{ "Event": { "analysis": "1", "date": "2026-07-29", "extends_uuid": "", "info": "[Threat Intel] Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria", "protected": false, "publish_timestamp": "1785643431", "published": true, "threat_level_id": "3", "timestamp": "1785643431", "uuid": "4c07771c-520f-4595-9cdf-269594cc80bd", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Password Guessing - T1110.001\"", "relationship_type": "" }, { "colour": "#aad818", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SSH - T1021.004\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#bf6f24", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\"", "relationship_type": "" }, { "colour": "#1b0fe1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerade Task or Service - T1036.004\"", "relationship_type": "" }, { "colour": "#f07d7c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#e12cbc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "relationship_type": "" }, { "colour": "#37ffb5", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Denial of Service - T1498\"", "relationship_type": "" }, { "colour": "#50bd28", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#370063", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": "" }, { "colour": "#40fad1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Fallback Channels - T1008\"", "relationship_type": "" }, { "colour": "#52d590", "local": false, "name": "misp-galaxy:target-information=\"China\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:botnet=\"jackskid\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"FBot\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "link", "uuid": "3c15b201-209e-42f8-9741-8c7794100d20", "value": "https://blog.xlab.qianxin.com/botnet-rising-star-the-evolution-and-in-depth-technical-analysis-of-dysphoria/", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "text", "uuid": "e2e0f241-94c0-4e17-89d5-3607393067d9", "value": "Since Q1 2026, an emerging botnet named Dysphoria has amassed over 200,000 compromised hosts through rapid technical iterations spanning jackskid and fbot variants. The botnet employs sophisticated blockchain-based command and control infrastructure using ENS and SNS domains, combined with a novel architecture that converts victim hosts into relay/proxy nodes. Dysphoria propagates primarily through Telnet/SSH credential brute-forcing and exploitation of IoT vulnerabilities. Its commercial operation offers tiered DDoS attack packages claiming up to 4 Tbps capacity, targeting victims globally across multiple industries. The botnet demonstrates advanced evasion techniques including modified RC4 encryption, UPnP NAT traversal, and dynamic C2 resolution mechanisms. Daily monitoring shows peak activity of 239,000 overseas bots and 1,801 domestic bots, with 740,000 daily C2 requests, confirming sustained high-volume malicious operations." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "text", "uuid": "1641dbc3-76c7-4fb7-be73-b1db4c75cd6c", "value": "Name: Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria\nAuthor: AlienVault\nAdversary: \nTags: [\"cve-2020-25499\", \"cve-2017-5259\", \"ens domains\", \"blockchain c2\", \"botnet\", \"cve-2013-3307\", \"cve-2022-35733\", \"dysphoria\", \"sns domains\", \"iot exploitation\", \"cve-2016-20016\", \"relay nodes\", \"cve-2017-17215\", \"jackskid\", \"cve-2025-9528\", \"proxy infrastructure\", \"cve-2020-8515\", \"ddos\", \"cve-2025-34152\", \"upnp traversal\", \"cve-2018-14558\", \"fbot\", \"cve-2025-55182\", \"cve-2025-28137\"]\nTgtd countries: [\"China\"]\nMlwr families: [\"Dysphoria\", \"jackskid\", \"fbot\"]\nAttack_ids: [\"T1110.001\", \"T1021.004\", \"T1071\", \"T1106\", \"T1140\", \"T1190\", \"T1055\", \"T1090\", \"T1059\", \"T1568\", \"T1036.004\", \"T1571\", \"T1027\", \"T1573\", \"T1095\", \"T1498\", \"T1046\", \"T1021.001\", \"T1008\"]\nIndustries: [\"Technology\"]" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "c7fb26e8-d6af-49c5-a821-68be748a6e40", "value": "CVE-2017-17215" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "fe9da98b-d368-4771-b3aa-2b74f4591913", "value": "CVE-2018-14558" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "1f167a67-35d3-40f4-b1ce-4a01f5b7b2e5", "value": "CVE-2017-5259" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "3e7c8e89-f4db-43e2-a994-2f35b4048347", "value": "CVE-2020-8515" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "25972e25-8948-42c2-8713-2ff157881476", "value": "CVE-2013-3307" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "e7cc095b-cce9-4521-bdce-8b15672113ec", "value": "CVE-2016-20016" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "1b621484-552f-4381-bd47-b5e75f8d78c8", "value": "CVE-2022-35733" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "797ed31d-5ce1-4fdd-9756-d36206639388", "value": "CVE-2020-25499" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "9c8291a1-12a5-4610-8f47-174f497d6396", "value": "CVE-2025-9528" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "cfa10b31-3e38-497c-b400-af31431b4a57", "value": "CVE-2025-55182" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "f1604e89-5a14-4e98-affd-92b56f3479ee", "value": "CVE-2025-34152" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639775", "to_ids": true, "type": "ip-dst", "uuid": "a2b95e74-076d-47ed-bcc9-70ec29adf0d5", "value": "92.42.100.131", "Tag": [ { "colour": "#87fce3", "local": false, "name": "asn:asn=\"25198\"", "relationship_type": "" }, { "colour": "#0f4993", "local": false, "name": "asn:as-owner=\"ZETSERVERS ZetServers.com - Unmetered Cloud and Dedicated Servers Provider\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639796", "to_ids": true, "type": "ip-dst", "uuid": "984a86f5-6f2a-4e84-bf2d-7c8a1dd5bada", "value": "78.153.155.152", "Tag": [ { "colour": "#b8cc18", "local": false, "name": "asn:asn=\"215540\"", "relationship_type": "" }, { "colour": "#c38d7e", "local": false, "name": "asn:as-owner=\"GCS-AS\"", "relationship_type": "" }, { "colour": "#e1449b", "local": false, "name": "asn:as-country=\"GB\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united kingdom\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639817", "to_ids": true, "type": "ip-dst", "uuid": "5879ee4b-d627-48c7-a51d-094b4b52d249", "value": "217.60.195.160", "Tag": [ { "colour": "#c5527c", "local": false, "name": "asn:asn=\"401362\"", "relationship_type": "" }, { "colour": "#679cf3", "local": false, "name": "asn:as-owner=\"HOST4NERD\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639838", "to_ids": true, "type": "hostname", "uuid": "0b1aa15b-0b9a-411f-ac7f-b626c05c76cb", "value": "c2.saintpetersburgresident.ru", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639859", "to_ids": true, "type": "hostname", "uuid": "e505dd73-f430-4425-9fa3-88b77705b702", "value": "peer.saintpetersburgresident.ru", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639881", "to_ids": true, "type": "ip-dst", "uuid": "1af7152d-dabf-4198-b8e6-b3dc96dc9feb", "value": "76.164.203.171", "Tag": [ { "colour": "#87fce3", "local": false, "name": "asn:asn=\"25198\"", "relationship_type": "" }, { "colour": "#0f4993", "local": false, "name": "asn:as-owner=\"ZETSERVERS ZetServers.com - Unmetered Cloud and Dedicated Servers Provider\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633214", "to_ids": true, "type": "sha1", "uuid": "17b8008b-e2c1-4f9c-b9ef-b638787a5c1c", "value": "9c1716d770ea69e8e1418d96d52222396ecb4362", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785633215", "to_ids": true, "type": "sha1", "uuid": "f062d767-08c2-4f4a-92d9-804ea2143e24", "value": "b7faa44ab0772047a8581bbfdd9c561e28fc66de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639902", "to_ids": true, "type": "hostname", "uuid": "e65ffee6-b238-45f3-8ccb-e1ffe333de80", "value": "dysphoria.androiddebugbridge.su", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639923", "to_ids": true, "type": "hostname", "uuid": "18bf0676-fedd-4613-8874-35d42eed6f82", "value": "jerusalem.androiddebugbridge.su", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639944", "to_ids": true, "type": "hostname", "uuid": "2ed44c3d-f9f0-4c1e-b3b8-c768f2dd812a", "value": "kieron.androiddebugbridge.su", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639965", "to_ids": true, "type": "hostname", "uuid": "c7e8625d-45fd-460c-af52-bad8802d8b8d", "value": "node.androiddebugbridge.su", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785639986", "to_ids": true, "type": "hostname", "uuid": "10445e23-8f0b-42ca-93b3-aac4f583b10a", "value": "telaviv.androiddebugbridge.su", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785640008", "to_ids": true, "type": "hostname", "uuid": "4341b493-3c9a-4cae-9ba9-c00c0bb4e234", "value": "wow.androiddebugbridge.su", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785380410", "to_ids": false, "type": "vulnerability", "uuid": "9bde624f-73dd-4ec6-92d0-924fdade5c4a", "value": "CVE-2025-28137" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785640029", "to_ids": true, "type": "ip-dst", "uuid": "46ef72f3-0b0b-4d79-9715-4b1b3effe907", "value": "144.31.38.215", "Tag": [ { "colour": "#917280", "local": false, "name": "asn:asn=\"401152\"", "relationship_type": "" }, { "colour": "#fcf58e", "local": false, "name": "asn:as-owner=\"ADCIL-ASN-01\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785640050", "to_ids": true, "type": "url", "uuid": "907ab8a3-4f9f-4812-86bb-691bdb78ad00", "value": "http://login.trees4sale.net:9000", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...y tamper with their process name to masquerade as libdalvikengine.so. 1. Modified RC4 Decryption The latest fbot var...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785640071", "to_ids": true, "type": "domain", "uuid": "ffd86520-7b55-40ae-8077-751880ac09f9", "value": "libdalvikengine.so", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"...status report to the heartbeat collection domain login.trees4sale.net:9000, reporting its availability: { \"status\":...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785640092", "to_ids": true, "type": "domain", "uuid": "b37b11b9-5443-49c7-abe5-aa2558d7fb1d", "value": "login.trees4sale.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"....100.131 78.153.155.152 2. Infrastructure Domains i.peer4you.net o.peer4you.net login.trees4sale.net www.trees4sal...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785640114", "to_ids": true, "type": "domain", "uuid": "d8596523-4e53-4245-9cec-8953325f928c", "value": "i.peer4you.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"....155.152 2. Infrastructure Domains i.peer4you.net o.peer4you.net login.trees4sale.net www.trees4sale.net c2.saintp...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785640135", "to_ids": true, "type": "domain", "uuid": "58ace790-a1ef-423e-952b-989c01a2f15d", "value": "o.peer4you.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"....peer4you.net o.peer4you.net login.trees4sale.net www.trees4sale.net c2.saintpetersburgresident.ru peer.saintpetersbur...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785640156", "to_ids": true, "type": "domain", "uuid": "25457158-f36e-4c34-9081-693584f90446", "value": "www.trees4sale.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640177", "uuid": "791ec13d-c4cf-413d-b602-da6771d42470", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "object_relation": "md5", "timestamp": "1785640177", "to_ids": true, "type": "md5", "uuid": "b8c73a24-1940-4319-9824-78344ae44cb6", "value": "4544683ef9879b53dee835de76d59b3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "object_relation": "sha1", "timestamp": "1785633202", "to_ids": true, "type": "sha1", "uuid": "7b739dbb-9f1b-42f3-a293-12fe22520e81", "value": "a3b9575897c16cbf6afe3af1aa8b55171ea6edf9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "object_relation": "sha256", "timestamp": "1785633203", "to_ids": true, "type": "sha256", "uuid": "0e49fcb1-a89c-4dc0-8de0-400ea8d492b6", "value": "17c5f13da5b62b155dd973f9062f12061687cc44ee9150d42871005ab5b9c4b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "object_relation": "text", "timestamp": "1785632173", "to_ids": false, "type": "text", "uuid": "8706b1a3-6fd8-4261-9859-bb7456214504", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Gafgyt.BA!xp\nClamAV: Unix.Dropper.Mirai-7135872-0\nVT Total Detection: 40/75\nFirst Submission: 2026-03-25T12:49:46+00:00\nLast Submission: 