{ "Event": { "analysis": "1", "date": "2026-06-12", "extends_uuid": "", "info": "[Threat Intel] Interlock and Rhysida within the Ransomware Ecosystem", "protected": false, "publish_timestamp": "1782230757", "published": true, "threat_level_id": "2", "timestamp": "1782230757", "uuid": "4f2a0ee4-d11b-46a6-ba6d-1f9be509076d", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#6675db", "local": false, "name": "misp-galaxy:producer=\"IBM X-Force\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#177fb7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"", "relationship_type": "" }, { "colour": "#f28fb8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"OS Credential Dumping - T1003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1087.002\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#0aebeb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Client Execution - T1203\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#370063", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Protocol - T1021.001\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"interlock\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"rhysida\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781578847", "to_ids": false, "type": "link", "uuid": "3eef2b89-fa72-4315-b96c-d79b751994ae", "value": "https://www.ibm.com/think/x-force/interlock-and-rhysida-within-the-ransonware-ecosystem" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781578847", "to_ids": false, "type": "text", "uuid": "c9ddf365-acd7-4cb4-be17-0916ae06341f", "value": "This analysis examines over two years of observations on the ransomware ecosystem surrounding Interlock and Rhysida threat groups. Hive0163 (Interlock) employs custom malware including NodeSnake, InterlockRAT, JunkFiction downloader, Supper, and Interlock ransomware, with identified links to TAG-124. Rhysida actors utilize Endico downloader, Broomstick, Supper, and Tomb crypter, showing relationships with IceNova operators and ITG23. Strong code overlaps between NodeSnake, JunkFiction downloader, InterlockRAT and Supper indicate shared codebases or common developers. Both groups primarily target U.S. organizations across multiple sectors, using trojanized installers, ClickFix campaigns, and traffic distribution systems for initial access. Analysis of post-exploitation payloads reveals broad, adaptable toolsets including custom WDAC policies, credential phishing tools, and various privilege escalation exploits, demonstrating sophisticated ransomware operations." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781578847", "to_ids": false, "type": "text", "uuid": "857e7eaa-5dca-4f02-8ba4-e46233bf71d5", "value": "Name: Interlock and Rhysida within the Ransomware Ecosystem\nAuthor: AlienVault\nAdversary: Hive0163, Rhysida, Vanilla Tempest, TAG-124, ITG23\nTags: [\"cve-2026-20131\", \"trojanized installers\", \"rhysida\", \"mintloader\", \"modelorat\", \"systembc\", \"cve-2023-36036\", \"nodesnake\", \"icenova\", \"socgholish\", \"inc\", \"vidar\", \"broomstick\", \"initial access broker\", \"endico\", \"tomb crypter\", \"tomb\", \"supper backdoor\", \"plus keylogger\", \"junkfiction\", \"sliver\", \"ransomware\", \"interlockrat\", \"gootloader\", \"mallard\", \"portstarter\", \"supper\", \"interlock\", \"latrodectus\", \"ntlmthief\", \"clickfix\", \"dave\", \"berserk stealer\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: [\"NodeSnake\", \"InterlockRAT\", \"JunkFiction\", \"Supper\", \"Interlock\", \"Rhysida\", \"Broomstick\", \"Endico\", \"Tomb\", \"IceNova\", \"Latrodectus\", \"Gootloader\", \"SocGholish\", \"MintLoader\", \"ModeloRAT\", \"Brave Prince - S0252\", \"Vidar\", \"Dave\", \"SystemBC\", \"Sliver\", \"Berserk Stealer\", \"Mallard\", \"Plus Keylogger\", \"NtlmThief\", \"PortStarter\"]\nAttack_ids: [\"T1053.005\", \"T1218.011\", \"T1003\", \"T1087.002\", \"T1140\", \"T1190\", \"T1055\", \"T1482\", \"T1083\", \"T1204\", \"T1059.001\", \"T1547.001\", \"T1566\", \"T1486\", \"T1203\", \"T1059.003\", \"T1189\", \"T1027.002\", \"T1018\", \"T1105\", \"T1021.001\", \"T1490\"]\nIndustries: [\"Aerospace\", \"Agriculture\", \"Chemical\", \"Construction\", \"Defense\", \"Education\", \"Energy\", \"Finance\", \"Government\", \"Healthcare\", \"Hospitality\", \"Manufacturing\", \"Media\", \"NGO\", \"Retail\", \"Technology\", \"Telecommunications\", \"Transportation\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1781578847", "to_ids": false, "type": "threat-actor", "uuid": "4ad5c1cb-1883-4c49-8d1f-1e4f4b508312", "value": "Hive0163, Rhysida, Vanilla Tempest, TAG-124, ITG23" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102631", "to_ids": true, "type": "domain", "uuid": "1afea462-232c-44fa-a6f2-f191d2f1e4d3", "value": "leadslaw.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781578847", "to_ids": false, "type": "vulnerability", "uuid": "40ea66bf-62ae-4657-a8fc-1314414d139f", "value": "CVE-2023-36036" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102652", "to_ids": true, "type": "ip-dst", "uuid": "a186a873-d845-4aba-8904-bda1fbd991c4", "value": "185.196.9.234", "Tag": [ { "colour": "#e812fb", "local": false, "name": "asn:asn=\"42624\"", "relationship_type": "" }, { "colour": "#582d87", "local": false, "name": "asn:as-owner=\"SWISSNETWORK02\"", "relationship_type": "" }, { "colour": "#b0962c", "local": false, "name": "asn:as-country=\"SC\"", "relationship_type": "" }, { "colour": "#85ff13", "local": false, "name": "misp-galaxy:country=\"seychelles\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102673", "to_ids": true, "type": "url", "uuid": "4eaff1f1-6eaf-4ad8-aa80-17e04bb22614", "value": "https://apple-online.shop/ChromeSetup.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102694", "to_ids": true, "type": "url", "uuid": "ae0d44c1-4406-402a-b649-57f22544036d", "value": "https://apple-online.shop/MSTeamsSetup.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102715", "to_ids": true, "type": "ip-dst", "uuid": "1a780f9d-4ba9-4d23-9ef3-bbacb9be8be8", "value": "157.250.195.229", "Tag": [ { "colour": "#0ec520", "local": false, "name": "asn:asn=\"26666\"", "relationship_type": "" }, { "colour": "#b6feca", "local": false, "name": "asn:as-owner=\"INTERSERVER-LAX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102737", "to_ids": true, "type": "domain", "uuid": "cbe3cf34-291f-4046-aea0-5dd922ff1cbd", "value": "registrywave.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102758", "to_ids": true, "type": "domain", "uuid": "3dd68dab-d8cb-4a03-954c-166e16c4d247", "value": "coretether.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102779", "to_ids": true, "type": "domain", "uuid": "46130e0b-63af-43cd-9883-fe726856f49a", "value": "nucleusgate.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102800", "to_ids": true, "type": "domain", "uuid": "76a796f4-25c3-449b-9ab2-e13d4985e52f", "value": "scs-techresources.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102821", "to_ids": true, "type": "ip-dst", "uuid": "eaf606a2-7ee4-4b2b-8d43-6238d43e292d", "value": "213.139.77.167", "Tag": [ { "colour": "#728fa5", "local": false, "name": "asn:asn=\"398256\"", "relationship_type": "" }, { "colour": "#5cc9ea", "local": false, "name": "asn:as-owner=\"AS-ULTAHOST\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102842", "to_ids": true, "type": "ip-dst", "uuid": "50ab6908-d53c-4087-bb19-0a35761f2896", "value": "170.168.103.208", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102863", "to_ids": true, "type": "ip-dst", "uuid": "46ff98c1-e798-4762-9eed-f7c8981e6004", "value": "216.219.95.234", "Tag": [ { "colour": "#0ec520", "local": false, "name": "asn:asn=\"26666\"", "relationship_type": "" }, { "colour": "#b6feca", "local": false, "name": "asn:as-owner=\"INTERSERVER-LAX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102884", "to_ids": true, "type": "domain", "uuid": "cb7b7e3a-f2ba-4bd6-9f6a-b5d4dc2c82c8", "value": "microsoft-teams.icu", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102905", "to_ids": true, "type": "hostname", "uuid": "2ff6cff0-532d-442a-ad9f-c2717e6e8df2", "value": "typically-performer-builds-increasing.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102926", "to_ids": true, "type": "hostname", "uuid": "797fff97-f83b-4997-bdfb-56a0bbee7a86", "value": "repair-provision-supplies-folder.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102947", "to_ids": true, "type": "hostname", "uuid": "2818184a-5f76-49a5-9d7a-f9727ca619e4", "value": "confident-accounts-ban-damaged.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102968", "to_ids": true, "type": "domain", "uuid": "d9b1d9dc-a5f5-4006-bf06-7ad512c457c6", "value": "nelavohomet.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781578847", "to_ids": false, "type": "vulnerability", "uuid": "5311c7ca-ed64-4666-bad8-d32192220387", "value": "CVE-2026-20131" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782102989", "to_ids": true, "type": "hostname", "uuid": "5b2d5aca-b00e-4efc-8441-bbce2e7b8f0f", "value": "hire-household-squad-postcard.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103010", "to_ids": true, "type": "hostname", "uuid": "363ddfc3-8c20-4beb-957c-2c50c648e91b", "value": "edinburgh-packaging-sense-idol.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103031", "to_ids": true, "type": "hostname", "uuid": "029d23f5-d17a-436c-9f5c-5c4d2bf2c9a9", "value": "describe-absent-operational-seventh.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103052", "to_ids": true, "type": "hostname", "uuid": "95522d87-3816-4b37-ad71-0bc932593f92", "value": "rpm-chicken-during-staying.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103074", "to_ids": true, "type": "hostname", "uuid": "83076f4f-bf86-4887-b1a8-782af58da4f3", "value": "lamp-voters-biodiversity-phillips.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103095", "to_ids": true, "type": "hostname", "uuid": "8e6fcd5d-beb0-4f7d-a7f1-c4c19a329e06", "value": "coffee-lloyd-families-excluded.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103116", "to_ids": true, "type": "hostname", "uuid": "4a3656af-5fa4-49c4-92fa-4dcb0b92dbf4", "value": "screenshots-executive-joins-hammer.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103137", "to_ids": true, "type": "hostname", "uuid": "26764f48-9b10-4b82-9ef6-90ece86d5e74", "value": "moore-cgi-pen-drove.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103158", "to_ids": true, "type": "hostname", "uuid": "1de8dd0c-e32a-48cc-a9d2-7908dcf47564", "value": "eugene-examinations-contained-timber.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103180", "to_ids": true, "type": "hostname", "uuid": "1f17928d-3079-47fc-be95-bf8411e30bc0", "value": "bits-promotions-turned-editions.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103201", "to_ids": true, "type": "hostname", "uuid": "88b44eaa-7e5c-4c44-95ec-98cd5e546776", "value": "specials-storm-height-warriors.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103222", "to_ids": true, "type": "hostname", "uuid": "a53fb35a-e4fe-4a3c-913a-b554b04e46ab", "value": "baseline-include-priority-bar.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103243", "to_ids": true, "type": "hostname", "uuid": "3c2e7a4e-8533-47f2-8731-835911837f1f", "value": "postal-ssl-converted-quantity.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103265", "to_ids": true, "type": "hostname", "uuid": "4b0ec2dd-044d-41e4-a637-02fe5ed7b710", "value": "misc-elliott-mouth-leading.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103285", "to_ids": true, "type": "hostname", "uuid": "915b7b9d-3ed3-473a-a3a7-715153bb6793", "value": "jane-practitioner-lightning-preservation.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103307", "to_ids": true, "type": "hostname", "uuid": "114d5d9e-f6c7-447b-9e76-2d369fa548cc", "value": "liverpool-patterns-lanes-specified.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103328", "to_ids": true, "type": "hostname", "uuid": "6747fa76-5f5d-418d-be55-a755f6fc9293", "value": "meet-noted-tax-qualification.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103349", "to_ids": true, "type": "hostname", "uuid": "15935b6b-cc10-4569-9a60-fe66065f1ddd", "value": "cigarette-assumed-biotechnology-checklist.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103370", "to_ids": true, "type": "hostname", "uuid": "55f87373-5c94-4f8f-b811-95fbac605a7c", "value": "corner-teacher-guam-characterization.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103391", "to_ids": true, "type": "domain", "uuid": "5f3ca323-aa5d-4ebf-9196-7d48b40631b3", "value": "partyglacierhip.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103412", "to_ids": true, "type": "ip-dst", "uuid": "0512d772-6e3a-4c0f-978b-33d6316b0dd5", "value": "199.217.99.121", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103434", "to_ids": true, "type": "domain", "uuid": "98a43239-2690-481a-b5cd-69535632f07e", "value": "browser-updater.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103455", "to_ids": true, "type": "domain", "uuid": "c30df80c-e00c-4782-ab85-fea3f603fc2c", "value": "browser-updater.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103476", "to_ids": true, "type": "domain", "uuid": "2207e791-3eba-4624-8fd1-2048b9b9fea3", "value": "ms-sql-auth.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103497", "to_ids": true, "type": "domain", "uuid": "9555b251-fe17-43d6-bf8f-f3656d265256", "value": "os-update-server.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103518", "to_ids": true, "type": "domain", "uuid": "d7c2c6a7-9ef8-48c4-b970-d697b088e7bc", "value": "os-update-server.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103539", "to_ids": true, "type": "domain", "uuid": "bb4899ca-ebdb-4f0a-8ac7-ef39e54ff713", "value": "os-update-server.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103560", "to_ids": true, "type": "domain", "uuid": "f036c654-3bb5-4511-a50c-0df5bca5dc2e", "value": "os-update-server.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103581", "to_ids": true, "type": "ip-dst", "uuid": "471bc2e3-4afa-40ca-99dd-25c6d0b8f55a", "value": "185.233.166.26", "Tag": [ { "colour": "#b598ba", "local": false, "name": "asn:asn=\"394177\"", "relationship_type": "" }, { "colour": "#e3243a", "local": false, "name": "asn:as-owner=\"SHIFT-HOSTING-LLC\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103602", "to_ids": true, "type": "ip-dst", "uuid": "441932c1-3909-46ec-a363-698e0952c9ea", "value": "38.134.148.147", "Tag": [ { "colour": "#6c7c38", "local": false, "name": "asn:asn=\"174\"", "relationship_type": "" }, { "colour": "#7674d4", "local": false, "name": "asn:as-owner=\"COGENT-174\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103624", "to_ids": true, "type": "domain", "uuid": "1f6ddf93-f032-4f24-969c-08fe727e2499", "value": "donnellykilbakk.