to_ids": true, "type": "vhash", "uuid": "24305592-08e1-4883-9d60-ac55840add21", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:36:01+00:00", "last_seen": "2026-07-14T12:36:01+00:00", "object_relation": "filename", "timestamp": "1784461606", "to_ids": true, "type": "filename", "uuid": "70780907-8d9a-4728-95c4-3c2faab5d6e3", "value": "rusfish4.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465347", "uuid": "faa8576c-c34e-462a-93a1-bc0b80ed3e9e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "md5", "timestamp": "1784465347", "to_ids": true, "type": "md5", "uuid": "285e1008-ca57-43c0-be96-0d01341e68c7", "value": "fdf69a52f562fda8d3401bb37fe63b8e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "sha1", "timestamp": "1784463680", "to_ids": true, "type": "sha1", "uuid": "6b7d85b6-0629-4f54-bf98-9aaa1f7a5125", "value": "9ace73fc029b32014a51f4db4b97a3e821d6b4d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "sha256", "timestamp": "1784463680", "to_ids": true, "type": "sha256", "uuid": "e8562914-39d1-4259-80ea-78d105136afd", "value": "5f3a9ebf7039097b3cdbca8609b5b68af07eeb1dbf716ba2817a97fc7c543854", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "text", "timestamp": "1784461627", "to_ids": false, "type": "text", "uuid": "4fcbed4c-65b6-4ac1-8c00-6679c9a04c45", "value": "Type Description: Win32 EXE\nOriginal name: setup.dll\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 22/74\nFirst Submission: 2026-07-14T12:30:46+00:00\nLast Submission: 2026-07-14T12:30:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "creation-time", "timestamp": "1784461627", "to_ids": false, "type": "datetime", "uuid": "6ae32b86-59e2-4540-922c-dbae74c672af", "value": "2088-10-22T06:16:41+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "ssdeep", "timestamp": "1784461627", "to_ids": true, "type": "ssdeep", "uuid": "a804fa3c-c362-4b29-9f0a-1b938bfb7eb0", "value": "1536:jWo0W/ZsbqG5pn8HFoM2DYNeh2lCOoX65yh:jtBZsbqG5eHFt322gX65I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461627", "to_ids": false, "type": "size-in-bytes", "uuid": "49338bb3-1e5a-4b69-b7de-0c36fda1bea0", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "vhash", "timestamp": "1784461627", "to_ids": true, "type": "vhash", "uuid": "65e63ff2-35c1-4551-ae82-e0ef3f0b110a", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T12:30:46+00:00", "last_seen": "2026-07-14T12:30:46+00:00", "object_relation": "filename", "timestamp": "1784461627", "to_ids": true, "type": "filename", "uuid": "4a1ddda3-aa9f-4fe7-a339-6b5531bf959c", "value": "setup.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465370", "uuid": "774dbb2f-2dd0-4920-8c54-55b367ad6e73", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "md5", "timestamp": "1784465370", "to_ids": true, "type": "md5", "uuid": "051a6b70-0c91-479f-b146-007962eb3c5e", "value": "7a050162c7cd766e47352f8901c1c8a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "sha1", "timestamp": "1784463681", "to_ids": true, "type": "sha1", "uuid": "3b9dc4b6-a59c-4ee9-91ef-8b695cd8b05b", "value": "5e3d260dd9a2c9acf9cf0b6cd3e85eb9ab5df654", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "sha256", "timestamp": "1784463681", "to_ids": true, "type": "sha256", "uuid": "c9fa0796-8bbd-4786-9fe8-9ad0715f6e07", "value": "23808e7638f7a00b1ef9b9f4ca524f8a46cf63be6f6b79fec8e4a3fd1cc82a1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "text", "timestamp": "1784461649", "to_ids": false, "type": "text", "uuid": "b5bce014-8cda-4d09-af7e-8f3e93975f30", "value": "Type Description: Win32 EXE\nOriginal name: trigger.dll\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 33/74\nFirst Submission: 2026-07-14T10:44:18+00:00\nLast Submission: 2026-07-14T10:44:18+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "creation-time", "timestamp": "1784461649", "to_ids": false, "type": "datetime", "uuid": "adcc8f5f-46da-4c93-b0c3-dc6a09a86246", "value": "2094-05-17T09:14:13+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "ssdeep", "timestamp": "1784461649", "to_ids": true, "type": "ssdeep", "uuid": "dd709212-7e3a-49c5-a51d-0b5516e63f87", "value": "1536:2WoglBBmCsbqGXJ9l1yuJtzrZaW2lCOoX6rsh:2tgfBmCsbqGXHyYzrZaW2gX6ru" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461649", "to_ids": false, "type": "size-in-bytes", "uuid": "977a9b00-fe3d-401d-bd25-2522c9abf2cc", "value": "65024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "vhash", "timestamp": "1784461649", "to_ids": true, "type": "vhash", "uuid": "a233e326-ce96-4170-a335-077a0771a13a", "value": "2640366575116061b281400614" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T10:44:18+00:00", "last_seen": "2026-07-14T10:44:18+00:00", "object_relation": "filename", "timestamp": "1784461649", "to_ids": true, "type": "filename", "uuid": "a31e68a1-4d1d-462b-888f-b9fd658a3592", "value": "trigger.