2026-03-25T12:49:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "object_relation": "ssdeep", "timestamp": "1785632173", "to_ids": true, "type": "ssdeep", "uuid": "e45b784d-2f55-4b10-99b7-21abbed4dbf8", "value": "3072:obzutk7tZnH2hdmctInW7gd9XDf8575aMnab6FauJsXPK8qhmuJxUozn53P:obzOAtt2hdNtIWcdRDfCauaWFauJsXPu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632173", "to_ids": false, "type": "size-in-bytes", "uuid": "f392bde9-d568-4a5b-b879-1fd33fe1221f", "value": "130808" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "object_relation": "vhash", "timestamp": "1785632173", "to_ids": true, "type": "vhash", "uuid": "5eaa9576-1ecd-413a-811d-173e470803e1", "value": "321374a58d81836849c1b75cecaa2fba" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T12:49:46+00:00", "last_seen": "2026-03-25T12:49:46+00:00", "object_relation": "filename", "timestamp": "1785632173", "to_ids": true, "type": "filename", "uuid": "c3959a74-1529-4977-89e7-3fe1b76c3abf", "value": "arm7" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640198", "uuid": "046a87bf-816f-434a-8a2b-eec5e5cec931", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "object_relation": "md5", "timestamp": "1785640198", "to_ids": true, "type": "md5", "uuid": "2a351646-fdb6-41cd-9282-192994af1c39", "value": "0eb9d7be572752b2978458a54c9e2222", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "object_relation": "sha1", "timestamp": "1785633203", "to_ids": true, "type": "sha1", "uuid": "84043aea-e896-443d-9e2a-9304da82e21f", "value": "73651c02b29f1c07e3177e86c967fc45e9f30f0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "object_relation": "sha256", "timestamp": "1785633203", "to_ids": true, "type": "sha256", "uuid": "d9531c53-db59-4834-952a-15dab042b12b", "value": "b55bd5db1e23f5f8da29de762624a69fda49e4c12030adb1bd5907e5c62d150e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "object_relation": "text", "timestamp": "1785632194", "to_ids": false, "type": "text", "uuid": "82042e6b-0ded-40ec-99c8-0f6d16c9e512", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 35/75\nFirst Seen In The Wild: 2026-04-29T15:02:31+00:00\nFirst Submission: 2026-04-29T12:44:34+00:00\nLast Submission: 2026-04-29T12:44:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "object_relation": "ssdeep", "timestamp": "1785632194", "to_ids": true, "type": "ssdeep", "uuid": "80c8da40-7ec6-4e0a-a5b3-bf05a6dff4a0", "value": "6144:Kwi7zLgsj+DWAnFm3wL8OjKNrR77XAbJtVnELdnC9Ch:KnzLN/AJLNjKNrR/MVELdC9Ch" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632194", "to_ids": false, "type": "size-in-bytes", "uuid": "e08a7453-703a-4da9-81ac-e6b7370fe58f", "value": "294484" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "object_relation": "vhash", "timestamp": "1785632194", "to_ids": true, "type": "vhash", "uuid": "d63688e8-405a-4274-a436-47fbcf31e94d", "value": "9b30dd3674857685c00209b2b0c66bf6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-29T12:44:34+00:00", "last_seen": "2026-04-29T12:44:34+00:00", "object_relation": "filename", "timestamp": "1785632194", "to_ids": true, "type": "filename", "uuid": "b514ac35-870c-4559-a146-943a75af28f1", "value": "fs0xnc.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640220", "uuid": "4423181d-5c7e-41df-afaa-6009749d01da", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "object_relation": "md5", "timestamp": "1785640220", "to_ids": true, "type": "md5", "uuid": "24c99c60-0aaf-4a68-932e-5cda056f387d", "value": "19dfcbd3726d6803844fb30dc04502ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "object_relation": "sha1", "timestamp": "1785633205", "to_ids": true, "type": "sha1", "uuid": "93cdb603-bd1e-4243-ae87-c540694f7d90", "value": "25081bdec05f64eb4f313420c82d8de957e30026", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "object_relation": "sha256", "timestamp": "1785633205", "to_ids": true, "type": "sha256", "uuid": "45f81a3c-0c49-46cd-98f7-9cdcee68bf43", "value": "336db0baaeb3528aad5ec906dbd2253827900e60d697be3e8d830c232c7d07d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "object_relation": "text", "timestamp": "1785632215", "to_ids": false, "type": "text", "uuid": "1ba64b53-12c7-482f-ae1e-e161b48ae498", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.LR!MTB\nClamAV: Unix.Trojan.Mirai-7755770-0\nVT Total Detection: 39/75\nFirst