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103645", "to_ids": true, "type": "domain", "uuid": "fd76bdbe-195d-4f2f-a227-f1078687c655", "value": "flowmiceornfidgring.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103666", "to_ids": true, "type": "ip-dst", "uuid": "7cd757bb-6a08-48ef-9f35-36ec8d9d638c", "value": "192.169.6.74", "Tag": [ { "colour": "#8e8779", "local": false, "name": "asn:asn=\"199959\"", "relationship_type": "" }, { "colour": "#d781fd", "local": false, "name": "asn:as-owner=\"CROWNCLOUD\"", "relationship_type": "" }, { "colour": "#7f61db", "local": false, "name": "asn:as-country=\"AU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"australia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103687", "to_ids": true, "type": "ip-dst", "uuid": "b08313d4-6d7b-45ef-9bcf-1f51d8355216", "value": "162.221.93.164", "Tag": [ { "colour": "#71fd37", "local": false, "name": "asn:asn=\"21554\"", "relationship_type": "" }, { "colour": "#de359b", "local": false, "name": "asn:as-owner=\"CYBERLYNK\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103709", "to_ids": true, "type": "ip-dst", "uuid": "63de6929-c045-4981-ab36-0b37105847c2", "value": "64.94.85.158", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103730", "to_ids": true, "type": "hostname", "uuid": "659ccdf8-8545-49f7-8e3d-1e6eb4089dcf", "value": "utility-include-clubs-measurement.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103751", "to_ids": true, "type": "hostname", "uuid": "87d79668-f798-4fe3-bace-76121a7af7bd", "value": "muscle-european-entering-bigger.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103772", "to_ids": true, "type": "ip-dst", "uuid": "99367513-5db2-4644-ad34-7eb245987902", "value": "45.84.59.21", "Tag": [ { "colour": "#cf5e9b", "local": false, "name": "asn:asn=\"212477\"", "relationship_type": "" }, { "colour": "#767adf", "local": false, "name": "asn:as-owner=\"ROYALE-AS\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:22/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782101860", "to_ids": true, "type": "sha256", "uuid": "bdbecb81-dc90-4906-b23a-b6150e60e0b7", "value": "1192381230fce07ef3f2a86ce746c71f22a7e0b97eea7560a38337844e8f3041", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:22/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782101861", "to_ids": true, "type": "sha256", "uuid": "99177c6a-9168-4ee8-9e84-7e5284177dd5", "value": "27091704a872d9ebbbc3b4273a365b1fcc8dee36e1e8a7b53f6df017a26812ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:22/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782101861", "to_ids": true, "type": "sha256", "uuid": "bcb26eb1-f92b-4850-a508-7d371e4555c5", "value": "47363515fbf02bb669f72adfdc1e52c6cdcb4fc4183832a96b5761b6d95f016c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:22/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782101863", "to_ids": true, "type": "sha256", "uuid": "78362559-fa1f-4575-8121-419913fd2e26", "value": "604f7aa77a14f07baa21e76b73ceb7970037bfbdcc2040bf2e445702e99587a0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103793", "to_ids": true, "type": "ip-dst", "uuid": "5a937692-6e02-4d63-b31e-028bcbed9c28", "value": "193.149.176.215", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103814", "to_ids": true, "type": "ip-dst", "uuid": "d33a8b3d-f037-4e26-aec6-107ab5ed4cb4", "value": "193.36.38.139", "Tag": [ { "colour": "#5e6e36", "local": false, "name": "asn:asn=\"56380\"", "relationship_type": "" }, { "colour": "#31265c", "local": false, "name": "asn:as-owner=\"AS-ITFRUIT\"", "relationship_type": "" }, { "colour": "#9ca493", "local": false, "name": "asn:as-country=\"MD\"", "relationship_type": "" }, { "colour": "#4f4d08", "local": false, "name": "misp-galaxy:country=\"moldova\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103835", "to_ids": true, "type": "ip-dst", "uuid": "f6aa4b8b-8c2f-4ff1-9b55-5506b0504892", "value": "198.13.158.219", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103857", "to_ids": true, "type": "ip-dst", "uuid": "30764fb0-8559-43a3-8e85-2874ff1a6ea9", "value": "199.217.99.95", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103878", "to_ids": true, "type": "ip-dst", "uuid": "31d57de3-2206-40dc-8b8d-edca293dc474", "value": "199.91.221.250", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103900", "to_ids": true, "type": "ip-dst", "uuid": "251e8c80-8ad8-46e9-98ac-43442a6527f5", "value": "199.91.221.73", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103921", "to_ids": true, "type": "ip-dst", "uuid": "9135ab35-3af2-4f04-bc6f-1b517d0dd76e", "value": "5.230.201.173", "Tag": [ { "colour": "#af9d1f", "local": false, "name": "asn:asn=\"12586\"", "relationship_type": "" }, { "colour": "#cb2365", "local": false, "name": "asn:as-owner=\"ASGHOSTNET\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103942", "to_ids": true, "type": "ip-dst", "uuid": "330f750e-e778-4a95-8e5a-fb6b9f84f164", "value": "64.94.84.155", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103963", "to_ids": true, "type": "url", "uuid": "ed66f170-7e55-4927-b88b-f8dadeca8f85", "value": "https://hire-household-squad-postcard.trycloudflare.com/MSTeamsSetup.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782103984", "to_ids": true, "type": "url", "uuid": "5f25b1d9-12bd-4162-8cc6-d5f91ea573f4", "value": "https://leadslaw.com/MSTeamsSetup.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104005", "to_ids": true, "type": "url", "uuid": "a8715fe2-f77d-4723-b602-2821e620900d", "value": "https://microsoft-teams.icu/files/MSteamsV7.80.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104026", "to_ids": true, "type": "domain", "uuid": "89393438-d4c1-44c2-852e-f37e57838409", "value": "auth-ms-service.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104047", "to_ids": true, "type": "domain", "uuid": "294ab488-0e47-4b9e-89a8-c653a925ef68", "value": "auth-ms-service.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104068", "to_ids": true, "type": "domain", "uuid": "6a3c941f-b66b-4af0-aeb9-409eb7609ed1", "value": "kolinhumercianali.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104089", "to_ids": true, "type": "domain", "uuid": "d8b08178-828c-4d5b-9ccd-be95f647810f", "value": "medhurstwaelcci.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104110", "to_ids": true, "type": "domain", "uuid": "1a12bd90-bae4-47b8-94af-e4303bea12f8", "value": "nimoloxanulokol.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104131", "to_ids": true, "type": "domain", "uuid": "5c7d7b7b-411f-4df3-923b-89672c3cffe8", "value": "updt-ms-srv.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104152", "to_ids": true, "type": "domain", "uuid": "1f028747-0067-4a56-98b7-877387c1fe32", "value": "updt-ms-srv.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104173", "to_ids": true, "type": "domain", "uuid": "541b72bf-10b7-454a-9525-d76ae84d4a11", "value": "updt-ms-srv.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104194", "to_ids": true, "type": "domain", "uuid": "5080a9a6-7229-456c-8510-737c6cfbbf32", "value": "updt-ms-srv.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104215", "to_ids": true, "type": "hostname", "uuid": "06776cbb-e7d4-4c33-b020-ec98d9accc0e", "value": "aaa.load-edge-service.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104236", "to_ids": true, "type": "hostname", "uuid": "04ffd5b6-3cb5-4952-b277-5b65507ca6d7", "value": "albany-motels-visibility-bus.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104258", "to_ids": true, "type": "hostname", "uuid": "f698a759-9103-4022-b5bd-bdf7e01afeef", "value": "apt.deyno-xom.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104279", "to_ids": true, "type": "hostname", "uuid": "c47768d8-fe27-40a6-8c32-a2c6f2949b9f", "value": "carlo-payment-bullet-grocery.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104300", "to_ids": true, "type": "hostname", "uuid": "60fb5781-ff5a-4ce2-a2f7-7f77a6e273d4", "value": "clouds.forever-size.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104321", "to_ids": true, "type": "hostname", "uuid": "c0469576-8e53-4257-a36e-bedd9fc410a6", "value": "country-character-how-charging.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104342", "to_ids": true, "type": "hostname", "uuid": "c1862f7a-043c-43a8-9a78-9d77167f6a4b", "value": "default.ms-updated-service.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104364", "to_ids": true, "type": "hostname", "uuid": "9b73d531-dbda-418e-a0a6-1cb16169683d", "value": "dev.konowe-sodo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104385", "to_ids": true, "type": "hostname", "uuid": "edc2d3f6-412f-46ad-a712-c60c74606efb", "value": "dex.nomok-xore.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104406", "to_ids": true, "type": "hostname", "uuid": "53e1857f-4c57-41b4-8024-eb1c1a375ca1", "value": "dpf.nomok-xore.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104427", "to_ids": true, "type": "hostname", "uuid": "c229c77b-f5a2-42ff-a8a7-c98c527798e9", "value": "firist.ms-updated-service.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104448", "to_ids": true, "type": "hostname", "uuid": "96fdd991-c426-446a-aa90-e4a0ffed523f", "value": "first.best-default-server.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104469", "to_ids": true, "type": "hostname", "uuid": "bbee9344-3c49-4aa5-967c-d6032d0731c1", "value": "fix.connecter-edge.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104490", "to_ids": true, "type": "hostname", "uuid": "007f338b-6718-4388-9966-bd7e26f42b13", "value": "glasgow-thank-del-heard.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104511", "to_ids": true, "type": "hostname", "uuid": "f044d592-ff04-4ae2-b14b-bf55019a2cb9", "value": "heap.best-default-server.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104532", "to_ids": true, "type": "hostname", "uuid": "b35a20b4-d93a-491b-a5a1-391c23cb68c5", "value": "johnny-republicans-muscles-partners.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104553", "to_ids": true, "type": "hostname", "uuid": "f1c598b0-a554-4438-8556-cc49ac41ba4c", "value": "last.best-default-server.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104574", "to_ids": true, "type": "hostname", "uuid": "931427e9-7406-4b14-a46f-50ad9054fad5", "value": "liabilities-complications-discussing-temporal.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104595", "to_ids": true, "type": "hostname", "uuid": "7f54172a-a6fa-4f74-8270-574a1ae37360", "value": "locals.best-default-server.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104616", "to_ids": true, "type": "hostname", "uuid": "46445b79-7f76-4691-80e7-c6a0d7072ab7", "value": "mail.best-default-server.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104638", "to_ids": true, "type": "hostname", "uuid": "d88befbf-532a-489c-bee2-47344d86fdad", "value": "mail.load-edge-service.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104659", "to_ids": true, "type": "hostname", "uuid": "d3844a33-3046-4ae1-a9c3-34a2641dd22b", "value": "mailed.load-edge-service.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104680", "to_ids": true, "type": "hostname", "uuid": "19b88a88-d28d-41ea-a354-d876e25104e2", "value": "mails.alomo-pofo.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104701", "to_ids": true, "type": "hostname", "uuid": "1a0e2355-e85f-4616-912c-df3fb9036121", "value": "maines.forever-size.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104723", "to_ids": true, "type": "hostname", "uuid": "262774ea-e7a2-4c59-af9e-8b2857c2def3", "value": "no-global.qomaun-upd.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104744", "to_ids": true, "type": "hostname", "uuid": "8787dacf-4152-48d3-9515-8275a0bb3493", "value": "orearch.giver-tuyk.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104765", "to_ids": true, "type": "hostname", "uuid": "6575d87c-a181-4c6f-87ff-b96c06186c2a", "value": "reduce-highest-acknowledge-apparent.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104786", "to_ids": true, "type": "hostname", "uuid": "87bbf5ab-c352-4027-83dd-318c036238a5", "value": "second.ms-updated-service.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104807", "to_ids": true, "type": "hostname", "uuid": "8028ce00-32cf-443c-ba6f-b7ebed10cdce", "value": "secure.connecter-edge.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104828", "to_ids": true, "type": "hostname", "uuid": "eee00f4a-a7ec-4c9f-8650-f092800b7e2b", "value": "secured.best-default-server.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104849", "to_ids": true, "type": "hostname", "uuid": "ffe90e19-dbef-4b2a-bcf2-275910753150", "value": "sos.konowe-sodo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104870", "to_ids": true, "type": "hostname", "uuid": "85c6c697-1ab2-4173-a1e1-34293b96e86c", "value": "ssh.qomaun-upd.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104891", "to_ids": true, "type": "hostname", "uuid": "9d56ff2c-ae0d-4b71-87f8-18387ac4bb20", "value": "status.connecter-edge.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104912", "to_ids": true, "type": "hostname", "uuid": "8b69bd8e-f917-456b-bb62-07f31c14ee92", "value": "survivors-troops-interesting-learned.trycloudflare.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104933", "to_ids": true, "type": "hostname", "uuid": "71ca236a-decd-49d0-b80e-1800c0e93107", "value": "time.konowe-sodo.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104954", "to_ids": true, "type": "hostname", "uuid": "95773c97-24ee-429f-88b1-67ba5ba9f8f0", "value": "tmp.alomo-pofo.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104975", "to_ids": true, "type": "hostname", "uuid": "9b995553-d32f-49d7-ab28-206f6bb73ce4", "value": "www.deyno-xom.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782104996", "to_ids": true, "type": "hostname", "uuid": "501079f5-069f-4cbd-9d75-097a1ff46531", "value": "www.forever-size.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105017", "to_ids": true, "type": "hostname", "uuid": "ae93105d-0f56-4c50-8409-850d4df12104", "value": "www.nomok-xore.