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465391", "uuid": "af0746c7-6286-4f1c-a37f-db126cb21f68", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "md5", "timestamp": "1784465391", "to_ids": true, "type": "md5", "uuid": "1c7fa9ed-676f-4391-a2b8-3e1a461ce519", "value": "40b7c3a2adb4e74e4177a2a7cbe36808", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "sha1", "timestamp": "1784463682", "to_ids": true, "type": "sha1", "uuid": "8c5f9241-3152-429a-84f1-a6e4b78baae5", "value": "e6e6e2ee0d26883608f100b0e58e152617493595", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "sha256", "timestamp": "1784463683", "to_ids": true, "type": "sha256", "uuid": "839d2d01-fe1d-48a0-a815-3a928fc63ebf", "value": "e8c2618565aa31d7ffe909ebc99040bafcc0ea8df7f5d92fa673bb7ffacb14c9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "text", "timestamp": "1784461670", "to_ids": false, "type": "text", "uuid": "6d7c1be8-22df-4497-b195-c8bcf1de94b2", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-07-08T13:21:42+00:00\nLast Submission: 2026-07-08T13:21:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "creation-time", "timestamp": "1784461670", "to_ids": false, "type": "datetime", "uuid": "b6be446b-fd35-4347-a6c1-ec1114c0c168", "value": "2026-07-05T11:38:43+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "ssdeep", "timestamp": "1784461670", "to_ids": true, "type": "ssdeep", "uuid": "a020bd2f-5662-4b7a-a3f1-1d8b44261b50", "value": "3145728:5GXnOGa7K1/h8fNknAnIdA7lxRXm4VnolGIr9dQPgVn/r93jQ:kXnpa7oGfqdbkMGQQPgBj9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461670", "to_ids": false, "type": "size-in-bytes", "uuid": "44507459-4c9a-4abd-afda-a145b3bf9e63", "value": "119651760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "vhash", "timestamp": "1784461670", "to_ids": true, "type": "vhash", "uuid": "2ea5f7b0-778c-4af5-af48-b1e9b5be9643", "value": "018076655d155d05755048z69mz12fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:21:42+00:00", "last_seen": "2026-07-08T13:21:42+00:00", "object_relation": "filename", "timestamp": "1784461670", "to_ids": true, "type": "filename", "uuid": "e4a9b8c0-4819-4ea9-b568-81c49b6113c6", "value": "amazing.rp.pepesoft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465412", "uuid": "a816942e-7b6e-4ccf-b6bc-43c7eaa4663e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "md5", "timestamp": "1784465412", "to_ids": true, "type": "md5", "uuid": "551e1937-8b6b-471a-81f3-0545b056f8e6", "value": "8dc0ac14b8c1aa3b4a83a2d5655f327c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "sha1", "timestamp": "1784463684", "to_ids": true, "type": "sha1", "uuid": "477570c4-5fca-4936-89fd-4ca8b03a1020", "value": "8fc99d6507247ebbdff1c96b8168edf099938f4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "sha256", "timestamp": "1784463684", "to_ids": true, "type": "sha256", "uuid": "1f693b01-c65e-42b5-8d67-7b8f9eecd024", "value": "6eefe9d5f030d403c72bd4e4caf5bbb9dbc2bd5e15ebb07de153494f458e5eb9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "text", "timestamp": "1784461692", "to_ids": false, "type": "text", "uuid": "1778aab6-cd62-4ff1-a143-5512ba7209c1", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-08T13:22:09+00:00\nLast Submission: 2026-07-08T13:22:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "creation-time", "timestamp": "1784461692", "to_ids": false, "type": "datetime", "uuid": "55be5736-455d-4291-a567-cdc0ef49fd0b", "value": "2026-07-05T11:38:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "ssdeep", "timestamp": "1784461692", "to_ids": true, "type": "ssdeep", "uuid": "3a0b14f9-5884-4a0e-af4d-5313ce9557fb", "value": "3145728:ZGxnOGa7K1/h8fNknAnIdA7lxKXm4VnoRGIrfdQPgVnDr93jN:Exnpa7oGfqdckyGQWPgB39" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461692", "to_ids": false, "type": "size-in-bytes", "uuid": "403da39d-56e0-4716-bb6d-7d5aae8f64eb", "value": "116064109" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "vhash", "timestamp": "1784461692", "to_ids": true, "type": "vhash", "uuid": "00817516-692e-4e02-9dd1-b554ca8ca05e", "value": "018076655d155d05755048z69mz12fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:22:09+00:00", "last_seen": "2026-07-08T13:22:09+00:00", "object_relation": "filename", "timestamp": "1784461692", "to_ids": true, "type": "filename", "uuid": "f525e986-93fe-42f5-a57f-1048ee66bf26", "value": "grandrp.su.pepesoft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465433", "uuid": "8c64ee3c-2b2d-41c1-a160-f242f051ed30", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "md5", "timestamp": "1784465433", "to_ids": true, "type": "md5", "uuid": "542f04f5-a27c-4eb4-a08b-d331799e4e09", "value": "a3f744691548b3ad9676c2990e8b3f4f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "sha1", "timestamp": "1784463685", "to_ids": true, "type": "sha1", "uuid": "b547a727-2f2f-41ab-80a9-4d88a64d1d6f", "value": "5175879cc7a2cc1772ef6573a750717d5088f0e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "sha256", "timestamp": "1784463685", "to_ids": true, "type": "sha256", "uuid": "c49190d7-e4b2-4057-9061-71e2107f4683", "value": "8ab256dd839aec6638cd46374f4a6664e534b9341bbcdfd9b763e5a27c51ddb7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "text", "timestamp": "1784461714", "to_ids": false, "type": "text", "uuid": "208f8ee6-5111-4faf-88be-d08e43d4d7e0", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-08T13:22:43+00:00\nLast Submission: 