Submission: 2026-05-02T06:22:59+00:00\nLast Submission: 2026-05-02T11:51:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "object_relation": "ssdeep", "timestamp": "1785632215", "to_ids": true, "type": "ssdeep", "uuid": "ca5482b4-9365-460d-8bd3-56cc9c83c51c", "value": "12288:TqqtEpaU1C3yYLDaYwwHC7TLuEFKnRyckTDKyYYV0A8TKpYajQEOr0SefYiyURW:TftFyYYwHCJLckT9OAc+Q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632215", "to_ids": false, "type": "size-in-bytes", "uuid": "1298fd61-1c9d-4860-aef6-5f5123a1d392", "value": "576764" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "object_relation": "vhash", "timestamp": "1785632215", "to_ids": true, "type": "vhash", "uuid": "0284187e-d66f-42d4-916d-08f3e8446ede", "value": "7bb5c3a96c44ccb02a5772af6a126452" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-02T06:22:59+00:00", "last_seen": "2026-05-02T11:51:00+00:00", "object_relation": "filename", "timestamp": "1785632215", "to_ids": true, "type": "filename", "uuid": "b95d5a9f-13a2-4387-b391-05c076a15950", "value": "w9seq7p.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640240", "uuid": "1643481e-2a55-4c9b-b206-621a1162581d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "object_relation": "md5", "timestamp": "1785640240", "to_ids": true, "type": "md5", "uuid": "5beac7ad-f70a-4598-8b53-9f04e7fbee9c", "value": "2ca1c7f343ad6e8ff1d1e4055ae80130", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "object_relation": "sha1", "timestamp": "1785633206", "to_ids": true, "type": "sha1", "uuid": "35ebb973-7acf-4a2c-ba3c-8269fa5891bf", "value": "955ff909972958098f0d4a06bcc4d6b9eea90449", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "object_relation": "sha256", "timestamp": "1785633206", "to_ids": true, "type": "sha256", "uuid": "06ecca5c-203c-4f93-9b61-31e428bfa538", "value": "0269c367eff172f6bfcb54ed717a3f9520be4130c4ab4d2f4a5c95c8dbaead5b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "object_relation": "text", "timestamp": "1785632237", "to_ids": false, "type": "text", "uuid": "a4747753-eea8-42a0-9b28-bed31ed4d6bd", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.LR!MTB\nClamAV: Unix.Trojan.Mirai-7755770-0\nVT Total Detection: 37/75\nFirst Submission: 2026-05-02T06:15:26+00:00\nLast Submission: 2026-05-02T06:15:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "object_relation": "ssdeep", "timestamp": "1785632237", "to_ids": true, "type": "ssdeep", "uuid": "4b3ff1d2-35ae-431c-bfed-104b4e2c1dd2", "value": "12288:QIjq+YOSHFWYHm1cQdR8m6sEjdN01uTuzBBKVNoeAX:mOSHFWH8mtEjdN0Eufr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632237", "to_ids": false, "type": "size-in-bytes", "uuid": "70ac5188-2ed7-445b-9fe8-44e64ccf0165", "value": "713168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "object_relation": "vhash", "timestamp": "1785632237", "to_ids": true, "type": "vhash", "uuid": "1784ccc6-850e-46bb-bba6-2a3dcee9065a", "value": "104b63fb2582917ef89ad0c777bd2eb0" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-02T06:15:26+00:00", "last_seen": "2026-05-02T06:15:26+00:00", "object_relation": "filename", "timestamp": "1785632237", "to_ids": true, "type": "filename", "uuid": "be6a7096-a94f-4f9f-8559-e8aec77adad6", "value": "833bi.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640262", "uuid": "58a391c5-a217-4f8c-a8a9-ea7ee20f7df6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "object_relation": "md5", "timestamp": "1785640262", "to_ids": true, "type": "md5", "uuid": "e28280c3-68ac-4542-8170-88d3138b758e", "value": "d993c59e338b0b3160f053ccd4a90794", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "object_relation": "sha1", "timestamp": "1785633207", "to_ids": true, "type": "sha1", "uuid": "75cabc83-1ddd-4942-8dcb-e5c3419fb4d6", "value": "dcea71b9ab9de8efca301de9e2f7bf11c7132364", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "object_relation": "sha256", "timestamp": "1785633207", "to_ids": true, "type": "sha256", "uuid": "ca9945c2-05c4-46cc-854d-0f0e8d45f77d", "value": "1c5080b6fa705f69758a8add633e3314f1953308ff68750be9455340bc91536b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "object_relation": "text", "timestamp": "1785632258", "to_ids": false, "type": "text", "uuid": "15848106-c0e5-4cb7-a378-b1f5c1bb63b2", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 