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105038", "to_ids": true, "type": "hostname", "uuid": "656a9072-df96-4c61-a198-f111f3c56bd8", "value": "year.giver-tuyk.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105060", "to_ids": true, "type": "hostname", "uuid": "5f342fa5-86b4-426e-b5cf-9853612dc243", "value": "yum.deyno-xom.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:22/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782101864", "to_ids": true, "type": "sha1", "uuid": "c580a0c9-7623-4276-826d-f4db5dbf4e82", "value": "89759f741606e3e9e3004978c08a3d8f5d8a887f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105081", "to_ids": true, "type": "ip-dst", "uuid": "41bb0f3e-1880-421b-8305-1111b1894939", "value": "67.217.228.180", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105102", "to_ids": true, "type": "url", "uuid": "85aaeca4-e6f1-422d-9bcf-a25355789967", "value": "https://apple-online.shop/MSTeamsSetup.exe\\", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105123", "to_ids": true, "type": "url", "uuid": "bd9db8a5-9efd-4f98-bb7f-a3560d01f209", "value": "https://apple-online.shop/MicrosoftEdgeSetup.exe\\", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 443", "deleted": false, "disable_correlation": false, "timestamp": "1782097424", "to_ids": true, "type": "ip-dst|port", "uuid": "62d0198e-d14e-42c5-a362-b9c96a132b26", "value": "144.172.104.212|443" }, { "category": "Network activity", "comment": "On port 443", "deleted": false, "disable_correlation": false, "timestamp": "1782097424", "to_ids": true, "type": "ip-dst|port", "uuid": "61bddef2-e2fa-41c3-871e-4d8e412b9940", "value": "91.99.97.247|443" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105144", "to_ids": true, "type": "ip-dst", "uuid": "83188f19-a025-4981-a5cf-72c22a093d60", "value": "165.245.130.101", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105165", "to_ids": true, "type": "ip-dst", "uuid": "3abafe89-149d-4bb9-a298-98cc9ee593d1", "value": "37.27.244.222", "Tag": [ { "colour": "#d17f93", "local": false, "name": "asn:asn=\"24940\"", "relationship_type": "" }, { "colour": "#18e065", "local": false, "name": "asn:as-owner=\"HETZNER-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 4043", "deleted": false, "disable_correlation": false, "timestamp": "1782097424", "to_ids": true, "type": "ip-dst|port", "uuid": "56afa42f-228f-4de1-b4da-2c65882db9b4", "value": "178.32.224.221|4043" }, { "category": "Network activity", "comment": "On port 1080", "deleted": false, "disable_correlation": false, "timestamp": "1782097424", "to_ids": true, "type": "ip-dst|port", "uuid": "58c4f24e-091d-44ff-9990-1a02038054b6", "value": "5.226.141.216|1080" }, { "category": "Network activity", "comment": "On port 8080", "deleted": false, "disable_correlation": false, "timestamp": "1782097424", "to_ids": true, "type": "ip-dst|port", "uuid": "3a6e71bf-3e55-4f96-b78c-18355f31858a", "value": "193.104.58.42|8080" }, { "category": "Network activity", "comment": "On port 1080", "deleted": false, "disable_correlation": false, "timestamp": "1782097424", "to_ids": true, "type": "ip-dst|port", "uuid": "5fb49ae6-80ad-482b-b698-9f935431730e", "value": "46.183.25.6|1080" }, { "category": "Network activity", "comment": "On port 8080", "deleted": false, "disable_correlation": false, "timestamp": "1782097424", "to_ids": true, "type": "ip-dst|port", "uuid": "817a3fdf-1011-4a75-ba0e-061cfd004d9e", "value": "151.241.99.169|8080" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105186", "to_ids": true, "type": "url", "uuid": "ffa9627f-f564-49b3-95a0-403f10be492f", "value": "https://steamcommunity.com/profiles/76561198765046918", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105207", "to_ids": true, "type": "url", "uuid": "7e5f669d-2645-4dfc-b3b1-9d31df077eea", "value": "https://telegram.me/bul33bt", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782105228", "to_ids": true, "type": "url", "uuid": "86189fb9-bc51-42c4-a1cf-0fc5da1237ac", "value": "https://apple-online.shop/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105249", "uuid": "56bf15a4-112f-4d91-9f37-05551885ba01", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105249", "to_ids": true, "type": "md5", "uuid": "1f43abe2-5ae9-4ced-9334-a06bd8a1d285", "value": "f0b3e112ce4807a28e2b5d66a840ed7f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101780", "to_ids": true, "type": "sha1", "uuid": "6f9a9a8e-c87a-4dc4-9a33-86fd1f1294ad", "value": "54a6743781fd4ceb720331fce92f16186931192d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101780", "to_ids": true, "type": "sha256", "uuid": "d70e3496-1f6d-4628-bd29-c1a14321ade7", "value": "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782099915", "to_ids": true, "type": "ssdeep", "uuid": "d4678ba2-5804-4155-bb06-d81728f84aa8", "value": "49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782099915", "to_ids": false, "type": "size-in-bytes", "uuid": "6abd52df-358f-46eb-8b8f-61b431bf080a", "value": "2609152" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782099915", "to_ids": true, "type": "vhash", "uuid": "fd9269a6-28fa-40f2-bd35-c04de6bda61f", "value": "32603655151d0fdff6200480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782099915", "to_ids": true, "type": "filename", "uuid": "f6bdfc2e-7d18-4d73-9989-385a4ed11c2e", "value": "BouncyCastle.Crypto.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 21/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782099915", "to_ids": false, "type": "text", "uuid": "bbf4d245-e953-449c-861b-af75a98a75e0", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:0/70\nFirst Submission:2020-12-23T19:31:14.000000+00:00\nLast Submission:2026-06-20T22:26:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105270", "uuid": "cd508f2f-05e5-4427-a5f9-17528a8965f7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105270", "to_ids": true, "type": "md5", "uuid": "52444a69-68d6-413d-bf19-7fe7533d61eb", "value": "edbf152ed9ac79e5d9e0111d1071af48", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101781", "to_ids": true, "type": "sha1", "uuid": "31e8c63f-bb87-4ce8-a899-32d87f6eb5fd", "value": "b0cfa2089802634ffb8c77962cdb18317a6332d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101781", "to_ids": true, "type": "sha256", "uuid": "e5888484-7ae6-4c29-9406-b229b9471226", "value": "64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782099937", "to_ids": true, "type": "ssdeep", "uuid": "21d8632c-2c65-495c-93cf-d558cb12636f", "value": "24576:DN79qK/icab2YQqQOFkjHCOS1s4YlD/40vWcPAmYNuiq3XnH1:p79t/fab2N6yHWHYHvzPAmY2Hn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782099937", "to_ids": false, "type": "size-in-bytes", "uuid": "5faccd6b-8145-4784-afb9-2361c321c1eb", "value": "920312" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782099937", "to_ids": true, "type": "vhash", "uuid": "02a3a806-8787-4a49-b288-1108d5ab9ffe", "value": "1950766d55551d1d1551z23z900130f5z7cz15ez9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782099937", "to_ids": true, "type": "filename", "uuid": "1f894d87-3d97-43c2-97ef-b1a2d0735600", "value": "afflict" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782099937", "to_ids": false, "type": "text", "uuid": "f1f9e457-45f5-4fbe-a671-73dd2763cf39", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/CryptInject.ZFW!MTB\nVT Total Detection:47/70\nFirst Submission:2024-09-30T09:51:02.000000+00:00\nLast Submission:2025-08-08T08:56:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105291", "uuid": "324bbbba-05be-4d1d-b1ec-9eefceda870a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105291", "to_ids": true, "type": "md5", "uuid": "8fbaffa5-0d01-4481-b8df-523d46647d4f", "value": "634a9af8d3f2fa0d38820d577fb0fbeb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101782", "to_ids": true, "type": "sha1", "uuid": "009525b2-081c-4e55-b255-c404c83e3b9e", "value": "cd6e84a3c4f81fc9df8b82449db8b2e87130e3fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101782", "to_ids": true, "type": "sha256", "uuid": "639b0f44-2454-4d9d-87c1-6bed6159b006", "value": "c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782099959", "to_ids": true, "type": "ssdeep", "uuid": "6b6a7b1a-0e8d-41f7-80d5-bf1f006170f4", "value": "12:etGSGQwU8O0ay2Y8qS6gK/H/ffk6Om2BXp:etGScU8O0ay2vqS6p/H/QvBXp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782099959", "to_ids": false, "type": "size-in-bytes", "uuid": "18f0a773-a427-4622-b399-4eec82ba93cf", "value": "2560" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782099959", "to_ids": true, "type": "vhash", "uuid": "31cee71f-de2f-4fe2-92ff-2942ae3ae9b1", "value": "123036151d1bz101&z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782099959", "to_ids": true, "type": "filename", "uuid": "19ee987b-92ae-4e98-9d44-df155d88ac80", "value": ".data" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782099959", "to_ids": false, "type": "text", "uuid": "966d4a95-a6c4-4e50-aceb-d72b0eacbe35", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Malgent!MSR\nVT Total Detection:53/70\nFirst Submission:2024-08-17T21:19:18.000000+00:00\nLast Submission:2025-05-15T23:22:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105313", "uuid": "3a7a3390-a97f-4f2b-9274-b49cacda737b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105313", "to_ids": true, "type": "md5", "uuid": "c1b05899-22b8-4848-8dbb-a35f7ae18501", "value": "614cc21ab0f47b6006bebef6f6dfe19a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101783", "to_ids": true, "type": "sha1", "uuid": "62698949-2603-43f5-9fe3-44f2580ace2c", "value": "0626f176f9d24f8dd41954e24a301a6d4b7a7877", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101783", "to_ids": true, "type": "sha256", "uuid": "50694670-10d4-44b8-9dc5-0a64a6eadda4", "value": "43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782099982", "to_ids": true, "type": "ssdeep", "uuid": "2a79bee1-9119-48ef-84ff-976787140d65", "value": "1536:RvWSc6jJyYvvnGv+ZietsGA3ceHg2Wk2WeWvcU6pc1q4hVfK8tNWqzUyjHhb:RvWSca8YvfvdKGyceA/k1cU6pc1q4hVx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782099982", "to_ids": false, "type": "size-in-bytes", "uuid": "c3f712fd-4151-4d12-b2ab-8df7496c80e0", "value": "90888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782099982", "to_ids": true, "type": "vhash", "uuid": "16b32336-4da1-4cea-a52e-07e92ccf46c7", "value": "0940666d555d15151bzb035z4dzafz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782099982", "to_ids": true, "type": "filename", "uuid": "e5898197-24e5-47f9-adb6-a5b4c69c9f54", "value": "material" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782099982", "to_ids": false, "type": "text", "uuid": "54b7d21c-bb09-4841-acb9-4e883965913f", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/ClearFake.DSK2!MTB\nVT Total Detection:49/70\nFirst Submission:2024-09-04T15:22:40.000000+00:00\nLast Submission:2024-09-04T15:22:40.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105334", "uuid": "1e2d5186-50df-41f6-a728-fcfe9e1c8b2f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105334", "to_ids": true, "type": "md5", "uuid": "aca81f8a-396e-4c79-bad9-330e680e5d30", "value": "c1846f9b6ea365c61dbc7c2c9b0e44c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101784", "to_ids": true, "type": "sha1", "uuid": "661eb10a-77df-479b-9f8a-d30ea557d69e", "value": "2950e67318b9aef887cb50b7a97de5365e3c20ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101784", "to_ids": true, "type": "sha256", "uuid": "351e6d82-8308-47a9-9f1f-7b918f333cc7", "value": "7890b116d13a52efe696ce1e2c0ed83029775cf4bea836ce551e71d222ee116f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100004", "to_ids": true, "type": "ssdeep", "uuid": "756b9655-27a4-4afd-a37b-203b1807f772", "value": "786432:k+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdls6EnXMb8HrRQ766ZnI8:SXGMK4XR3bLSCU/+6yPl3lsDcOwq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100004", "to_ids": false, "type": "size-in-bytes", "uuid": "8fe2a258-14a7-4345-b3f6-f79440b57dc6", "value": "38783696" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100004", "to_ids": true, "type": "vhash", "uuid": "8df90b60-8526-4bfe-8024-e8df18e24815", "value": "037066655d155575504013z3006bmz1cfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100004", "to_ids": true, "type": "filename", "uuid": "92478ae7-d534-4081-969f-c5760d57dbd3", "value": "Cisco-Secure-Client.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100004", "to_ids": false, "type": "text", "uuid": "aac3b8f6-5766-4cc4-9c91-b52459a3169d", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Malgent!MSR\nVT Total Detection:37/70\nFirst Submission:2025-01-28T16:19:05.000000+00:00\nLast Submission:2025-02-28T13:15:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105355", "uuid": "1dd33c41-b029-4b0f-b335-3829817e238f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105355", "to_ids": true, "type": "md5", "uuid": "52e46631-5a4a-459f-8f60-cd1f1ee39f4e", "value": "8bf60bab86b0f501aecd48308b1d2c18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101785", "to_ids": true, "type": "sha1", "uuid": "750c960d-9a9b-4e28-8bf0-6934caf03d1a", "value": "79fbf19fd5624b7a3dc8e182d9944d6ddb167188", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101786", "to_ids": true, "type": "sha256", "uuid": "37d74c2e-7654-4b09-844e-7d291de4054c", "value": "f962e15c6efebb3c29fe399bb168066042b616affddd83f72570c979184ec55c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100025", "to_ids": true, "type": "ssdeep", "uuid": "6683b811-1f7a-4911-b949-fbe9c13e6f3a", "value": "786432:R+gX4BMdhwzTQXR5FbPp6FcSS5U/LT2KzVyPVLBdoXMb8UH/Q/aU:TXGMK4XR3bLSCU/+6yPl3oc0aU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100025", "to_ids": false, "type": "size-in-bytes", "uuid": "0316d5a5-ff4b-4231-a1b7-8c07e5b15ca5", "value": "38507776" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100025", "to_ids": true, "type": "vhash", "uuid": "22fdc3a9-5750-40fa-9296-acae712bfc79", "value": "037066655d155515504013z3006bmz1cfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100025", "to_ids": true, "type": "filename", "uuid": "35bd25fe-0cca-43ce-917f-19d1b6cd0828", "value": "nxnf3l.