2026-07-08T13:22:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "creation-time", "timestamp": "1784461714", "to_ids": false, "type": "datetime", "uuid": "6361e5a1-dc4d-4ce0-9073-e1743bb2eac1", "value": "2026-07-05T11:38:40+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "ssdeep", "timestamp": "1784461714", "to_ids": true, "type": "ssdeep", "uuid": "568ce441-d224-4fce-b8c0-fc7216a7a1f7", "value": "3145728:IGInOGa7K1/h8fNknAnIdA7lxK/m4Vno8GIrkdQPgV98J93jN:PInpa7oGfqdck5GQZPgju9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461714", "to_ids": false, "type": "size-in-bytes", "uuid": "8cbeafea-acd2-4822-8a2a-244cfb1a55b1", "value": "116330305" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "vhash", "timestamp": "1784461714", "to_ids": true, "type": "vhash", "uuid": "5a32b371-40db-4f47-98f0-448f9f8c1389", "value": "018076655d155d05755048z69mz12fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:22:43+00:00", "last_seen": "2026-07-08T13:22:43+00:00", "object_relation": "filename", "timestamp": "1784461714", "to_ids": true, "type": "filename", "uuid": "e4c244e3-fac1-42df-884f-2fbf8d676d6c", "value": "gta5rp.com.pepesoft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465455", "uuid": "3d2792d6-7b43-463f-a8e4-22f677a6b5fd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "md5", "timestamp": "1784465455", "to_ids": true, "type": "md5", "uuid": "4ad6b55c-3cc5-4d5d-addf-2f304a5f72a4", "value": "0724a81b879825f81b123b6a2117205d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "sha1", "timestamp": "1784463686", "to_ids": true, "type": "sha1", "uuid": "7616d847-9aa5-4ae3-ae86-148280c286c6", "value": "0b16690d52a66b67d7dba5997391b8a8a352d5da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "sha256", "timestamp": "1784463687", "to_ids": true, "type": "sha256", "uuid": "c202ff4d-d5ac-4a7f-808c-c500481ce260", "value": "6c1f828e4d8395dde8293868c65ba8d86b3b9672ebbbb16e932624706d37d832", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "text", "timestamp": "1784461735", "to_ids": false, "type": "text", "uuid": "13ae482d-096a-4769-be39-389f89d860b0", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-07-08T13:23:05+00:00\nLast Submission: 2026-07-08T13:23:05+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "creation-time", "timestamp": "1784461736", "to_ids": false, "type": "datetime", "uuid": "96df3a5a-a284-4e2b-b39c-474fd858e2db", "value": "2026-07-05T11:38:40+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "ssdeep", "timestamp": "1784461735", "to_ids": true, "type": "ssdeep", "uuid": "a433bb50-60e7-49e9-ab8f-0f96ce310e6e", "value": "3145728:ZGApnOGa7K1/h8fNknAnIdA7lxKXm4VnogGIrfdQPgVnDr93jN:EApnpa7oGfqdcklGQWPgB39" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461735", "to_ids": false, "type": "size-in-bytes", "uuid": "8856616c-22c1-4ea7-a226-365a3304711b", "value": "116468496" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "vhash", "timestamp": "1784461735", "to_ids": true, "type": "vhash", "uuid": "03dfc4cf-3887-4314-9e48-8765964f70a2", "value": "018076655d155d05755048z69mz12fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:05+00:00", "last_seen": "2026-07-08T13:23:05+00:00", "object_relation": "filename", "timestamp": "1784461735", "to_ids": true, "type": "filename", "uuid": "102382a3-b2ce-4ff3-b584-655517f8cea8", "value": "lineage2panel.pepesoft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465476", "uuid": "1c7a6022-f9de-432c-bd9a-42039030384f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "md5", "timestamp": "1784465476", "to_ids": true, "type": "md5", "uuid": "7e9a3953-d36d-4de9-bf5f-58c25331e653", "value": "e12e689af2a2c72b81c9f952a0bc5f71", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "sha1", "timestamp": "1784463688", "to_ids": true, "type": "sha1", "uuid": "8be78a98-7473-48dd-a90c-7c9a6eb4231a", "value": "e23d4059c8755087017ca60160fd018bc2727485", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "sha256", "timestamp": "1784463688", "to_ids": true, "type": "sha256", "uuid": "086bd972-007d-4dd8-b64a-3faa66674e36", "value": "6cbd4bc491deb11040e2b2f91b0b4e129af551a802fc78cb42e0e985297ef44c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "text", "timestamp": "1784461757", "to_ids": false, "type": "text", "uuid": "9dce97c0-b21e-4c5f-9b9c-689692a8a025", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-07-08T13:23:25+00:00\nLast Submission: 2026-07-08T13:23:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "creation-time", "timestamp": "1784461757", "to_ids": false, "type": "datetime", "uuid": "00035a4c-891a-4c7d-86a5-b04f49e9fa59", "value": "2026-07-05T11:38:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "ssdeep", "timestamp": "1784461757", "to_ids": true, "type": "ssdeep", "uuid": "6e924539-05d7-4a43-bac1-00319eda58e3", "value": "3145728:WGbnOGa7K1/h8fNknAnIdA7lxKXm4VnoiGIrUyydQPgVLbWY3jN:Zbnpa7oGfqdckHGQUy7Pg5aY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461757", "to_ids": false, "type": "size-in-bytes", "uuid": "ea25b101-ae1c-430c-87e4-5704efe2c108", "value": "118811993" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "vhash", "timestamp": "1784461757", "to_ids": true, "type": "vhash", "uuid": "51d74bc3-f8cb-42b2-bd1c-f4a22ce06738", "value": "018076655d155d05755048z69mz12fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