30/75\nFirst Submission: 2026-05-28T20:11:02+00:00\nLast Submission: 2026-07-25T02:57:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "object_relation": "ssdeep", "timestamp": "1785632258", "to_ids": true, "type": "ssdeep", "uuid": "951df563-b643-4ef2-9c3e-c33afbc8bb9e", "value": "12288:H7C6HEX8RiqoH2VKBr6WTwZOWlwt4UIGg7qua33k5X+6m:Hfk8itBrVKtLUo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632258", "to_ids": false, "type": "size-in-bytes", "uuid": "3fe993bc-7072-4a43-b0df-a32399bc131f", "value": "436428" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "object_relation": "vhash", "timestamp": "1785632258", "to_ids": true, "type": "vhash", "uuid": "183c4d71-ffc7-4e27-ae60-bf93f104347e", "value": "634fa42059855cee962857fabedeb12b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T20:11:02+00:00", "last_seen": "2026-07-25T02:57:34+00:00", "object_relation": "filename", "timestamp": "1785632258", "to_ids": true, "type": "filename", "uuid": "75b94845-fe58-420d-bed7-18af4d3061e7", "value": "1c5080b6fa705f69758a8add633e3314f1953308ff68750be9455340bc91536b.bin.sample" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640284", "uuid": "5565ab78-16f9-4e25-aa05-b977268a2d12", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "object_relation": "md5", "timestamp": "1785640284", "to_ids": true, "type": "md5", "uuid": "06ceebd1-a576-44cd-ab5b-10eeb9ee4800", "value": "b17532532560628d67674ca968c38b47", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "object_relation": "sha1", "timestamp": "1785633208", "to_ids": true, "type": "sha1", "uuid": "6e76a81b-715d-4410-85d3-0548e35924d9", "value": "b0782a9d6eef2ce02f734a6e5e1d8e0f9a2b65be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "object_relation": "sha256", "timestamp": "1785633208", "to_ids": true, "type": "sha256", "uuid": "55d27a7f-8c96-4a28-984d-df03416755fe", "value": "d0310e982b671884e67580d627b1ad9dbaeaf2f68fef0611526615604ed93449", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "object_relation": "text", "timestamp": "1785632280", "to_ids": false, "type": "text", "uuid": "fab2ac9f-5743-4f67-814f-bc6dee080065", "value": "Type Description: ELF\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 35/75\nFirst Submission: 2026-06-25T00:52:51+00:00\nLast Submission: 2026-06-25T14:39:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "object_relation": "ssdeep", "timestamp": "1785632280", "to_ids": true, "type": "ssdeep", "uuid": "e0e3ad85-8358-4b6d-ad7d-6d800660576f", "value": "1536:19nLXBSGc3K5I8naya/9rJfV+LiEOfhOLYUc+/:bXQGN5I8naya/9ryJOfhOLm+/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632280", "to_ids": false, "type": "size-in-bytes", "uuid": "e4d362c0-34a1-4e60-951c-1498d7775561", "value": "69544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "object_relation": "vhash", "timestamp": "1785632280", "to_ids": true, "type": "vhash", "uuid": "1bb4c8da-89b5-46a8-9712-7729a8f28f90", "value": "7bb5c3a96c44ccb02a5772af6a126452" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T00:52:51+00:00", "last_seen": "2026-06-25T14:39:08+00:00", "object_relation": "filename", "timestamp": "1785632280", "to_ids": true, "type": "filename", "uuid": "fb161144-5b89-4e20-a024-43281755e4d8", "value": "d0310e982b671884e67580d627b1ad9dbaeaf2f68fef0611526615604ed93449.elf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640305", "uuid": "f3105374-455a-443e-bc1d-02fba4d140cd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "object_relation": "md5", "timestamp": "1785640305", "to_ids": true, "type": "md5", "uuid": "5bd160d2-075a-40a2-8f03-a48c8ee61b01", "value": "a233dd26477ede4dfe1aaad67d6ca49e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "object_relation": "sha1", "timestamp": "1785633209", "to_ids": true, "type": "sha1", "uuid": "e7ee55e6-bc1b-474d-b75f-637c493259ea", "value": "8db6c78533c176f13b61405cdc3f8fad703325f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "object_relation": "sha256", "timestamp": "1785633210", "to_ids": true, "type": "sha256", "uuid": "1bf5dd3e-7f42-4d73-bdd5-0b29d78bfae1", "value": "5883fef28a236079cfcd98ffe50d85711a2e763763f218239d2a81e05ae43ace", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "object_relation": "text", "timestamp": "1785632301", "to_ids": false, "type": "text", "uuid": "39c16fb8-249e-44f2-a12b-91e730a712d1", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Gafgyt.BA!xp\nClamAV: Unix.Dropper.Mirai-7135872-0\nVT Total Detection: 40/75\nFirst Submission: 2026-04-01T16:13:26+00:00\nLast Submission: 2026-04-01T16:13:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "object_relation": "ssdeep", "timestamp": "1785632301", "to_ids": true, "type": "ssdeep", "uuid": "ef06defc-33cd-4cd0-bf49-93cc237a7b85", "value": "1536:0gnlwY0g3ZR630e6ColBIdTBPy8h77Iigsorb72V9luHiAv82CyQ8Wnc3JE:dwYtZR6306AU6817Iigsorbdhv823WnK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632301", "to_ids": false, "type": "size-in-bytes", "uuid": "14905dd7-0cf4-4046-8f6a-97db6fb4cde3", "value": "88676" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "object_relation": "vhash", "timestamp": "1785632301", "to_ids": true, "type": "vhash", "uuid": "bf0a01f8-a4ef-4104-8036-faa22dd017c6", "value": "321374a58d81836849c1b75cecaa2fba" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-01T16:13:26+00:00", "last_seen": "2026-04-01T16:13:26+00:00", "object_relation": "filename", "timestamp": "1785632301", "to_ids": true, "type": "filename", "uuid": "772aaab8-cc2e-49be-ac8d-974336f3b095", "value": "44mvkfs71.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640326", "uuid": "103cce49-0ced-4202-ac3e-88bab78f571c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "object_relation": "md5", "timestamp": "1785640326", "to_ids": true, "type": "md5", "uuid": "91b8d07d-51de-4b02-ba50-44ce7bc46d0a", "value": "6c07b423216bcb472cfc437b621f1cc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "object_relation": "sha1", "timestamp": "1785633210", "to_ids": true, "type": "sha1", "uuid": "5a0e49eb-2089-44fa-a7f8-c8a93b9326c9", "value": "c1bedea261f325441fb9a75c50b11d0c8fb01ac6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "object_relation": "sha256", "timestamp": "1785633211", "to_ids": true, "type": "sha256", "uuid": "c7571417-1c1b-47c2-b865-8b6b85c1b0fb", "value": "d6b7bb3baba4a7a97d0fab24faa2165ca4f658a87447761321c77b8cda841a97", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "object_relation": "text", "timestamp": "1785632365", "to_ids": false, "type": "text", "uuid": "d4e9975e-6c32-4c06-9abe-2d20f1666dc1", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Mirai.EQ!MTB\nClamAV: Unix.Trojan.Mirai-7755770-0\nVT Total Detection: 38/75\nFirst Seen In The Wild: 2026-03-25T09:43:46+00:00\nFirst Submission: 2026-03-25T08:41:01+00:00\nLast Submission: 2026-04-04T18:26:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "object_relation": "ssdeep", "timestamp": "1785632365", "to_ids": true, "type": "ssdeep", "uuid": "dbac73b4-a1d7-44ec-8c5e-e1b4aa06e133", "value": "12288:Hzt/7CyPqtahsegbHCc6zGExKHRGXTi4HykZEWgeEKaphaEQvwTZaaz7bNhWMn:HitaIbHCj7XTieHglhQm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632365", "to_ids": false, "type": "size-in-bytes", "uuid": "dea1c9d4-e16a-4e15-9317-24a2201eefcd", "value": "585012" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "object_relation": "vhash", "timestamp": "1785632365", "to_ids": true, "type": "vhash", "uuid": "b0a76798-26cc-4624-8048-feb127e6f23c", "value": "7bb5c3a96c44ccb02a5772af6a126452" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-25T08:41:01+00:00", "last_seen": "2026-04-04T18:26:14+00:00", "object_relation": "filename", "timestamp": "1785632365", "to_ids": true, "type": "filename", "uuid": "8e8dc6b8-24b4-48cb-b0db-4b1477bec2e1", "value": "d6b7bb3baba4a7a97d0fab24faa2165ca4f658a87447761321c77b8cda841a97.elf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640347", "uuid": "03501542-be84-4e8a-816c-6647e398fe1f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "object_relation": "md5", "timestamp": "1785640347", "to_ids": true, "type": "md5", "uuid": "6bcb4dd8-7882-4159-82b8-c866aec8b48b", "value": "eb7fe0fd1463a58a165df1111669eaea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "object_relation": "sha1", "timestamp": "1785633211", "to_ids": true, "type": "sha1", "uuid": "b54f34da-a631-4ee0-981b-0861dd9b812e", "value": "df510f6f69a5c149c216c7b3accc4f460d8cf363", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "object_relation": "sha256", "timestamp": "1785633212", "to_ids": true, "type": "sha256", "uuid": "2de68756-57c0-4560-b23d-210876dcc584", "value": "461a9036ea41cca79988c0504c72059af47b5e8ec1a9194d88da5395fe4e452f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "object_relation": "text", "timestamp": "1785632386", "to_ids": false, "type": "text", "uuid": "e9a821ed-86f0-47b2-adc2-4c9c3b056a4d", "value": "Type