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100025", "to_ids": false, "type": "text", "uuid": "0809ef74-b4d0-4635-8bf1-3efa3ae859d8", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:18/69\nFirst Submission:2024-11-04T18:13:12.000000+00:00\nLast Submission:2024-11-04T18:13:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105376", "uuid": "9bb5047c-cf8f-48d1-b766-2a2d4179f33e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105376", "to_ids": true, "type": "md5", "uuid": "a0662a1c-67f5-4cb2-93aa-96dd1935b46e", "value": "2b2e657ae1bc2fdcdfe5201a8e0e5224", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101787", "to_ids": true, "type": "sha1", "uuid": "c51a8011-f900-42c4-8fa3-002fdd386836", "value": "8bd16897409ae5d5667c345276d2532f493c0f98", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101787", "to_ids": true, "type": "sha256", "uuid": "10963955-41a3-45fb-905d-6e01311cd176", "value": "28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100047", "to_ids": true, "type": "ssdeep", "uuid": "af033e93-0b93-4184-93de-de1a59be9baf", "value": "384:GAPWWK2PqzJzJFjHn399KpDHrEQIg27zcHn1pqJdGXXd2oi2Oei3hNWeydh9yTXx:GAVPqvFb9iqV7zkru0Moi2OPXWeAMB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100047", "to_ids": false, "type": "size-in-bytes", "uuid": "81a61e6f-4d20-48f8-a710-32c77ab39865", "value": "27392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100047", "to_ids": true, "type": "filename", "uuid": "aed71698-409f-4d74-89b1-4c6956ba8d20", "value": "5f7ed7bbdabc10f5028429d833ffe3f0_8_Txt.txt" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100047", "to_ids": false, "type": "text", "uuid": "938329b8-5bbb-4bd7-8bf5-131946172eb2", "value": "Type Description: PHP\nMicrosoft: None\nVT Total Detection:32/60\nFirst Submission:2025-06-17T06:57:18.000000+00:00\nLast Submission:2025-07-30T18:42:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105397", "uuid": "152e3e33-13ca-481e-b7f7-8ad9d28bc062", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105397", "to_ids": true, "type": "md5", "uuid": "266758e9-216e-4b75-b926-eaf1ecd4c49f", "value": "259fd28f9e66159d5a30b86688fec184", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101788", "to_ids": true, "type": "sha1", "uuid": "40d307cd-63ec-41e6-8d84-899bedc8f5fb", "value": "442af2726e22f512b49f67bcdbf7c0d1e806aa8b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101788", "to_ids": true, "type": "sha256", "uuid": "98b5292e-3dd8-4fa2-9ae0-9d187c20df99", "value": "4e4a3751581252e210f6f45881d778d1f482146f92dc790504bfbcd2bdfa0129", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100069", "to_ids": true, "type": "ssdeep", "uuid": "69b59525-9a96-4fb5-9be3-92e5894f869e", "value": "49152:xCgcvj6x8FI2nuayaDPP47JBs6IYykhLIoutipdL2NX7dfCXiu4D3:xCgv2uaCFIYykaoaQ0NcXd83" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100069", "to_ids": false, "type": "size-in-bytes", "uuid": "9a532e1d-b0dc-49d6-a7df-e41d24a03af8", "value": "2700024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100069", "to_ids": true, "type": "vhash", "uuid": "3e0e1770-a7db-40c4-9494-00c1542427b9", "value": "026086655d155d1d05555az8c9z2tz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100069", "to_ids": true, "type": "filename", "uuid": "22f55250-e3e2-47bc-99fe-71b6f8d30bc7", "value": "MSTeamsSetup.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100069", "to_ids": false, "type": "text", "uuid": "71c5f8cc-c8a7-4603-9274-a27beeb592ed", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Oyster.DA!MTB\nVT Total Detection:47/70\nFirst Submission:2025-09-12T15:57:50.000000+00:00\nLast Submission:2025-09-24T16:24:58.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105418", "uuid": "b09eb647-4e17-46a1-ac07-f4bf163c6c10", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105418", "to_ids": true, "type": "md5", "uuid": "bc4e0c06-2fd3-4988-8cc0-90dc254f3392", "value": "42a99a5effdc1d02f6b622537de881e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101789", "to_ids": true, "type": "sha1", "uuid": "3e82e613-6ff7-4bd8-936a-3cb6a72f2d63", "value": "3e62797fd746ce9bd5d49cb833b7d9ac62d6b7a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101789", "to_ids": true, "type": "sha256", "uuid": "f60bc26f-f009-424d-9d60-e2a7c59b8b89", "value": "16474e9e4773fbc1e0b48a5025fad31b7f084b1beffb9a42687b4d01979885fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100090", "to_ids": true, "type": "ssdeep", "uuid": "275ce66f-e020-4bbc-84fa-cdde1e9d624c", "value": "49152:uFbqz5oiEfZuNAOn3+B+AQjFyoGtlqrLAIU6ipwKPWf3W:X357+2pO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100090", "to_ids": false, "type": "size-in-bytes", "uuid": "f5452102-219d-4758-bc7f-c60b49430b33", "value": "2169384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100090", "to_ids": true, "type": "vhash", "uuid": "c94b9aa7-3a5d-4a2d-8410-5cd74cbf3dcd", "value": "126066656d555575119z8iz13z4dz44" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100090", "to_ids": true, "type": "filename", "uuid": "18c9663b-10b1-4e59-a430-97dc96971b13", "value": "bkdrupdt.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100090", "to_ids": false, "type": "text", "uuid": "e22317a7-7e37-4fe8-bd82-9be07229364e", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Latrodectus.CZ!MTB\nVT Total Detection:45/70\nFirst Submission:2025-09-15T16:51:58.000000+00:00\nLast Submission:2025-12-09T09:22:07.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105439", "uuid": "ff075bb2-8e57-4309-be3b-f84ef1570d2a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105439", "to_ids": true, "type": "md5", "uuid": "a7f06e17-5970-41ee-80d4-a9b2bb72ca33", "value": "16afa928cd820a572bd47e798f481c46", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101791", "to_ids": true, "type": "sha1", "uuid": "73755bb4-683d-4cc9-b691-fd65b79ef9f0", "value": "273962821f14982ead6c10823587fd39e89cf2fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101791", "to_ids": true, "type": "sha256", "uuid": "1d2ab532-ddc4-434b-a31c-941fd56c0569", "value": "2528df60e55f210a6396dd7740d76afe30d5e9e8684a5b8a02a63bdcb5041bfc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100112", "to_ids": true, "type": "ssdeep", "uuid": "ab7aea1e-f1d2-4bb6-9ee1-59722e27ef86", "value": "49152:JbYkfzBzhnECxWaSDrYH3qn6Z+ReFC9CBt1sNH5ZBMruWtmTXgbKvFo3wiJ/jm:Z+vyAcm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100112", "to_ids": false, "type": "size-in-bytes", "uuid": "9be8e4b1-83cf-403e-8904-742d15ca69a6", "value": "2702488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100112", "to_ids": true, "type": "vhash", "uuid": "05037537-0a90-472d-b29c-b9f5a76456c6", "value": "126066555d5565755038z7a9z15z13z3dz24" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100112", "to_ids": true, "type": "filename", "uuid": "610e2dd2-224e-44ab-a91e-7047f7ae87be", "value": "ftjsonlib.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 16/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100112", "to_ids": false, "type": "text", "uuid": "cea0d4c1-d447-456c-94bb-e9d07b4cf8b6", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Oyster.DA!MTB\nVT Total Detection:37/71\nFirst Submission:2025-09-16T09:59:52.000000+00:00\nLast Submission:2025-09-16T09:59:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105461", "uuid": "e945f830-6399-460e-8160-6019e4aca189", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105461", "to_ids": true, "type": "md5", "uuid": "ec9752ec-48ad-45f6-b970-54c5a1381101", "value": "e6bff27adbbcfe6b71ac8fad79b8297f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101792", "to_ids": true, "type": "sha1", "uuid": "f72bba63-e273-414b-a9df-bcee302e7d38", "value": "86edacec5be6df1bb5431e228e688ac3936df5b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101792", "to_ids": true, "type": "sha256", "uuid": "76b6fc28-eae1-4577-ab38-ac614efb9739", "value": "6190923b28679eb8230010aff9b1d1a4184e8697540cc021a5be38126f3f6d99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100133", "to_ids": true, "type": "ssdeep", "uuid": "bbf3f1a0-f8be-4b30-bc9b-a300d551c5e2", "value": "3072:6ICX6jWbOwoFDlWu/kAYPwWf+qjwGUN8ag1bvl:pk3CWP/wWhjwGS+p" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100134", "to_ids": false, "type": "size-in-bytes", "uuid": "c7fcda68-bb5f-4b77-af6a-990c26157d1c", "value": "200496" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100134", "to_ids": true, "type": "vhash", "uuid": "af2af73f-a00e-48d7-a39f-2861f7e20539", "value": "125056651d051516z171z3nz3ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100134", "to_ids": true, "type": "filename", "uuid": "af43c1a5-8981-4285-9f08-b8d46d19c496", "value": "libsocksdll9_1.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100134", "to_ids": false, "type": "text", "uuid": "d76bcc1c-31c4-43d5-9538-ce7d790906ea", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Oyster.CC!MTB\nVT Total Detection:36/70\nFirst Submission:2025-08-28T20:06:40.000000+00:00\nLast Submission:2025-08-30T14:45:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105482", "uuid": "bd491601-30a3-4190-a275-851bbc04213e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105482", "to_ids": true, "type": "md5", "uuid": "5a40fc2a-d8c4-479f-b970-641e76af4a2f", "value": "4482fdd6d9269d3b748233ff4a87e9e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101793", "to_ids": true, "type": "sha1", "uuid": "11318450-3e76-4036-9825-4173e7c14876", "value": "8819a011ff38b0b0587f0cae0f3572502ec3c82d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101794", "to_ids": true, "type": "sha256", "uuid": "4e61b84c-6e48-4567-adbc-8bfd56a3f112", "value": "72bed9b26a7747252156b65d24a9a737d70b9bf6aca069c514c1c7b9e04ef9b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100155", "to_ids": true, "type": "ssdeep", "uuid": "eb2daf86-bd46-4e5d-8d96-885caeadffda", "value": "49152:uYKjGVDI8yRrwojt6e/vCIhVl/RpLNpGtlqatM0VwASOGgpTLMfIU6iDTsSVPd:NAQtMwhb+cSX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100155", "to_ids": false, "type": "size-in-bytes", "uuid": "6988fc64-f469-4dcb-8c9d-91b86100e74e", "value": "2752304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100155", "to_ids": true, "type": "vhash", "uuid": "0edfe501-f49b-42e7-8ebc-1ac3f7a23b0d", "value": "126066656d5565755093z32za69z65z10d1z3010100176z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100155", "to_ids": true, "type": "filename", "uuid": "b2d2e59e-31bb-4edc-80bd-edf88e080ccd", "value": "360NetBase.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100155", "to_ids": false, "type": "text", "uuid": "389a9723-0615-4b88-915c-0d5d666da585", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Latrodectus.CH!MTB\nVT Total Detection:27/70\nFirst Submission:2025-08-28T20:08:35.000000+00:00\nLast Submission:2025-08-28T20:08:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105503", "uuid": "7634375c-7a9a-4bb5-b5b8-2c0ecd5f74d8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105503", "to_ids": true, "type": "md5", "uuid": "daab2f65-9505-47fd-be4a-9ffd0c3192ae", "value": "67396fae15b4917894b2ef9392bff60f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101794", "to_ids": true, "type": "sha1", "uuid": "2b3a5493-7c2c-4db7-930c-ea0348c3e276", "value": "317291b511b832f599908c59906cd480ee165206", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101794", "to_ids": true, "type": "sha256", "uuid": "89844573-db56-4032-b9f3-58939a4d8e3a", "value": "b659389cde06f5e01e592dca458fe1be07a302c40dc2a820c7f76d4ee788bad3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100178", "to_ids": true, "type": "ssdeep", "uuid": "8e6f499f-a934-44a0-ad81-2edf9a18e239", "value": "1536:EaKJA396hnj5qPdjpeWVyXTqyV6Ly/hrUz3At8t633jHRi:EaKJA3ACdjpVQTYLMhrUA+Ujxi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100178", "to_ids": false, "type": "size-in-bytes", "uuid": "f50e9f2a-7eb0-4299-bb7d-db8b0545264a", "value": "93432" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100178", "to_ids": true, "type": "vhash", "uuid": "ffdd6b5f-dca0-480e-a739-86e8f81e5bdc", "value": "0940666d555d15151bz303=z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100178", "to_ids": true, "type": "filename", "uuid": "67b68165-325e-4588-a256-754ae6416dc2", "value": "subverted" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100178", "to_ids": false, "type": "text", "uuid": "42a1ccc3-89f0-4254-a70c-156ca57c2a64", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/ShellcodeRunner.CE!MTB\nVT Total Detection:48/70\nFirst Submission:2025-08-31T10:22:34.000000+00:00\nLast Submission:2025-08-31T10:22:34.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105524", "uuid": "a2d977b7-2b15-4518-95c3-e07a0e503cfb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105524", "to_ids": true, "type": "md5", "uuid": "b03f9c97-6773-4498-b2f0-fe2715411fe0", "value": "aecc447b2b69af35e20c3ea91e21e853", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101796", "to_ids": true, "type": "sha1", "uuid": "f25be798-a4df-4157-beaf-245137d12aab", "value": "29765840a9897f93ea3bf07ef59ffa8ae8cd5f14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101796", "to_ids": true, "type": "sha256", "uuid": "12dc8845-2d83-4250-a7c6-fbecf64f4079", "value": "55a02d14de13134e77eb9cc787ac622791b38b74931d1588bb5750b06951c8c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100200", "to_ids": true, "type": "ssdeep", "uuid": "bf96d618-5da0-4546-9f7b-bbbaf31c0b49", "value": "49152:+fw0t0GGpa2BhG7LbPVcJgUge/T/w6QPFkEObJV:NGGI7Cjb4Lto" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100200", "to_ids": false, "type": "size-in-bytes", "uuid": "ffc0d62c-6349-46f3-97b0-2ea6b049b979", "value": "1631744" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100200", "to_ids": true, "type": "vhash", "uuid": "669fb214-a011-4ef7-a6a7-f9d805cd15c8", "value": "016066655d15551556z230018z1dz8fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100200", "to_ids": true, "type": "filename", "uuid": "e1bf1f80-164b-43bd-b37d-52970fa60579", "value": "55a02d14de13134e77eb9cc787ac622791b38b74931d1588bb5750b06951c8c0.