:25+00:00", "last_seen": "2026-07-08T13:23:25+00:00", "object_relation": "filename", "timestamp": "1784461757", "to_ids": true, "type": "filename", "uuid": "58b84af8-1b2f-4ef2-9db0-a2c4ced49509", "value": "majesticpanel.pepesoft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465497", "uuid": "36ae1357-5e83-4fda-8f27-75495c453850", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "md5", "timestamp": "1784465497", "to_ids": true, "type": "md5", "uuid": "870a7925-e9bd-439f-a818-3ee9258fb65e", "value": "35573e9960b44e9ef08428350dc60e45", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "sha1", "timestamp": "1784463689", "to_ids": true, "type": "sha1", "uuid": "06191c20-3122-4b4d-9f58-8cd2c2b7128f", "value": "c9388da97669a25d64b5e766d97bc8b26bbbcece", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "sha256", "timestamp": "1784463689", "to_ids": true, "type": "sha256", "uuid": "607d0ca3-96b9-4535-a29e-d506d99f1322", "value": "5d9843126db4223dc2a8a9cd4a627286fe1a6345e33b28e9c98b5fe56fe89da6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "text", "timestamp": "1784461779", "to_ids": false, "type": "text", "uuid": "350d56f3-cb16-4456-b4f2-b7e1189f5b77", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-07-08T13:23:47+00:00\nLast Submission: 2026-07-08T13:23:47+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "creation-time", "timestamp": "1784461779", "to_ids": false, "type": "datetime", "uuid": "3ec6f937-ee9f-4568-bcf4-0a5f8ba15471", "value": "2026-07-05T11:38:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "ssdeep", "timestamp": "1784461779", "to_ids": true, "type": "ssdeep", "uuid": "6d4b4a48-2797-41c9-91b3-38a2a6b0fa10", "value": "3145728:zGD4nOGa7K1/h8fNknAnIdA7lxK/m4VnoPGIrMdQPgVnUJ93jN:iD4npa7oGfqdckkGQxPgB29" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461779", "to_ids": false, "type": "size-in-bytes", "uuid": "812f8e61-d1ba-4fc0-b584-0534e3b5e600", "value": "115475021" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "vhash", "timestamp": "1784461779", "to_ids": true, "type": "vhash", "uuid": "d4389767-3b32-4646-8c8c-b67300a0372e", "value": "018076655d155d05755048z69mz12fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:23:47+00:00", "last_seen": "2026-07-08T13:23:47+00:00", "object_relation": "filename", "timestamp": "1784461779", "to_ids": true, "type": "filename", "uuid": "babf781a-01b5-41d1-83b6-a610204a9bfd", "value": "rmrp.pepesoft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465518", "uuid": "b7ffa562-e743-45c0-8b0b-e2e8605c8397", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "md5", "timestamp": "1784465518", "to_ids": true, "type": "md5", "uuid": "80b58913-d20e-46f9-b7b5-1415b774dff6", "value": "2ed6254dcc5b8457b0982c088eb58820", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "sha1", "timestamp": "1784463690", "to_ids": true, "type": "sha1", "uuid": "205a6980-a102-4ffe-bc89-046be71efefd", "value": "71ebff05debc8ab084c45332392fcaa010f0fb5b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "sha256", "timestamp": "1784463691", "to_ids": true, "type": "sha256", "uuid": "3bc1486e-39fb-43bf-b566-46ca5ec3a034", "value": "c9f3e7766dbe728d84a1243447faa5f5eba0645bf13089074d128ea7663e7f5b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "text", "timestamp": "1784461801", "to_ids": false, "type": "text", "uuid": "19cd07cd-4c06-4029-a08b-578fc42dad51", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-08T13:24:11+00:00\nLast Submission: 2026-07-08T13:24:11+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "creation-time", "timestamp": "1784461801", "to_ids": false, "type": "datetime", "uuid": "1c497cf9-fa49-4ff2-9ddc-eb73c6985c41", "value": "2026-07-05T11:38:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "ssdeep", "timestamp": "1784461801", "to_ids": true, "type": "ssdeep", "uuid": "edda48e6-258e-41e0-864f-ec40eb290303", "value": "3145728:BGs8nOGa7K1/h8fNknAnIdA7lxKXm4Vno3GIr1dQPgVnD893jN:Mjnpa7oGfqdckeGQ4PgBA9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461801", "to_ids": false, "type": "size-in-bytes", "uuid": "52cfbe11-87d3-455c-9385-af92fbe40b33", "value": "116000948" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "vhash", "timestamp": "1784461801", "to_ids": true, "type": "vhash", "uuid": "41077c6c-4a09-48f5-a5f9-bd483fa70e51", "value": "018076655d155d05755048z69mz12fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:24:11+00:00", "last_seen": "2026-07-08T13:24:11+00:00", "object_relation": "filename", "timestamp": "1784461801", "to_ids": true, "type": "filename", "uuid": "ed0169bf-1624-4dc2-9273-68917e1c1dc2", "value": "russianfish4.pepesoft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465539", "uuid": "1db71de9-343d-4c3c-8043-1ee17051d8f7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "md5", "timestamp": "1784465539", "to_ids": true, "type": "md5", "uuid": "63bad1d1-8690-4d7a-b53f-dd3408ea0489", "value": "4b5da871fa6f95fcea6ab7624c909fe1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "sha1", "timestamp": "1784463692", "to_ids": true, "type": "sha1", "uuid": "0b6db9a9-48aa-453c-a6db-670583ef1d45", "value": "38508996aae517f602f622256f8ace60665cdeb1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "sha256", "timestamp": "1784463692", "to_ids": true, "type": "sha256", "uuid": "78469d38-adc1-47c3-a9a9-7958b40642b1", "value": "a2a5e473dba85959b21b7e8a184bc255d5f2dacdf7411b91d212fb1217d2518b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "text", "timestamp": "1784461824", "to_ids": false, "type": "text", "uuid": "72964671-aaf2-4175-b778-835b913fb514", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-07-08T13:24:35+00:00\nLast