Description: ELF\nMicrosoft: Backdoor:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 34/75\nFirst Seen In The Wild: 2026-06-10T15:04:34+00:00\nFirst Submission: 2026-06-10T14:29:58+00:00\nLast Submission: 2026-07-25T02:56:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "object_relation": "ssdeep", "timestamp": "1785632386", "to_ids": true, "type": "ssdeep", "uuid": "6b20e2c8-5370-4f2e-ba13-3b59ac7857d8", "value": "12288:yhznq66fMpivtI2TomrsihZOWamZaPcqgG7ikaOUEOHTqCZb6V:WzqlEiQmrly7PfT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632386", "to_ids": false, "type": "size-in-bytes", "uuid": "bcd10671-3ed3-4c3c-8572-6cc12e81475e", "value": "456264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "object_relation": "vhash", "timestamp": "1785632386", "to_ids": true, "type": "vhash", "uuid": "4319d354-4171-4da9-b146-c3fe65a65137", "value": "634fa42059855cee962857fabedeb12b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-10T14:29:58+00:00", "last_seen": "2026-07-25T02:56:53+00:00", "object_relation": "filename", "timestamp": "1785632386", "to_ids": true, "type": "filename", "uuid": "44787c21-231c-4f55-8e88-c5283cb827c2", "value": "461a9036ea41cca79988c0504c72059af47b5e8ec1a9194d88da5395fe4e452f.elf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785640368", "uuid": "01e9ef07-cf0c-4366-9771-13166453afae", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "object_relation": "md5", "timestamp": "1785640368", "to_ids": true, "type": "md5", "uuid": "9ae70af9-3a3a-4a7c-8dc3-844158c0d6b6", "value": "7e24b6f83f38fd25eaf5f17b137b2407", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "object_relation": "sha1", "timestamp": "1785633213", "to_ids": true, "type": "sha1", "uuid": "f8e6cd26-5fe4-42f3-aaa6-57b9a4becc8f", "value": "e7e1694162639ed587625432a79cfaa49f560d11", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "object_relation": "sha256", "timestamp": "1785633213", "to_ids": true, "type": "sha256", "uuid": "80d1c845-bf90-4331-bb38-d6d3bc9abeda", "value": "8df9fee6cc31f0f62218ac3fc3165f6533968370d718cc59e0c49dad870582f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "object_relation": "text", "timestamp": "1785632408", "to_ids": false, "type": "text", "uuid": "b03b8d0a-6c51-4462-bd61-f0d25b874b0a", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Mirai.Z!MTB\nClamAV: None\nVT Total Detection: 35/75\nFirst Seen In The Wild: 2026-06-27T15:04:34+00:00\nFirst Submission: 2026-06-27T14:51:03+00:00\nLast Submission: 2026-06-27T14:51:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "object_relation": "ssdeep", "timestamp": "1785632408", "to_ids": true, "type": "ssdeep", "uuid": "3f4fa125-e497-4307-8336-adfaf4edb57e", "value": "1536:6XlE2DAL8IIJ+sY4VkFZ7AVjzipfazO4MqsijX4A9laqwywkBGGDd5lVwinyvgnf:mE4IIc4uozips3LZ8qZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "object_relation": "size-in-bytes", "timestamp": "1785632408", "to_ids": false, "type": "size-in-bytes", "uuid": "4110bdce-1955-4dcc-961c-8f802d4173a9", "value": "121196" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "object_relation": "vhash", "timestamp": "1785632408", "to_ids": true, "type": "vhash", "uuid": "3f2d9b7f-2c10-451e-b64c-7991be45cc9b", "value": "426177b03c790aee4e600a6d3ca1675e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-27T14:51:03+00:00", "last_seen": "2026-06-27T14:51:03+00:00", "object_relation": "filename", "timestamp": "1785632408", "to_ids": true, "type": "filename", "uuid": "42b0c736-b5bc-43b9-a7eb-cb91777b4b7d", "value": "8df9fee6cc31f0f62218ac3fc3165f6533968370d718cc59e0c49dad870582f8.elf" } ] } ] } }