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100200", "to_ids": false, "type": "text", "uuid": "111092ae-f6ab-45bc-a9ee-1eeba9f8159a", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:54/70\nFirst Submission:2025-11-26T19:47:45.000000+00:00\nLast Submission:2025-11-29T15:34:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105545", "uuid": "8665502d-014e-4900-90b0-2369a79bf1f6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105545", "to_ids": true, "type": "md5", "uuid": "3c88d92f-e0c8-4c35-9029-abacf447cf37", "value": "366a9c89b9769117b5014a918d222456", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101797", "to_ids": true, "type": "sha1", "uuid": "32134ec1-6b4c-405e-9c61-eb9a8329c67b", "value": "c524749d590c5057642f72b583e2336b6e80d0ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101797", "to_ids": true, "type": "sha256", "uuid": "bb69d2fc-6b5d-41c8-ab9a-3846f4ebc8ee", "value": "f34cfdc950124d26b4f2f99b192a4ab7a4163af3143c3b18bc2271ca08d6c899", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100222", "to_ids": true, "type": "ssdeep", "uuid": "a840b0ed-4049-4310-8652-92498b68e582", "value": "6144:9t+rTCu2ND+zUzYnAkWY1hREv96LIOnu59fXQYi0CmuK6RRQpSYyI6KWMytiW/kz:9tueBN4INY18ZOa9PVHSSDpWVeAFBQL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100222", "to_ids": false, "type": "size-in-bytes", "uuid": "45104ca8-5148-4eaf-a9cc-43a41828ceb8", "value": "445440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100222", "to_ids": true, "type": "vhash", "uuid": "d2291e9c-37ce-4f86-8cd7-06ee425813b7", "value": "145066655d15551516z2100137z1dz6ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100222", "to_ids": true, "type": "filename", "uuid": "ac095ddd-14cd-464a-b33f-cf6c58bdbaab", "value": "alphasecurity.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100222", "to_ids": false, "type": "text", "uuid": "57e13cca-86af-4ac4-b35c-62fe0f50eb9d", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:44/70\nFirst Submission:2025-11-26T15:41:38.000000+00:00\nLast Submission:2025-11-26T15:41:38.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105566", "uuid": "708408de-fb69-4be1-9680-8a9d164763d4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105566", "to_ids": true, "type": "md5", "uuid": "9c8dc573-f80e-41b6-8914-0edf92f31819", "value": "273ce734daab80ddc2850b4975ac3c7b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101798", "to_ids": true, "type": "sha1", "uuid": "cf9efcd6-de09-47b8-a68c-0a055de9fef0", "value": "794a0b6f21d80a426ac33a706a962b66a6cc0492", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101799", "to_ids": true, "type": "sha256", "uuid": "6f87cd9a-2e3d-4689-a60c-e2e66e1eeb5d", "value": "c15f44d6abb3a2a882ffdc9b90f7bb5d1a233c0aa183eb765aa8bfba5832c8c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100243", "to_ids": true, "type": "ssdeep", "uuid": "1e6bcaae-e4f6-4d94-881e-81aeda1e8e16", "value": "768:XoGxq2CTskEwicwSu9D4NkkTCYwO5o4dM:Xoiq2gtlicwf4NAD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100243", "to_ids": false, "type": "size-in-bytes", "uuid": "d494c67d-6aba-4091-a2e6-baff52b7922b", "value": "45137" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100243", "to_ids": true, "type": "filename", "uuid": "eb800549-f931-4bb3-a6ce-57015295e208", "value": "modes.py.bin" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100243", "to_ids": false, "type": "text", "uuid": "1d617193-5e70-4957-b661-7e98b2574052", "value": "Type Description: Python\nMicrosoft: Trojan:Python/ModeloRAT!MSR\nVT Total Detection:34/61\nFirst Submission:2025-12-10T13:27:19.000000+00:00\nLast Submission:2026-06-02T20:36:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105587", "uuid": "4f6e608b-7570-4026-88b4-efde86173cbb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105587", "to_ids": true, "type": "md5", "uuid": "68045336-de49-49b0-b709-b4143e9f6380", "value": "583d4a295c4ff7ae8bd4cb2085a39934", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101800", "to_ids": true, "type": "sha1", "uuid": "1400538d-199b-4cc0-9ce4-09613aea6b7b", "value": "b0b63051f231bc2dcb67bec9ac8702177678fa39", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101800", "to_ids": true, "type": "sha256", "uuid": "f2560164-e8c5-4f3a-aa07-cad6bad9cf36", "value": "7ed805c5fc3bd0a4eab3d523483a9cc83b8768ff667875f2318f3bfa4ef68fe2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100265", "to_ids": true, "type": "ssdeep", "uuid": "70b89a57-9bf9-4814-ad9c-0983106c70e3", "value": "49152:LRmHFAzbwloFvoncfhWG1lSwhxsnQnmzDuczSP5e2sE:0HFAzbY5iQGi8qnmmvuczSP5e2sE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100265", "to_ids": false, "type": "size-in-bytes", "uuid": "66d1ca6b-e22d-4b0c-badf-6247a405684c", "value": "2071596" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100265", "to_ids": true, "type": "vhash", "uuid": "1562cd10-1edf-489f-864b-e8008566e23c", "value": "47d265657dad8ca2fdc1978546e377f8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100265", "to_ids": true, "type": "filename", "uuid": "6d618653-cba9-4d01-8040-1aff7f131be4", "value": "r0moncdr.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100265", "to_ids": false, "type": "text", "uuid": "0458b2cc-7cb2-4cf3-97d5-8d0d2b4612e1", "value": "Type Description: JAR\nMicrosoft: None\nVT Total Detection:18/64\nFirst Submission:2025-10-21T08:06:47.000000+00:00\nLast Submission:2025-10-21T08:06:47.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105608", "uuid": "65ec0fd5-5493-4544-b009-86503f5df572", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105608", "to_ids": true, "type": "md5", "uuid": "435f6a86-8b9f-46e7-accc-9339e2bdc318", "value": "b2b03dfcdc2e59d81e99d20c15919a13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101801", "to_ids": true, "type": "sha1", "uuid": "b54ebc9c-f120-4f83-ab60-254e58ca4f13", "value": "d3c5bcb1494f034248fba8f0649242e191bcc3fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101801", "to_ids": true, "type": "sha256", "uuid": "a6c3dc62-4c49-43e7-af0e-c332df2915aa", "value": "7389c2d346ef85e469a5ce47ef4cbf55bf3c58075996b8f5596e15fa257d90ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100287", "to_ids": true, "type": "ssdeep", "uuid": "a0d3ca23-5c7e-4de1-9db0-3e09c6912d6a", "value": "196608:SLb/W2ulh5g7OCBeJ4JJQP/USofo6myG/CV9NmXCriws6Jm+CU:dOO+GMSoAyGCx2M0U" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100287", "to_ids": false, "type": "size-in-bytes", "uuid": "fbd46b3e-8e9a-471f-a6b2-cad167de55f4", "value": "10233856" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100287", "to_ids": true, "type": "vhash", "uuid": "5bcb52e7-c79f-4e4a-88c8-c55e14749d09", "value": "0170666d557d1d1551z1021zd00170e5z9dzbfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100287", "to_ids": true, "type": "filename", "uuid": "5830dd4b-ce44-4548-bc8b-f97fae52527f", "value": "Dixie" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100287", "to_ids": false, "type": "text", "uuid": "11bc0d35-5e96-483c-8cab-8d6adfbdf67a", "value": "Type Description: Win32 EXE\nMicrosoft: Backdoor:Win32/Supper.GTB!MTB\nVT Total Detection:52/70\nFirst Submission:2026-02-15T17:05:27.000000+00:00\nLast Submission:2026-02-15T17:05:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105629", "uuid": "3b4f76f2-08ec-4043-9290-079bc1f594e9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105629", "to_ids": true, "type": "md5", "uuid": "49aef674-dbc6-4c56-aa37-361096b811f6", "value": "422755116ab311b473dd38ec88f129d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101803", "to_ids": true, "type": "sha1", "uuid": "2e206041-f74e-4d46-a239-1c8e83f55bdd", "value": "60d78692c48277679dae37b66ce80bab272359cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101803", "to_ids": true, "type": "sha256", "uuid": "1567dc4b-8e03-48d2-948d-1f764be0ff42", "value": "aa6e5529831b62cb27211b4918dd6da15ac7e69dbcc8621671dccf6df151c5a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100308", "to_ids": true, "type": "ssdeep", "uuid": "4f1ff214-aaae-4cfe-9cf1-50d0e813f28b", "value": "196608:Uw4SxIZczW3/qQzrBvr7U4J2ncr9R9wmYDRORwt2xHdU7H/kFt:Uw4rKzWvq8ZUE2bmAowt2MM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100308", "to_ids": false, "type": "size-in-bytes", "uuid": "83cb2fb3-fc8b-4efb-9fa0-852367d62586", "value": "10247168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100308", "to_ids": true, "type": "vhash", "uuid": "8711a8d0-d611-474d-b001-2aec9a8d87c8", "value": "0170666d557d1d1551z1010013001f0c5zbcz1bfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100308", "to_ids": true, "type": "filename", "uuid": "dba55116-9869-49ea-b030-33e44eff4e4a", "value": "splendidly" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100308", "to_ids": false, "type": "text", "uuid": "c023f5db-522a-480a-a0f9-541e39eacd88", "value": "Type Description: Win32 EXE\nMicrosoft: Backdoor:Win32/Supper.GTB!MTB\nVT Total Detection:48/69\nFirst Submission:2026-02-15T16:32:51.000000+00:00\nLast Submission:2026-02-15T16:32:51.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105650", "uuid": "69f1aa05-9366-438c-adcf-7c1908ee7d3f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105650", "to_ids": true, "type": "md5", "uuid": "025a4bd3-b61b-4756-b096-223622051320", "value": "abe1d920b98240580563f750c1c1e4db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101803", "to_ids": true, "type": "sha1", "uuid": "70ca96e1-f326-44f9-a5fd-e72812d86e33", "value": "df5ddf117b0e19e797c7628ba1faabb95d8efd04", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101803", "to_ids": true, "type": "sha256", "uuid": "ca58f036-292b-4776-8ae2-f211f654e3ed", "value": "d1caa376cb45b6a1eb3a45c5633c5ef75f7466b8601ed72c8022a8b3f6c1f3be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100330", "to_ids": true, "type": "ssdeep", "uuid": "d7690bb7-15c5-4ea0-9741-a9086e5d6a80", "value": "24576:V04OjAlC+9nHLmX63wZSGBI/u0+eW81ATw8SEn4FDpH+p:GHsl99nrmXOFp/HJW8iKS4FO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100330", "to_ids": false, "type": "size-in-bytes", "uuid": "519fd0f4-f4ab-4f0c-b6e9-dd081052a96f", "value": "984064" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100330", "to_ids": true, "type": "vhash", "uuid": "249ed397-987a-42d0-9242-1489ddc453c0", "value": "295036751511e0d6b76510ee6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100330", "to_ids": true, "type": "filename", "uuid": "5b02790e-d517-4554-8f21-dc2a3d20bb8e", "value": "Certify.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100330", "to_ids": false, "type": "text", "uuid": "eb6c1535-96cc-43a5-9df1-3e8163cb5a99", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:47/70\nFirst Submission:2026-02-16T13:31:51.000000+00:00\nLast Submission:2026-02-16T13:31:51.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105671", "uuid": "58bca54c-1670-4fd6-96e2-1fc6048274c9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105671", "to_ids": true, "type": "md5", "uuid": "36fb42a1-45c3-4e16-97e6-9ae0f630532a", "value": "862763a754b4edfc0af31e14a3b1d691", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101804", "to_ids": true, "type": "sha1", "uuid": "31997c9b-be3c-4ff8-a927-4dff10300ea6", "value": "ceb69dfdd768aa08b86f1d5628bd3a38c1fe8c1f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101804", "to_ids": true, "type": "sha256", "uuid": "f94b39cb-616d-4ee3-9775-b11f18a0f5e0", "value": "396eb0e817d90cf366b5648f9a97c51bfb37737af13dc4a9e1a768885a867dc5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100352", "to_ids": true, "type": "ssdeep", "uuid": "24fc175d-31ec-4899-9393-4b41c14d6631", "value": "24576:5Pni53B7fLRuGE5NcjmprVgYayiI1RUTEmLEArEGwNpHP8WCB4PFxZOR:5Pi5lLRxEPAmpr9aa1RUT1EWwfRbZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100352", "to_ids": false, "type": "size-in-bytes", "uuid": "e93b6497-af60-4dda-a7d1-2266769c867b", "value": "1816064" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100352", "to_ids": true, "type": "vhash", "uuid": "329de956-c8cd-49cc-ad76-9944fe9800e9", "value": "1160766d55651d1d1551z3031ze0022094z127zc2z14dz15" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100352", "to_ids": true, "type": "filename", "uuid": "a17d1dd1-2490-4fa8-adaa-7be4f05d3e00", "value": "9OFIv" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100352", "to_ids": false, "type": "text", "uuid": "e12585eb-3b66-4c57-ac88-08ee6fde25e4", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:46/70\nFirst Submission:2026-02-09T14:42:03.000000+00:00\nLast Submission:2026-03-24T13:00:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105693", "uuid": "3dbfece1-e004-4288-a500-46d07b0230e7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105693", "to_ids": true, "type": "md5", "uuid": "15dabc34-53b0-4b25-8656-2ec0c7f41754", "value": "953ff92984b8598799ea163f73a1f84a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101806", "to_ids": true, "type": "sha1", "uuid": "a54a4bb8-cb09-4f88-8295-4eeed355b656", "value": "4ba8397e9a1de711a0ed6ed34d305e98c2d9f9f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101806", "to_ids": true, "type": "sha256", "uuid": "9623efc0-3d03-4f47-ba6a-97134ed72c50", "value": "0708a518ef644a3911a717220706190fbd5e5246c533845887c5fbd967953799", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100373", "to_ids": true, "type": "ssdeep", "uuid": "36ef46ed-ca27-41f6-ba0b-ec9a578c485a", "value": "196608:xHxcp9ym3+ltDUJVnHxcp9ym34Hxcp9ym3cHxcp9ym3bHxcp9ym3nHxcp9ym3DHk:jGpopAGpGGp6GplGpRGptGp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100373", "to_ids": false, "type": "size-in-bytes", "uuid": "2f7646fe-e667-443d-b5f4-385075b799b1", "value": "13447168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100373", "to_ids": true, "type": "vhash", "uuid": "8a559551-dd2d-4416-ae3b-d1224a1fb78c", "value": "45155b83172cd3ff230fec9025027227" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100373", "to_ids": true, "type": "filename", "uuid": "7d0b5c79-723c-4aca-a0f6-3fcff340ca19", "value": "0708a518ef644a3911a717220706190fbd5e5246c533845887c5fbd967953799.msi" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100373", "to_ids": false, "type": "text", "uuid": "f83139ce-c375-4c96-9f76-9a26ceeeb087", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:34/61\nFirst Submission:2026-02-15T17:09:30.000000+00:00\nLast Submission:2026-03-24T11:30:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105714", "uuid": "17f6bd4e-65a7-429f-9a15-5bfc15f07618", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105714", "to_ids": true, "type": "md5", "uuid": "86c7c350-143e-427e-b07a-c3d9d0d3ed0a", "value": "5d3569401837f0ffa3a69ff02131b3b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101807", "to_ids": true, "type": "sha1", "uuid": "c73db852-503b-4b51-acd5-425a32ea2997", "value": "fe3b3127c4328adb4489e84d7fc4c6decc2169ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101807", "to_ids": true, "type": "sha256", "uuid": "d913af39-161c-4478-a68e-8b5c4fd16e4f", "value": "21d9ed48d51a5b5edae7eb7f99d1648a3ce7d419bc46234143c37dec4638c60d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100395", "to_ids": true, "type": "ssdeep", "uuid": "bfe62632-fc6d-4763-8ebd-c3b3ad08e951", "value": "98304:BHFAzbLUqZ/saQ2Mv68haJBP4lz6HVCDzPk96Tcly1i0GN/lpmz6u5zlUZe2vD:BlAzHUBao6/BgwcDzM/oQ0e/c6u3UZeu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100395", "to_ids": false, "type": "size-in-bytes", "uuid": "91f6df2f-6d2d-4f69-b43a-f5f188a5ac36", "value": "5380934" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100395", "to_ids": true, "type": "vhash", "uuid": "28f48fba-032a-4d7e-b332-49f331639813", "value": "a0a190469333a86b8ba263ba9d84300b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100395", "to_ids": true, "type": "filename", "uuid": "fe060d48-555e-4e93-81fc-bb2010433efc", "value": "1f4MlBphL" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100395", "to_ids": false, "type": "text", "uuid": "ad76054e-f089-45c3-b049-9309e25a1a1d", "value": "Type Description: JAR\nMicrosoft: None\nVT Total Detection:22/66\nFirst Submission:2026-02-16T13:14:51.000000+00:00\nLast Submission:2026-03-24T11:35:14.