Submission: 2026-07-08T13:24:35+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "creation-time", "timestamp": "1784461824", "to_ids": false, "type": "datetime", "uuid": "1b156c30-6c26-44df-b1bf-cf5958f9ce4f", "value": "2026-07-05T11:38:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "ssdeep", "timestamp": "1784461824", "to_ids": true, "type": "ssdeep", "uuid": "a212e4e3-39eb-4270-b60a-cd2b6626213d", "value": "3145728:3fGknOGa7K1/h8fNknAnIdA7lxKXm4VnoGGIr+dQPgVnZr93jN:uknpa7oGfqdck3GQ3PgBJ9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461824", "to_ids": false, "type": "size-in-bytes", "uuid": "12b1966f-f787-4ad3-b4d9-c52ff8cc97a3", "value": "116124806" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "vhash", "timestamp": "1784461824", "to_ids": true, "type": "vhash", "uuid": "38423618-49d2-44a1-b480-3b89268ab2a3", "value": "018076655d155d05755048z69mz12fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T13:24:35+00:00", "last_seen": "2026-07-08T13:24:35+00:00", "object_relation": "filename", "timestamp": "1784461824", "to_ids": true, "type": "filename", "uuid": "7362fc34-e53f-4f32-a899-a363f4d11e44", "value": "trigpanel.pepesoft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465560", "uuid": "cabe11a5-bbfe-432d-bc33-2f1e7d06c7f9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "md5", "timestamp": "1784465560", "to_ids": true, "type": "md5", "uuid": "8b32186a-2410-4ab7-99cd-1b05a42bce51", "value": "d6b2c2d2851a63b90e7210a943d0fdf6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "sha1", "timestamp": "1784463693", "to_ids": true, "type": "sha1", "uuid": "fb17b781-ca05-4ef7-93f4-7778137e9657", "value": "642bfeae924b9d4e6ed642b5946ac8e745cfc531", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "sha256", "timestamp": "1784463693", "to_ids": true, "type": "sha256", "uuid": "fb64b524-1aef-456a-bf7b-00f556e218f0", "value": "ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "text", "timestamp": "1784461845", "to_ids": false, "type": "text", "uuid": "81bd5712-9221-43df-bca0-aad96d1a5134", "value": "Type Description: Win32 DLL\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2026-04-02T09:32:34+00:00\nLast Submission: 2026-07-16T22:50:44+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "creation-time", "timestamp": "1784461846", "to_ids": false, "type": "datetime", "uuid": "1ebbc021-4a3f-4c1f-8477-1bb450100854", "value": "2026-04-02T07:50:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "ssdeep", "timestamp": "1784461845", "to_ids": true, "type": "ssdeep", "uuid": "83547ba6-c029-4d70-8f8f-c99102083039", "value": "6144:sjTLQQOvUVTTPDlxkP8VXaVHaT8fyFmiGJZMzEKAqsCbb:sjTLTPGgn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461845", "to_ids": false, "type": "size-in-bytes", "uuid": "942a21a8-848a-4310-82b1-b30a6b049876", "value": "218624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "vhash", "timestamp": "1784461845", "to_ids": true, "type": "vhash", "uuid": "58d518ea-da85-445c-b69a-62e8e8eb9cd8", "value": "125066655d1555155bzf?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-02T09:32:34+00:00", "last_seen": "2026-07-16T22:50:44+00:00", "object_relation": "filename", "timestamp": "1784461845", "to_ids": true, "type": "filename", "uuid": "d609abbd-614f-4876-aeab-70edcdd24d42", "value": "fls9T3rJI0nabUrq5FvnZXMk61oUBM" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-15T04:27:37+00:00", "last_seen": "2026-07-15T04:27:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465581", "uuid": "7c7944c5-97f9-4588-bc30-32b7ea4fe6e9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T04:27:37+00:00", "last_seen": "2026-07-15T04:27:37+00:00", "object_relation": "md5", "timestamp": "1784465581", "to_ids": true, "type": "md5", "uuid": "b09d54b9-e404-41de-ae99-ee2289146955", "value": "ee9323ff64110858dc6493c23427feda", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T04:27:37+00:00", "last_seen": "2026-07-15T04:27:37+00:00", "object_relation": "sha1", "timestamp": "1784463694", "to_ids": true, "type": "sha1", "uuid": "beea5b3d-504e-4438-95ea-69c4c0e09dba", "value": "625a106b2dd4b0742e3123de33fbd9418eb741a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T04:27:37+00:00", "last_seen": "2026-07-15T04:27:37+00:00", "object_relation": "sha256", "timestamp": "1784463694", "to_ids": true, "type": "sha256", "uuid": "5c571b7b-0267-40d2-a49d-129547d8bd33", "value": "567952daf0ab7b36b017aac9963791188dea0fbf2e99c7cc6f6652ee540f4840", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T04:27:37+00:00", "last_seen": "2026-07-15T04:27:37+00:00", "object_relation": "text", "timestamp": "1784461867", "to_ids": false, "type": "text", "uuid": "57009919-33b8-4163-8416-0495beea91b7", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nClamAV: None\nVT Total Detection: 5/74\nFirst Submission: 2026-07-15T04:27:37+00:00\nLast Submission: 2026-07-15T04:27:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T04:27:37+00:00", "last_seen": "2026-07-15T04:27:37+00:00", "object_relation": "ssdeep", "timestamp": "1784461867", "to_ids": true, "type": "ssdeep", "uuid": "7382d33b-c3c3-451e-972e-0fa44a766aea", "value": "24576:wsSK6ZfehKc6HautofmX5eNHlDOr7zqx/5kD17ws1Q1vg73thVt5y:wtK6Z2ccButof4cHZOze8wHvahVy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T04:27:37+00:00", "last_seen": "2026-07-15T04:27:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461867", "to_ids": false, "type": "size-in-bytes", "uuid": "b259e8c7-3264-45dc-a04d-6b48fdeedf46", "value": "1450998" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-03T13:53:22+00:00", "last_seen": "2026-06-03T13:53:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465602", "uuid": "6125712a-2e2f-4369-a8a0-08d6c73f91a9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T13:53:22+00:00", "last_seen": "2026-06-03T13:53:22+00:00", "object_relation": "md5", "timestamp": "1784465602", "to_ids": true, "type": "md5", "uuid": "40dbc4cf-f03c-4ffe-91fd-54f0c140efb5", "value": "6af7f400b1aa547d0eaa1b8765d5a64b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T13:53:22+00:00", "last_seen": "2026-06-03T13:53:22+00:00", "object_relation": "sha1", "timestamp": "1784463696", "to_ids": true, "type": "sha1", "uuid": "48bf7d89-dd22-4a68-afbd-88eb30f7fbd6", "value": "51292ab3e6508b530ba361cb51a97ddd97dfc4a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T13:53:22+00:00", "last_seen": "2026-06-03T13:53:22+00:00", "object_relation": "sha256", "timestamp": "1784463696", "to_ids": true, "type": "sha256", "uuid": "037a127c-53f8-473d-993e-b7531ca98f02", "value": "476c6f36a22156e53548a87291989a21d6c905dcbd9e1bf68ff5bc12e5c8bb07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T13:53:22+00:00", "last_seen": "2026-06-03T13:53:22+00:00", "object_relation": "text", "timestamp": "1784461909", "to_ids": false, "type": "text", "uuid": "a644e10c-7612-4cfb-bdaf-f58533529791", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nClamAV: None\nVT Total Detection: 22/74\nFirst Submission: 2026-06-03T13:53:22+00:00\nLast Submission: 2026-06-03T13:53:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T13:53:22+00:00", "last_seen": "2026-06-03T13:53:22+00:00", "object_relation": "ssdeep", "timestamp": "1784461909", "to_ids": true, "type": "ssdeep", "uuid": "d8aa7507-e83a-4988-9294-379ba74b1886", "value": "49152:x+HIYtPJDfTiNxBiVU2Hex/jT6J+eNK5gRlnRAl51dXMNhRKcVnIo/tAlxUGMlol:gIQPJDLiNxBixHex/v6J+e45gRlnKl5V" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T13:53:22+00:00", "last_seen": "2026-06-03T13:53:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461909", "to_ids": false, "type": "size-in-bytes", "uuid": "17bf5ec2-1f60-45c5-93af-5dec86591a7e", "value": "2504342" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-15T13:18:30+00:00", "last_seen": "2026-07-15T13:19:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465623", "uuid": "af800606-54a4-41e1-8533-a9e1a0d88298", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:18:30+00:00", "last_seen": "2026-07-15T13:19:44+00:00", "object_relation": "md5", "timestamp": "1784465623", "to_ids": true, "type": "md5", "uuid": "8e214910-c26a-4955-b9f6-aac3ff99b125", "value": "9a54b27eaaa50b74bae0d7aeb62ce9c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:18:30+00:00", "last_seen": "2026-07-15T13:19:44+00:00", "object_relation": "sha1", "timestamp": "1784463697", "to_ids": true, "type": "sha1", "uuid": "02ea84e1-1e18-4996-85a6-3039209ca0cf", "value": "abaa7bcf6c6a7ff3fca266d27cb45d2bb68094d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:18:30+00:00", "last_seen": "2026-07-15T13:19:44+00:00", "object_relation": "sha256", "timestamp": "1784463697", "to_ids": true, "type": "sha256", "uuid": "7ff6e3c3-9002-40b5-bfdb-403d1b084f76", "value": "774e40046f353e3f916f39e3d13d6499da35705a479cfb89288c21017aaf5461", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T13:18:30+00:00", "last_seen": "2026-07-15T13:19:44+00:00", "object_relation": "text", "timestamp": "1784461931", "to_ids": false, "type": "text", "uuid": "62f410c9-9176-4df6-a340-45fdb6b6d528", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-15T13:18:30+00:00\nLast Submission: 2026-07-15T13:19:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T13:18:30+00:00", "last_seen": "2026-07-15T13:19:44+00:00", "object_relation": "ssdeep", "timestamp": "1784461931", "to_ids": true, "type": "ssdeep", "uuid": "d3230c4a-327c-41e9-b56a-1dd08c060b94", "value": "24576:P3pmS84/XipDZzFrahLyCI0LTbtIsEbuYqEaDua1S3z:PZh84vcehGChP4buNEGuaM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T13:18:30+00:00", "last_seen": "2026-07-15T13:19:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461931", "to_ids": false, "type": "size-in-bytes", "uuid": "b7c82193-2093-456c-8694-62794b79c9f0", "value": "954868" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T07:30:04+00:00", "last_seen": "2026-07-14T07:30:04+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465