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105735", "uuid": "20d27b8d-a285-46ed-b336-95fd243d1f0e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105735", "to_ids": true, "type": "md5", "uuid": "986c5ab3-7f8f-41eb-b5e2-6a028187e5c8", "value": "fb7c39b75beab3a7b96815f7e31d72ca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101808", "to_ids": true, "type": "sha1", "uuid": "13934ca7-5186-4ad0-91b1-dc77e1880323", "value": "ab420e67f5b2ba45702674a7fe3e10e9d4283732", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101808", "to_ids": true, "type": "sha256", "uuid": "ee9e3504-0c0c-4449-ad36-b2874827be33", "value": "097f139304307375cd41bb2dc3913166e9f05f0d6bf5aad1efdc081dbf07c68d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100417", "to_ids": true, "type": "ssdeep", "uuid": "0d8e2314-ecea-4664-814a-0ef65a974f96", "value": "768:WlDdO1ccLlJIgGSE2UmPt05qtG2bIbO6wJPpG+ubxxKT2Cq4FoKW:+DdOmyJ3VEm0MzbsX4uG2Cq4FoKW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100417", "to_ids": false, "type": "size-in-bytes", "uuid": "44a1b448-829a-4696-b948-2d5fccab3bc6", "value": "56336" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100417", "to_ids": true, "type": "vhash", "uuid": "64a21dac-471a-4db9-8966-74ebd1267119", "value": "0540a76d5555151c0d1d1az112ctz97z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100417", "to_ids": true, "type": "filename", "uuid": "0f303e4e-179b-4b1b-a9db-8c323fdf140f", "value": "hisar_so.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100417", "to_ids": false, "type": "text", "uuid": "40e4c56d-f52e-4271-b480-b2f2b9642a07", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:29/70\nFirst Submission:2025-12-07T06:03:37.000000+00:00\nLast Submission:2025-12-07T06:03:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105756", "uuid": "2c9ae772-d7a3-4012-bf96-28368c412441", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105756", "to_ids": true, "type": "md5", "uuid": "1179fc98-8218-447b-b162-4fdb8559165f", "value": "505060fb5f7e82941edf3070a8a78644", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101809", "to_ids": true, "type": "sha1", "uuid": "91f1bb82-9d48-48e4-9b54-937fc27d1ffb", "value": "f99970d8f0993f451083bb0fda224d344718352b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101809", "to_ids": true, "type": "sha256", "uuid": "7e49cbe7-495d-42e4-8f7d-e9c585485c20", "value": "c24cb7692b77123387b821f3683966807662217a4c918c32bb97358729c33a1d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100439", "to_ids": true, "type": "ssdeep", "uuid": "cfff6832-3d1f-46bf-8265-ab77e0b49e51", "value": "1536:5asMcIVrrAAoMlebUc0rrR7U5Bg/n6ViaLv:5aZlrAHDy7U5Bi6ViaLv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100439", "to_ids": false, "type": "size-in-bytes", "uuid": "b9b4596f-e9c7-482c-8f8c-015603086ea4", "value": "54784" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100439", "to_ids": true, "type": "vhash", "uuid": "cc962831-275e-4b6f-b04e-48a2258dedc3", "value": "1540766d65551d151517z51zf0alzc5z66z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100439", "to_ids": true, "type": "filename", "uuid": "4dd67581-03ba-401a-a58c-c131e8486aac", "value": "vacuuming" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100439", "to_ids": false, "type": "text", "uuid": "cf5bef58-50ed-4e38-bf7a-e734745e43e5", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/CryptInject!rfn\nVT Total Detection:42/70\nFirst Submission:2024-11-04T18:19:31.000000+00:00\nLast Submission:2024-11-04T18:19:31.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105777", "uuid": "3c285df9-684b-42af-927e-a5774cf5430d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105777", "to_ids": true, "type": "md5", "uuid": "5d3e358a-aebe-4d33-b88e-e5101faef883", "value": "c1623eaddbbbd40756053526c908f6dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101811", "to_ids": true, "type": "sha1", "uuid": "804ec0a4-b295-40f3-af24-d216de3ce2c6", "value": "9a5c7cbc8cc55da24e2e19897f3d34f8c063393a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101811", "to_ids": true, "type": "sha256", "uuid": "81c36c09-7c35-4c99-83fa-e4a2e452715e", "value": "ec90465dbe3e2846be394bc2d76ddffdee4834086bcc65a6f43535f51333a7d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100461", "to_ids": true, "type": "ssdeep", "uuid": "8758bc3c-0b07-480f-9679-c5bae7b329b1", "value": "384:9fCZgvh/3HUh/RpoQzb06PQioVcAQy7eYZQtTrnNwnjq3kbmo8v3bscURYFocC4n:9fMgvh/3HUh/RpoQzb06PQioCAQLAQtx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100461", "to_ids": false, "type": "size-in-bytes", "uuid": "35d33edd-82c5-4da2-8c00-143b45cff248", "value": "23032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100461", "to_ids": true, "type": "filename", "uuid": "3762d01d-4470-48f2-9aa6-dffb9af9a34a", "value": "wZ1NM68U" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100461", "to_ids": false, "type": "text", "uuid": "35183642-343f-4f3c-ac6e-1487e459f3d8", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:20/60\nFirst Submission:2026-02-15T10:49:21.000000+00:00\nLast Submission:2026-02-15T10:49:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105798", "uuid": "2f1ee703-1c66-4634-9534-7cd9b52fe737", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105798", "to_ids": true, "type": "md5", "uuid": "934a32f4-098e-41c4-afb5-6b1f398833c9", "value": "9801f62c97e5b328070158a8f7337747", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101812", "to_ids": true, "type": "sha1", "uuid": "51120ce9-24ec-4118-8f43-ccfba1f4def0", "value": "037c5f87a56d63fbe051e71f9b0349ab785a919b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101812", "to_ids": true, "type": "sha256", "uuid": "6113145b-19a2-495e-982d-f4fa278aedb1", "value": "ff664520f263e30ee0380e496328a93701576f1312d2e33a70297a228a8a49a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100483", "to_ids": true, "type": "ssdeep", "uuid": "7fcfa604-fc57-4cf5-8bef-500f3d5eae2c", "value": "768:L4T/DMRoPoWq6OE05DZ7Y51iJjGj/slLJ4v0MUQ9L9bkxvC5r3qCZaC609KNTTl8:0T/5dOEZ/vFeB4pJcly" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100483", "to_ids": false, "type": "size-in-bytes", "uuid": "59418348-48c1-4e4c-8e27-c78d14fc1d53", "value": "55947" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100483", "to_ids": true, "type": "vhash", "uuid": "aad9fe42-f3d9-4f57-a5d9-31d8886aaff2", "value": "99c7a8e943104b38d898a723ad270c58" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100483", "to_ids": true, "type": "filename", "uuid": "f640bdcb-583a-4cb8-8407-6d6211ab881c", "value": "NtTx.js" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100483", "to_ids": false, "type": "text", "uuid": "33c2f3ea-f6bc-4ca1-a2ac-f486261e36fc", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:22/60\nFirst Submission:2026-02-17T15:37:50.000000+00:00\nLast Submission:2026-02-17T15:37:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105819", "uuid": "27318dd0-5a7d-43b8-acc5-c4b80143ef18", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105819", "to_ids": true, "type": "md5", "uuid": "0d8a4eba-2c47-4e2c-a243-2252b43eee13", "value": "c029b2b8c6271a74668a40cad2eb5db7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101813", "to_ids": true, "type": "sha1", "uuid": "fa84668d-43ac-4404-af37-abf632537eca", "value": "308dc4d38b6f7a5b1156c9d2bae979e69dfc9110", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101813", "to_ids": true, "type": "sha256", "uuid": "9ca2f5ee-0aec-4344-af69-ce8e3394594f", "value": "66f9c0eb64db7fac127d3d6d2a5a65de6b00bf2b78146a5acecdba2c628b1753", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100504", "to_ids": true, "type": "ssdeep", "uuid": "ae0ec7e5-f512-42d0-984c-fef2fa1eda90", "value": "1536:Uw4meF/a2bxaR2R/qHXFJTRe5nZHWhfeoNlhKVNml+Zi7BNgmsNiGuVa+yIJ30:Uw12bx8ReBHoNlhKVNml+Zi7BNgmsNas" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100504", "to_ids": false, "type": "size-in-bytes", "uuid": "0d7f391e-e3db-4e02-889e-3346180cf197", "value": "78903" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100504", "to_ids": true, "type": "filename", "uuid": "826cb088-1365-4db4-9eb2-9368eceea964", "value": "Pmanager.py" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100504", "to_ids": false, "type": "text", "uuid": "d778da3c-6e14-497e-9b5e-3ac59e4a256b", "value": "Type Description: Python\nMicrosoft: Trojan:Python/Boxter.HAB!MTB\nVT Total Detection:24/61\nFirst Submission:2026-05-19T19:10:09.000000+00:00\nLast Submission:2026-05-19T19:10:09.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105839", "uuid": "84ddbfbd-a3f5-4ecf-ab59-39a715300d99", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105839", "to_ids": true, "type": "md5", "uuid": "22d7eea8-0456-40be-aab1-21da9a8a49fb", "value": "18e6cfd561175e6e043ee3d91819a37d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101814", "to_ids": true, "type": "sha1", "uuid": "2b7a22e8-7b9e-4b77-bb95-c6dbc5f69ccf", "value": "224a21c122569d682302ae26ec4fdbfada36aa65", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101814", "to_ids": true, "type": "sha256", "uuid": "5671e923-c8c1-4148-b673-20f498ed86cd", "value": "dbc316c240067d5495415fca6b8fec28b0d9e41282919d7d124fc645e15f5d4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100526", "to_ids": true, "type": "ssdeep", "uuid": "32834069-3dc1-44c7-9482-48d300d63f89", "value": "24576:IB96lNlKEI/2yL/CuL9+K4jS63qDdLWihliujwZM9+LTiIXUhLaPTWudGDqQLMX7:RlDKE6PL9+KsS63qO+wk9MauMD1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100526", "to_ids": false, "type": "size-in-bytes", "uuid": "3f2a11b9-8807-4289-83f8-385fb89b871b", "value": "1576448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100526", "to_ids": true, "type": "vhash", "uuid": "bb44b93f-0f8c-4a7c-9312-20bd4ad6918c", "value": "1160766d55655d151551z32z110017075z77za2z12dz1e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100526", "to_ids": true, "type": "filename", "uuid": "1582e377-9f0d-40c8-89a2-02d59b33ec46", "value": "x1NATLCW2uj" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 17/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100526", "to_ids": false, "type": "text", "uuid": "f029ebe3-e3c8-494a-8994-47d8e067a315", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:27/69\nFirst Submission:2026-02-15T10:51:54.000000+00:00\nLast Submission:2026-02-15T10:51:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105860", "uuid": "5cc69547-7403-44e3-8e38-1a58b2327554", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105860", "to_ids": true, "type": "md5", "uuid": "d0e57584-448a-4e54-8205-8332ffb41f17", "value": "1bd5659194613808731a143dd5c88c0c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101815", "to_ids": true, "type": "sha1", "uuid": "51f6cea0-3bae-482e-8fba-41c2d83e7faa", "value": "d7f6f8fc71eadbd7a665702d638666b4a1138da4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101815", "to_ids": true, "type": "sha256", "uuid": "41cc7a7e-7c93-414a-acc1-532bbc581904", "value": "b204d00dd01da0408978e4101479efbdc977e84ad4a99cdbfd4a3364df964dd0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100548", "to_ids": true, "type": "ssdeep", "uuid": "6a588897-ef01-4c2d-87a9-e92db9f09273", "value": "3072:BwMUo5TuNJWqQNmMppYMblIfLOtHDkwoeWms:go56NXEmMpBaeX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100548", "to_ids": false, "type": "size-in-bytes", "uuid": "bbe05aef-2925-4222-b294-54e3591c1bce", "value": "107520" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100548", "to_ids": true, "type": "vhash", "uuid": "8c5f158d-8279-4a67-a368-6c9f4c9c2f7f", "value": "115076655d155515155az481z2$z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100548", "to_ids": true, "type": "filename", "uuid": "fa6d05d1-4b38-4aa2-9f19-909ae520a222", "value": "ELBhS" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100548", "to_ids": false, "type": "text", "uuid": "cc8de843-1895-425a-bc92-117dda5312b6", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Seheq!rfn\nVT Total Detection:47/70\nFirst Submission:2026-02-15T09:37:49.000000+00:00\nLast Submission:2026-02-15T09:37:49.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105882", "uuid": "fbf20ced-39dc-4a66-b478-a62ecd195c97", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105882", "to_ids": true, "type": "md5", "uuid": "0aa36ad5-1901-4e45-a53d-eb81dbc3a44e", "value": "2471ab67e2bb73a5f12877a10c1d1dc4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101816", "to_ids": true, "type": "sha1", "uuid": "29cda5af-32d3-4ab7-9323-42c685b07dd0", "value": "d2fcf4a3c0012398caf4247cd08f16857e115223", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101816", "to_ids": true, "type": "sha256", "uuid": "a5c15958-a2c5-49f9-977e-d952acfe6908", "value": "b1444193923ca6f71c70c6a45011378ef00459c8a0795da6e1637ef74a24facb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100569", "to_ids": true, "type": "ssdeep", "uuid": "b5583b07-d35a-4828-9d64-af314af291e4", "value": "24576:dN/aOgzM3lJK+9qxvj1PJT0xoxaQQsHAxPr/20USYq7qUTp6SV:dN/aOgzM3vK+8xZ1ooxatsHGT/2a" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100569", "to_ids": false, "type": "size-in-bytes", "uuid": "2c23b880-2f0c-4372-ba6d-bd508a3d113d", "value": "1394688" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100569", "to_ids": true, "type": "vhash", "uuid": "7052b807-1a60-4290-bf55-31095d63c93e", "value": "1160766d55555d1d1553z11zf00180d5za7z53zfeze" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100569", "to_ids": true, "type": "filename", "uuid": "78822555-31e0-4177-8216-e07d531baecf", "value": "sick.txt" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 17/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100569", "to_ids": false, "type": "text", "uuid": "13d4ede8-da64-478b-a344-96df23e7f61e", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:39/69\nFirst Submission:2026-02-16T12:57:00.000000+00:00\nLast Submission:2026-02-16T12:57:00.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105903", "uuid": "5f0d6dae-fdde-4c6d-8612-c36fe66101a5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105903", "to_ids": true, "type": "md5", "uuid": "26d6a740-8a9f-4a61-ad32-b4c71c19c74b", "value": "43656342f73a12ecc02209ea14211c88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101817", "to_ids": true, "type": "sha1", "uuid": "1100c4cc-ba56-4bc5-b5da-a9dd73c58c6c", "value": "9daa74a3b63c352c120c8b043a1e88f32cb8ad54", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101817", "to_ids": true, "type": "sha256", "uuid": "360f6eff-76d7-4dd2-83e1-eaf79cfff5fa", "value": "5811d60e80a6051ab3bd2651060fce8f1ea8d446a062625b0d2b55bb7b2bad99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100591", "to_ids": true, "type": "ssdeep", "uuid": "a40e89c2-1598-4af3-9089-084f9570d0fa", "value": "393216:303cBSB+WJ4YIraW/6lYWRsvjymT0jdE1awe4gSpqa+eKViMtn26GdjUp5R6i6a:38cBSQYI2W/6OYE17eXYPA2hdjUDUVa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100591", "to_ids": false, "type": "size-in-bytes", "uuid": "7bbd82aa-5d4a-4690-8dba-8d65e66b260a", "value": "17391057" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100591", "to_ids": true, "type": "vhash", "uuid": "55d8cc72-0041-43d4-88b6-89fb6b5ce7cf", "value": "39c310d524afbc41fbd819a80ab53e0a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100591", "to_ids": true, "type": "filename", "uuid": "d55f0a58-a1de-4ad7-be7b-9f0ac22202a7", "value": "dh8FXO" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100591", "to_ids": false, "type": "text", "uuid": "cfd10fbe-851c-429c-8c64-b8425b01944b", "value": "Type Description: Python Wheel package\nMicrosoft: None\nVT Total Detection:3/67\nFirst Submission:2026-02-15T11:21:39.000000+00:00\nLast Submission:2026-02-15T11:21:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105924", "uuid": "9b1c54a7-a244-4a29-b83b-ea0d21e9e5cc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105924", "to_ids": true, "type": "md5", "uuid": "faf94636-48e3-462a-b026-2d983198968a", "value": "43948d6f8c51b96c1f854ea695ffe67f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101819", "to_ids": true, "type": "sha1", "uuid": "959ce5bc-36cd-4db4-bbfe-2c9b5bcb53b4", "value": "7678f6e106be134178afa1a0752adcdefa140939", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101819", "to_ids": true, "type": "sha256", "uuid": "de8fb5f1-8c12-452f-bf5b-7a175522387f", "value": "ea1a0bb1bc5eb31b85675dc91370ee26a8bc6571b0c21a8fc5faa58e67fa01ac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100613", "to_ids": true, "type": "ssdeep", "uuid": "b6ff74a5-22f2-4da3-a8df-9b3c8708d490", "value": "384:hIDEPXphakPGSg0fKrZNt1fsv6QCSFNjlzn2EJo/yo5OLE+QziGQu9pFGAT:hIDEXphakPGSg0fKrZvVsvbN52EJo/yg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100613", "to_ids": false, "type": "size-in-bytes", "uuid": "75269029-a060-4b97-8658-92a13a1e43d9", "value": "21304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100613", "to_ids": true, "type": "vhash", "uuid": "0153d7e5-1a4d-4c9a-9ec7-ac67fc5fba61", "value": "482e3ae6420e6c55f402730cf3ff03f6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100613", "to_ids": true, "type": "filename", "uuid": "bce84310-2e02-4a7d-8afc-e58141c2036b", "value": "F7drcO" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100613", "to_ids": false, "type": "text", "uuid": "6019e64b-2d9d-4190-8105-3905a554159f", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:21/60\nFirst Submission:2026-04-01T08:37:02.000000+00:00\nLast Submission:2026-04-01T08:37:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105945", "uuid": "e042b846-4e4e-46ba-bcef-a74c3aa82c49", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105945", "to_ids": true, "type": "md5", "uuid": "3a75bb94-4e1f-4d34-a04e-40d5110a2d3e", "value": "556050a9f9cb6bff6e19ada58215e469", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101819", "to_ids": true, "type": "sha1", "uuid": "b497fe86-67dc-4796-ba47-90f25f996aa2", "value": "7cabb558174ceb08b7468902ff2aa0e8b0a27179", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101820", "to_ids": true, "type": "sha256", "uuid": "6ff70c7c-8941-48fa-ba7b-335fe3b57bbf", "value": "913487d5c4514300e1f774af965d046479f0a6612061bcb82b536c7427a49102", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100635", "to_ids": true, "type": "ssdeep", "uuid": "aeafaaca-949f-45d8-93d1-a8ecb8730c70", "value": "196608:RkMarhXWnUe7FR5HTdoApza/tsed4JCD1TVQgoxkPdi:REhG7F7poApza/Dd4JCD1TaIPU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100635", "to_ids": false, "type": "size-in-bytes", "uuid": "b49aa793-730d-4633-b20a-73b1d50894a4", "value": "18092544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100635", "to_ids": true, "type": "vhash", "uuid": "f7a91c8f-e44c-4bfa-948b-09cb05bd7ef4", "value": "017116655d55551555757az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100635", "to_ids": true, "type": "filename", "uuid": "436d406e-024c-4c49-a8b7-1503e5e44297", "value": "PapaPepeV1.4.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100635", "to_ids": false, "type": "text", "uuid": "504ee8f1-4950-4ce3-a0ed-520c2baf2136", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/SuspGolang.AM\nVT Total Detection:49/70\nFirst Submission:2026-02-07T06:27:17.000000+00:00\nLast Submission:2026-02-16T19:27:53.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105966", "uuid": "de39c76c-8525-48da-bf46-5770b30405cb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105966", "to_ids": true, "type": "md5", "uuid": "9363928b-f9bf-4f74-923d-504aead2f4ac", "value": "80a78a49e65c07d381455e02457e7670", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101821", "to_ids": true, "type": "sha1", "uuid": "59f7ca1d-dde1-406e-9ed9-0aec9e8337b5", "value": "3ed07b60cb23b8414e89ccc1117e6a0662226e30", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101821", "to_ids": true, "type": "sha256", "uuid": "5c110a79-264b-482c-ae0e-fb22722c7f31", "value": "c8347069980e0c7b8d42cbf0f2be7bc6e558f8b6cf7ca960f6454926120adf55", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100656", "to_ids": true, "type": "ssdeep", "uuid": "e798b962-80c7-4285-b03b-7fc20fbccdfe", "value": "768:HXEcvzhZk5//hTrt38NJEC+jDat5QpRU+eRapPqCewpH7kbTt50rTZT+Yftx5DhT:pGz38NI+Bul+U" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100656", "to_ids": false, "type": "size-in-bytes", "uuid": "a15012f8-2e1b-4579-877a-a6603154334e", "value": "35002" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100656", "to_ids": true, "type": "vhash", "uuid": "70134e7c-222a-4f36-8afe-aad81965277c", "value": "c9988cbd459f29ff70fd1b834702c171" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100656", "to_ids": true, "type": "filename", "uuid": "04183d2f-aac7-4ef9-a4a7-ea36f10807fa", "value": "_c8347069980e0c7b8d42cbf0f2be7bc6e558f8b6cf7ca960f6454926120adf55.txt" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100656", "to_ids": false, "type": "text", "uuid": "ebacd6d9-7374-43c8-851c-70a332971baf", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:24/60\nFirst Submission:2025-11-10T19:01:39.000000+00:00\nLast Submission:2025-11-10T21:41:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782105987", "uuid": "ef385337-6aba-4de6-9119-2511af7c682b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782105987", "to_ids": true, "type": "md5", "uuid": "886a72e7-3629-4ecd-8ec3-0bd26d76cfcf", "value": "819084b07947d662863eade75246bee1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101822", "to_ids": true, "type": "sha1", "uuid": "6f5deda7-b192-40ee-92a8-760cd5c7ec32", "value": "0e3e745502e065c105d890c7457d9bc39473ed2a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101823", "to_ids": true, "type": "sha256", "uuid": "9c24021b-a0e0-45b0-a024-d8f9c944da00", "value": "b0e292346b4ab3f83fadd8abcce7cfc5b9d50ef73ad141e8bc4a4689fee13504", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100678", "to_ids": true, "type": "ssdeep", "uuid": "e48c02b8-825a-4774-a9c1-c2e6feed22e2", "value": "196608:q3d6sw9Yq0JgYALoK8zilk5qCtc7MATm+0li25/1Xi+XJ9Q9D17j451PvQ/pPSNT:qN29F0EKgL7MFE259X9Z9gq1PvQhKN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100678", "to_ids": false, "type": "size-in-bytes", "uuid": "3016a0b6-c5da-4887-9395-9ec9386a222f", "value": "10332160" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100678", "to_ids": true, "type": "vhash", "uuid": "7f2298e2-6fdb-4999-93d9-a67deeaa9bf1", "value": "0170666d557d1d1551z4011zf001f0b5z7cz1gz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100678", "to_ids": true, "type": "filename", "uuid": "a377f46f-4dee-4cad-90a3-eedde9ba8e54", "value": "Tabasco" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100678", "to_ids": false, "type": "text", "uuid": "44d6bede-5f01-4344-83ba-7677025c75a6", "value": "Type Description: Win32 EXE\nMicrosoft: Backdoor:Win32/Supper.GTB!MTB\nVT Total Detection:52/70\nFirst Submission:2026-02-15T17:54:39.000000+00:00\nLast Submission:2026-02-15T17:54:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106008", "uuid": "e6653971-30d5-4f9d-a373-ab780691f1f5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106008", "to_ids": true, "type": "md5", "uuid": "dbbcbb8b-ee79-4652-9451-e365f310f639", "value": "993bd3fe3c439747c27bb138866ccbef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101823", "to_ids": true, "type": "sha1", "uuid": "674f70c6-2f85-4c80-9928-ceae7b2b6c8c", "value": "ed8eaefd9c404b95832f700238efe56b46e23412", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101823", "to_ids": true, "type": "sha256", "uuid": "2356446d-2a7a-4632-81cc-57462cb1983a", "value": "966908e8863bb78cdd66d29f1d425578cdd2035b6045b86fd8418bfde5e34986", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100700", "to_ids": true, "type": "ssdeep", "uuid": "a3ea6263-43bd-43b1-8606-7e4d2ccd857f", "value": "786432:gXdRWlzPqX4dpuTnlyQPVjX0HTIEGFpAVrU77vO+VSo6wI:gXdOzNcTllP5X0zIEMAVqWCSsI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100700", "to_ids": false, "type": "size-in-bytes", "uuid": "e44b8865-37f4-4456-8d35-a0c33b4bf2e2", "value": "36161437" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100700", "to_ids": true, "type": "vhash", "uuid": "e4d51321-8c8f-41d2-a751-2fea58fafed0", "value": "93d582945116ac81ac5501ac8dcab183" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100700", "to_ids": true, "type": "filename", "uuid": "0c2d56fc-a889-4966-b375-406dd413f3ea", "value": "GbPz3WUNp" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100700", "to_ids": false, "type": "text", "uuid": "5696dfad-a739-4e98-b4c4-8506a991672b", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:8/66\nFirst Submission:2026-02-15T17:24:58.000000+00:00\nLast Submission:2026-02-15T17:24:58.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106029", "uuid": "c960c94a-b286-4343-90d5-9fadcc8bb233", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106029", "to_ids": true, "type": "md5", "uuid": "720abd5d-f2b3-48db-9d75-bd18c3f0fd15", "value": "9f1950591d1f40fd24c335a2fe56cb03", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101824", "to_ids": true, "type": "sha1", "uuid": "4b5f62ce-4c61-46b4-82de-8b458bf9304a", "value": "1977753fadf4be46e340b4dcb7805e1f1649df51", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101824", "to_ids": true, "type": "sha256", "uuid": "81d4b63f-59d4-40b8-b6fa-02cc0f9f3111", "value": "690b6cf4205248a3fc5521762c69a24f46958e57621dc97b031e41ec1f381221", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100722", "to_ids": true, "type": "ssdeep", "uuid": "980e62eb-d6c8-4f16-8afe-21499e15144d", "value": "768:ZDWd6ZgAy3bgWwsTKDTagbpaG4MovYvNQAssAfS3/1+EBpup3l/0r+3OpVS1KgG2:msYll/d3p1wIF2e4inGJfUi4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100722", "to_ids": false, "type": "size-in-bytes", "uuid": "846066cc-ec03-4ee9-a981-f512cca9e2ab", "value": "55800" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100722", "to_ids": true, "type": "vhash", "uuid": "145fcdfc-cdab-4095-a0da-ac6efbd40e86", "value": "5e19c7d5d1a177463d690de60adb4816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100722", "to_ids": true, "type": "filename", "uuid": "0357ebaf-473a-4491-ae93-2f718eb8a675", "value": "BgamlQB2jR5" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100722", "to_ids": false, "type": "text", "uuid": "85a170c5-e3e8-4d76-87c3-14590528bdae", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:24/60\nFirst Submission:2026-02-15T12:05:23.000000+00:00\nLast Submission:2026-02-15T12:05:23.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106050", "uuid": "bf3020fc-c681-4a26-b43c-d2de845e0815", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106050", "to_ids": true, "type": "md5", "uuid": "dccd53f8-47ad-4eca-a1db-f7a8697d03c7", "value": "b5f0a148f0608800150d0852de7781bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101826", "to_ids": true, "type": "sha1", "uuid": "54a9f219-2c9e-462a-bdd1-10f7c2266611", "value": "bde432404084c75da8bda13ab4ac7b445f66f284", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101826", "to_ids": true, "type": "sha256", "uuid": "753f842b-52f5-48cb-89a6-4dfa08828ced", "value": "dc3c1616b70ab3a8b9c25e46fa00f04e18364909ca7ed5b2698f58918e0ccef3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100743", "to_ids": true, "type": "ssdeep", "uuid": "1acd90c8-9f76-4858-8451-60873cb47167", "value": "49152:xHIreyYbnvxHpOAMHXwi+RpTxLMntEpiRX7Or:q6nbnvxHpO5wVTRMF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100743", "to_ids": false, "type": "size-in-bytes", "uuid": "694d704e-8b7a-44dd-acab-7d0aebb50dc9", "value": "2264576" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100743", "to_ids": true, "type": "vhash", "uuid": "1f5268b9-3008-41e7-a39e-78aebc061caf", "value": "1260766d55651d151551z52z11001b0a5zd7z62z22ezf" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100743", "to_ids": true, "type": "filename", "uuid": "b970f313-d402-4a41-b64f-da8de977ab88", "value": "fagf6r.