644", "uuid": "1119a4a7-475b-4e14-834e-3df156a40cb8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T07:30:04+00:00", "last_seen": "2026-07-14T07:30:04+00:00", "object_relation": "md5", "timestamp": "1784465644", "to_ids": true, "type": "md5", "uuid": "6763b84e-1f9b-41e6-a099-9787d571531d", "value": "bfe3fa820b3b253e66735ec554608880", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T07:30:04+00:00", "last_seen": "2026-07-14T07:30:04+00:00", "object_relation": "sha1", "timestamp": "1784463698", "to_ids": true, "type": "sha1", "uuid": "1e0424db-b9fa-4d47-9368-aee2609ba0b1", "value": "08024c430eb41ea2eea79f13387461b96e65795a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T07:30:04+00:00", "last_seen": "2026-07-14T07:30:04+00:00", "object_relation": "sha256", "timestamp": "1784463698", "to_ids": true, "type": "sha256", "uuid": "82f5024b-5155-4831-979d-70f3b326a0b3", "value": "23e4d8af5425dae022793450190c8d30809b2986dd879eb4bff557cdacf49c86", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T07:30:04+00:00", "last_seen": "2026-07-14T07:30:04+00:00", "object_relation": "text", "timestamp": "1784461952", "to_ids": false, "type": "text", "uuid": "c8a11d40-9d24-4709-ac65-6c9befeaf770", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-14T07:30:04+00:00\nLast Submission: 2026-07-14T07:30:04+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T07:30:04+00:00", "last_seen": "2026-07-14T07:30:04+00:00", "object_relation": "ssdeep", "timestamp": "1784461952", "to_ids": true, "type": "ssdeep", "uuid": "f470ef5e-2f17-49e4-a460-f2d581f9400b", "value": "12288:Owd29iR2K2mT2uj8rKqlAkRpQNkUJDyoUxeCMySE4evO2/Y2rd2YVeAAAc:Oo26MmTorKGN0xuoUoCMy+s9AAc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T07:30:04+00:00", "last_seen": "2026-07-14T07:30:04+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461952", "to_ids": false, "type": "size-in-bytes", "uuid": "de1b8632-10a2-4bb3-95d1-e93d3b18c0b3", "value": "532778" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-09T13:23:31+00:00", "last_seen": "2026-07-09T13:23:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465665", "uuid": "f37f5b86-6f92-409d-b22a-d14d99e518dc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T13:23:31+00:00", "last_seen": "2026-07-09T13:23:31+00:00", "object_relation": "md5", "timestamp": "1784465665", "to_ids": true, "type": "md5", "uuid": "46e2bbae-53e7-4431-8271-e639b3501ac2", "value": "54c3dfa46b0e2213fc2b47018ec75e3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T13:23:31+00:00", "last_seen": "2026-07-09T13:23:31+00:00", "object_relation": "sha1", "timestamp": "1784463700", "to_ids": true, "type": "sha1", "uuid": "1c889b48-4f71-4760-a5e2-9163da114a8b", "value": "5d648b02d5a8a7a5fc64109cfc1165d7e161d23c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T13:23:31+00:00", "last_seen": "2026-07-09T13:23:31+00:00", "object_relation": "sha256", "timestamp": "1784463700", "to_ids": true, "type": "sha256", "uuid": "600b263a-98c3-4b88-8b60-48f1ff03cfa6", "value": "2a4fed04d792b9c2fdf9c1456a08ca23eda5fef50c0b409ab294ad489e12d801", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T13:23:31+00:00", "last_seen": "2026-07-09T13:23:31+00:00", "object_relation": "text", "timestamp": "1784461995", "to_ids": false, "type": "text", "uuid": "22b3c380-0f5a-46cf-bc73-0b147c9a4cd2", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-09T13:23:31+00:00\nLast Submission: 2026-07-09T13:23:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T13:23:31+00:00", "last_seen": "2026-07-09T13:23:31+00:00", "object_relation": "ssdeep", "timestamp": "1784461995", "to_ids": true, "type": "ssdeep", "uuid": "9d289939-fec7-4d39-bcc4-ad10a2954c38", "value": "12288:XO/OzqoLrGhCaBqplK1LyKwXNcZqTRZYFWXZYw6aKA0ju7tFXb5Qtf4GkSoruDE8:XMOzLTbK1u7dEsCw9FdQl4Gk/oANSp3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T13:23:31+00:00", "last_seen": "2026-07-09T13:23:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461995", "to_ids": false, "type": "size-in-bytes", "uuid": "f0dee53c-573b-40de-85fc-bac21bb733f6", "value": "936224" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-09T13:21:31+00:00", "last_seen": "2026-07-09T13:21:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465687", "uuid": "6c71ddac-4d08-4d8e-9782-f6eb160df4b2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T13:21:31+00:00", "last_seen": "2026-07-09T13:21:31+00:00", "object_relation": "md5", "timestamp": "1784465687", "to_ids": true, "type": "md5", "uuid": "60236ec5-8f42-498c-b5bc-e5387610facd", "value": "09f47ae07e04e7e8663ad96734363e62", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T13:21:31+00:00", "last_seen": "2026-07-09T13:21:31+00:00", "object_relation": "sha1", "timestamp": "1784463700", "to_ids": true, "type": "sha1", "uuid": "a9ab0661-2547-464e-857a-a6e05afd6b9f", "value": "bc20339a9c009182174c778c82762f423fbe6cb8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T13:21:31+00:00", "last_seen": "2026-07-09T13:21:31+00:00", "object_relation": "sha256", "timestamp": "1784463701", "to_ids": true, "type": "sha256", "uuid": "95cb5eba-c946-4be6-965c-13c6352ffc3c", "value": "d59e1914d76499fa51bf861f418c84bda0b48913dc39bd2e73756e326e4ccbb0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T13:21:31+00:00", "last_seen": "2026-07-09T13:21:31+00:00", "object_relation": "text", "timestamp": "1784462037", "to_ids": false, "type": "text", "uuid": "b5e0b9d9-f2e9-4df6-899f-e38642eb83c6", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-09T13:21:31+00:00\nLast Submission: 2026-07-09T13:21:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T13:21:31+00:00", "last_seen": "2026-07-09T13:21:31+00:00", "object_relation": "ssdeep", "timestamp": "1784462037", "to_ids": true, "type": "ssdeep", "uuid": "0ccbc3fb-ca46-4c86-9aa1-736652ac6364", "value": "12288:C5LzWl5y7IfcvSAOFOVlmQf2zZDuSwLcZ9kVT0eZLUs9DzTYKMdwZrx80m:CQby7IfeO0r3f6GAMXXIHdwZu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T13:21:31+00:00", "last_seen": "2026-07-09T13:21:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784462037", "to_ids": false, "type": "size-in-bytes", "uuid": "0812ed91-f7fc-44ed-a95a-a50d348c378e", "value": "495259" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-15T08:18:48+00:00", "last_seen": "2026-07-15T08:18:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465708", "uuid": "f41f0f69-c9a3-4007-9251-c103b8b54d6b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T08:18:48+00:00", "last_seen": "2026-07-15T08:18:48+00:00", "object_relation": "md5", "timestamp": "1784465708", "to_ids": true, "type": "md5", "uuid": "b5149849-0c11-440b-bc39-27d40176ddc4", "value": "f8d40e49b9dc2062152bcbd023d6b10a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T08:18:48+00:00", "last_seen": "2026-07-15T08:18:48+00:00", "object_relation": "sha1", "timestamp": "1784463702", "to_ids": true, "type": "sha1", "uuid": "96ef3a0d-d6d7-48b3-8f18-1987b9a5556d", "value": "25940567c5a25b7df483d27e91a9a839f940e048", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T08:18:48+00:00", "last_seen": "2026-07-15T08:18:48+00:00", "object_relation": "sha256", "timestamp": "1784463702", "to_ids": true, "type": "sha256", "uuid": "1b1fbbd6-19d2-4c3b-80d3-2ee4f70f3789", "value": "17b1d836c2f15a97be0350879943b04e14bc076cf09e31df0d73258ee10f7e7c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T08:18:48+00:00", "last_seen": "2026-07-15T08:18:48+00:00", "object_relation": "text", "timestamp": "1784462059", "to_ids": false, "type": "text", "uuid": "793e8d41-fec1-4bb2-b769-a7fae2161c77", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-15T08:18:48+00:00\nLast Submission: 2026-07-15T08:18:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-15T08:18:48+00:00", "last_seen": "2026-07-15T08:18:48+00:00", "object_relation": "ssdeep", "timestamp": "1784462059", "to_ids": true, "type": "ssdeep", "uuid": "92453b30-d2ab-4b5f-8cea-7443f5d7b816", "value": "12288:4BOLvysa/KmhuRf43wTM09C2TfZPZGctwZkHxkiiDXNGk0m7uwRzWKVri4nIoBAc:RvBa/KmgxrMs9xBTtwZ4BirNGTm3RdrB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-15T08:18:48+00:00", "last_seen": "2026-07-15T08:18:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784462059", "to_ids": false, "type": "size-in-bytes", "uuid": "25641631-05e9-4513-a4df-37d5a7b93e88", "value": "610067" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T07:09:24+00:00", "last_seen": "2026-07-14T07:09:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784465729", "uuid": "9e4435f8-0b88-443d-92e1-1866fe3efed2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T07:09:24+00:00", "last_seen": "2026-07-14T07:09:24+00:00", "object_relation": "md5", "timestamp": "1784465729", "to_ids": true, "type": "md5", "uuid": "14119d05-fdb3-4a40-9b31-1261dbab85a1", "value": "40619aa6d0f1616a60438cd47e509142", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T07:09:24+00:00", "last_seen": "2026-07-14T07:09:24+00:00", "object_relation": "sha1", "timestamp": "1784463703", "to_ids": true, "type": "sha1", "uuid": "eb834827-b75a-4863-9ccd-664e6900f574", "value": "61c2ac08dac2b43192aafdd039476e96c527c909", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T07:09:24+00:00", "last_seen": "2026-07-14T07:09:24+00:00", "object_relation": "sha256", "timestamp": "1784463703", "to_ids": true, "type": "sha256", "uuid": "513a141c-bb20-42e2-87af-bb168010ef9b", "value": "01d2afea0f2201a3b59765a1a60ba324ff4b8fdd25f23a0e05824b97f195b27c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T07:09:24+00:00", "last_seen": "2026-07-14T07:09:24+00:00", "object_relation": "text", "timestamp": "1784462080", "to_ids": false, "type": "text", "uuid": "50e15f67-6bbe-4314-aa35-38614282de84", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-14T07:09:24+00:00\nLast Submission: 2026-07-14T07:09:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T07:09:24+00:00", "last_seen": "2026-07-14T07:09:24+00:00", "object_relation": "ssdeep", "timestamp": "1784462080", "to_ids": true, "type": "ssdeep", "uuid": "38e46992-3e98-434b-8ee4-568ad0bc9627", "value": "12288:+mvjcEWiYP4MEB0dUeQVcntMC0Qna2wZxuM8YU2Z:bLeitToiUtMCVnQxuMJz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T07:09:24+00:00", "last_seen": "2026-07-14T07:09:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784462080", "to_ids": false, "type": "size-in-bytes", "uuid": "0e341119-4ec5-42a9-a72b-db92211ad142", "value": "582753" } ] } ] } }