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 17/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100743", "to_ids": false, "type": "text", "uuid": "f75dca67-276f-4734-a130-f8172221d953", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:28/69\nFirst Submission:2026-02-15T15:49:28.000000+00:00\nLast Submission:2026-02-15T15:49:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106071", "uuid": "4f3cb2e9-555d-466e-89dc-05486e58d503", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106071", "to_ids": true, "type": "md5", "uuid": "5ce8a07b-22e9-48f7-8a2a-48aac930c39f", "value": "e2b789bf39ba132ce56d3d97c28b5ff2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101826", "to_ids": true, "type": "sha1", "uuid": "db7cac70-5c5a-4384-95a6-4fbec9d01fb3", "value": "bedb38c9a40b2dc2486fe8f4a68911c3632d23ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101827", "to_ids": true, "type": "sha256", "uuid": "11a9ad6d-4d37-42a3-8727-3bd408772635", "value": "a07ddb6d55f122b056d594fd2efaadacdcb2eab6f65e6f0766684773300a7859", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100766", "to_ids": true, "type": "ssdeep", "uuid": "b8865ad2-068a-4d0d-8892-20f279aef68a", "value": "96:ZUEY1GCRlgZVeF6iJEOosfDr4QMGhGelsR/sXzJ5O:a1lRsVehasfDdlsNsXV5O" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100766", "to_ids": false, "type": "size-in-bytes", "uuid": "962cbb77-033c-467a-8812-3f50a5eeac91", "value": "6005" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100766", "to_ids": true, "type": "vhash", "uuid": "37656f28-0b9e-4f62-a84c-b4295351902d", "value": "b4a35301b14594aeb005db54e4ddb93c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100766", "to_ids": true, "type": "filename", "uuid": "4e801006-a2fe-4a1f-993c-d1429fef04c7", "value": "QLrAh" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100766", "to_ids": false, "type": "text", "uuid": "81309b91-e327-4de9-be05-5a879a02bdeb", "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:24/60\nFirst Submission:2026-02-15T12:05:24.000000+00:00\nLast Submission:2026-02-15T12:05:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106092", "uuid": "6eea3504-b253-4794-8438-af30a020a4d8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106092", "to_ids": true, "type": "md5", "uuid": "d82ea5f5-caa4-42c5-8d65-4807d7cca8ef", "value": "e8950c794ef31f444bc1f9768c5fc4d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101828", "to_ids": true, "type": "sha1", "uuid": "a927591c-924a-477d-be6a-982d6d18c938", "value": "a0951e69af5b361e7c2d7f4144b9028b91be434e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101828", "to_ids": true, "type": "sha256", "uuid": "a22bb4d1-0035-4380-a58f-280cae12589c", "value": "9422d19bca175bf0727336b6ed5bef01c81e5a80dfdaebf4d7cde9ebfb4ef44e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100788", "to_ids": true, "type": "ssdeep", "uuid": "7d6ba948-64c0-4432-8f78-337784d201c3", "value": "49152:YhAbslubnopB7v9Cxg8vE8oCDnGHtpHF0rJITOTY2I/sdZ+N35gpIK7ICQ2UiTkH:GYsTx9Cxgu5e8FZ+sLNfNN4YcrK8x7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100788", "to_ids": false, "type": "size-in-bytes", "uuid": "508b03cd-5276-48c9-a917-2cece06b41f5", "value": "4424704" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100788", "to_ids": true, "type": "vhash", "uuid": "0a387bfa-cc18-429f-b5f2-d50d3c18b4a3", "value": "1460766d55755d151551z501001800290f4z137zd2z16eze" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100788", "to_ids": true, "type": "filename", "uuid": "2941de6a-189c-4cb4-9337-0ba066de9700", "value": "mMLCQC6iaO" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100788", "to_ids": false, "type": "text", "uuid": "207668a1-9de0-42bd-b47e-47cfba3cf101", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:45/70\nFirst Submission:2026-02-15T17:43:24.000000+00:00\nLast Submission:2026-02-15T17:43:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106113", "uuid": "64b76e88-2aac-4159-bef1-ad5b7486031c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106113", "to_ids": true, "type": "md5", "uuid": "a39f29f7-de6c-4919-b989-0d9c0d247fb9", "value": "ecd2b847349f7b1e55cab2c1b25a3dcb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101829", "to_ids": true, "type": "sha1", "uuid": "13eeb72e-e981-4d15-ab9b-555391ef75b5", "value": "78a57ffcf84c2e0e2f779f65cfd92379bee3858d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101829", "to_ids": true, "type": "sha256", "uuid": "6fa654b9-7f13-4849-b290-d94f3a493ddb", "value": "8e2a3f32479404e195db7dbfd6ae3117122db0fcedccf7fe6abb087763f3ecf2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100809", "to_ids": true, "type": "ssdeep", "uuid": "94005b2b-a3ea-45a9-a102-42aceb30f0f5", "value": "98304:RfQUAh7upr+BnCqe5AnH6gbhOyHT8uL/KT0hOpJwWCXPtht:lQUAh7upr2nCT5AH6gQuT8uL/KT0hOp0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100809", "to_ids": false, "type": "size-in-bytes", "uuid": "b2a5b225-73ba-42b0-aeee-6403028770c5", "value": "5331456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100809", "to_ids": true, "type": "vhash", "uuid": "7ab15154-9d27-4af3-a174-210d81582811", "value": "1560766d55651d1d1551z7021zc0027134z18zf2z1bez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100809", "to_ids": true, "type": "filename", "uuid": "f85390ed-1fd3-4c2f-a60c-e6b38662e4aa", "value": "7VjM3PszY" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100809", "to_ids": false, "type": "text", "uuid": "f17f3e9e-bf89-4525-b757-1ce224207a1d", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:44/70\nFirst Submission:2026-02-15T17:49:57.000000+00:00\nLast Submission:2026-02-15T17:49:57.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106134", "uuid": "c0cce067-deba-43f1-8733-3b6ffcb8fad8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106134", "to_ids": true, "type": "md5", "uuid": "51a49b4a-0325-4504-80f7-5aff2e6cfb2a", "value": "cab6a38352682632215b1d8c870424fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101830", "to_ids": true, "type": "sha1", "uuid": "6f98384a-24de-4a31-a631-6219b8c18e3a", "value": "2badf37031093424d8e63bf09a667e6915da2690", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101830", "to_ids": true, "type": "sha256", "uuid": "0027d553-ecda-46f8-b005-d051e4002669", "value": "082a6286953c0f4256751f1c9bf4c06d4c14fc63f601a78e2f70f7ebd42821cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100831", "to_ids": true, "type": "ssdeep", "uuid": "26d4a803-d23f-4611-a85b-16c1d8da6c32", "value": "384:rZlpTmZ/y4/pKENM8NpvwIyawZy/zpY2KSdCT77pvTo8v9nVyytLgOlYjLVIJ7wz:rZj65/IGMIVwIyaH/zG2HkX7p7o8v9n2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100831", "to_ids": false, "type": "size-in-bytes", "uuid": "97c5077c-5314-41e2-a1e6-f8d4b2f96218", "value": "23771" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100831", "to_ids": true, "type": "filename", "uuid": "a4c9536b-c1d2-48f6-9dde-e2282640eb35", "value": "template.txt" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100831", "to_ids": false, "type": "text", "uuid": "bab2c8aa-2703-40ca-9728-fc3916bf2a70", "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:1/60\nFirst Submission:2026-04-08T03:32:38.000000+00:00\nLast Submission:2026-04-08T03:32:38.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106155", "uuid": "f403d6fd-d7f5-49fe-8fa1-8d451714f663", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106155", "to_ids": true, "type": "md5", "uuid": "2f193ee1-9d2d-4d02-80e0-579ad773bf12", "value": "42737ec2971020f928d99baeb19f4a90", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101831", "to_ids": true, "type": "sha1", "uuid": "bf48cf55-b4a4-43ef-ac0f-08ab0074c4f8", "value": "b2cb33b7d63ef43c6004f10369215fc94f34afa4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101832", "to_ids": true, "type": "sha256", "uuid": "1a2b8f0a-6d66-4626-a542-5e2e2b5bb84f", "value": "0e13ca9e55fbe5ae323f7f295dde8d68aaca3e2c737999174691bee77525de99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100853", "to_ids": true, "type": "ssdeep", "uuid": "af9fc3ee-0442-40da-8fd0-ec85a4e8cda5", "value": "3072:a5AxiIAceMPEQT8rfIU0NcNGpquHK1Ujn:awbemtg+L" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100853", "to_ids": false, "type": "size-in-bytes", "uuid": "f86f62f7-9663-4bf0-8902-90757ad44d53", "value": "183560" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100853", "to_ids": true, "type": "vhash", "uuid": "38a1e024-8ed7-425b-9b1a-42c568cee891", "value": "0151476d6555151c0d1d17z3001726z4dz95z67z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100853", "to_ids": true, "type": "filename", "uuid": "ddfe9b89-175b-4e1d-832b-23b639bc5ce1", "value": "honchos" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100853", "to_ids": false, "type": "text", "uuid": "e5806ee6-c674-4436-b57c-fb26df8fdcaf", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/ClearFake.B\nVT Total Detection:43/70\nFirst Submission:2024-11-13T00:28:57.000000+00:00\nLast Submission:2024-11-17T18:22:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106176", "uuid": "de7163df-d59b-4f61-a148-f5cf57d3f490", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106176", "to_ids": true, "type": "md5", "uuid": "c13858dd-5b45-45c1-a51f-8a1b960556d9", "value": "3dc3aa7848c00cc8b4891595f60858d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101832", "to_ids": true, "type": "sha1", "uuid": "16129909-55df-4154-a714-25f6e13f7db5", "value": "407553ebeb5ef02774154c2ca64ccf9e865462e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101832", "to_ids": true, "type": "sha256", "uuid": "ef07144b-4a4f-44cb-9139-53b387a71691", "value": "0edfad6a8b34b2b419fd254a99394b8f2303d144dbeba7148ef5343e2929fe76", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100875", "to_ids": true, "type": "ssdeep", "uuid": "f186c692-79ea-489c-b018-5f1aa0b069b9", "value": "12288:bF7fqE6hQDZsYdTbmZPs1bQTNY203dalz:bF7iE0ghtCZPs1b86Bdiz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100875", "to_ids": false, "type": "size-in-bytes", "uuid": "7e18feb6-9107-4621-9eb4-024752719d9f", "value": "524288" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100875", "to_ids": true, "type": "vhash", "uuid": "17165a23-8e4f-43e4-ba15-77b6d3bebf50", "value": "155066655d15551516z211zdnzbez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100875", "to_ids": true, "type": "filename", "uuid": "aef16cb9-1ec1-4149-b476-2278aea43441", "value": "alphasecurity.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100875", "to_ids": false, "type": "text", "uuid": "2201c500-45cb-40c7-a1ad-0e75a132074f", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:45/70\nFirst Submission:2025-11-26T19:57:52.000000+00:00\nLast Submission:2025-11-26T19:57:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106197", "uuid": "580388e4-100c-403d-b049-1ab8a39e9d33", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106197", "to_ids": true, "type": "md5", "uuid": "e1e9c702-02cb-4a2f-b3ba-1611300dccb5", "value": "6ca0726661e16febede88259542405aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101834", "to_ids": true, "type": "sha1", "uuid": "cbdc7882-1646-47ef-81b7-dfb98c5ed96f", "value": "d15e1021ad394e624a8b568808fb5cd631f7f666", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101834", "to_ids": true, "type": "sha256", "uuid": "d22088bf-d179-41cc-be9e-144169f338eb", "value": "12b86190ab3fb916b8901d82fbe996f43417ffa5736df5294a63a440758f158e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100918", "to_ids": true, "type": "ssdeep", "uuid": "25ef5411-9fc5-4814-b6d7-cb542ad3b1f1", "value": "12288:6j4rGogfn0MxKRUPUIB/N2PC0bR4ihe96ZedRUzsRQKOOLlpa/WAIYMBYkAaMVEi:1GZ/MzIBie9KwULK1BbJv7mQk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100918", "to_ids": false, "type": "size-in-bytes", "uuid": "affdd210-6c0d-4896-99ee-8b245bbd926b", "value": "831256" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100918", "to_ids": true, "type": "vhash", "uuid": "f8f10a94-c9b6-49ab-add7-1cda4152a99c", "value": "185066655d15555556z180051nz5ez2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100918", "to_ids": true, "type": "filename", "uuid": "a730c442-9e32-45f8-a01a-d473e8924d5c", "value": "twain_96.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100918", "to_ids": false, "type": "text", "uuid": "570d8272-1952-4c36-800e-01bb63dddc30", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Lazy!rfn\nVT Total Detection:36/70\nFirst Submission:2025-06-05T19:31:47.000000+00:00\nLast Submission:2025-06-05T19:31:47.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106218", "uuid": "5d9ced2e-754b-43c5-8ee3-3186fe64f31a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106218", "to_ids": true, "type": "md5", "uuid": "3f4b48c9-b53a-4ae3-ab8b-b6d093e55ae5", "value": "44ae246feec75b5f564b29aa1fd7e283", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101835", "to_ids": true, "type": "sha1", "uuid": "00b7dd58-4518-4348-9325-a5997811657e", "value": "cc69e479af86efe129112b507a03b2d497f907a5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101835", "to_ids": true, "type": "sha256", "uuid": "70fc6ccf-e75d-4afb-af53-d13b51b690ba", "value": "41b6815d187a9bd7284fb0919b814eaf310d55452030eb932b32b27b5c473e26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782100961", "to_ids": true, "type": "ssdeep", "uuid": "cf13212d-f447-467b-8315-9eab5b62fd2b", "value": "12288:DKua9O0OLQTRaTYQFfLbdNv5wZnfY98y8duOHl9efBV1lKO6oRr7vKaQTUaWlnJ:D3uanJfLbdNv5wZnfY2y8duOjAsO6aKe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782100961", "to_ids": false, "type": "size-in-bytes", "uuid": "701d3ba0-1467-436f-8c0b-80fbb8180dd4", "value": "629496" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782100961", "to_ids": true, "type": "vhash", "uuid": "2a4a505f-a0c4-4a44-9ae3-94e1f7a05621", "value": "165056555d055516z171z3nz3dz33" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782100961", "to_ids": true, "type": "filename", "uuid": "e29ea58d-c695-43c5-97c5-7df59d905c17", "value": "yjwa7.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782100961", "to_ids": false, "type": "text", "uuid": "c0181731-47bd-4838-89af-663377e86f7f", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:32/70\nFirst Submission:2026-04-08T15:35:59.000000+00:00\nLast Submission:2026-04-08T15:35:59.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106239", "uuid": "52c9e41b-c1f7-44e3-8982-460d7084250c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106239", "to_ids": true, "type": "md5", "uuid": "fa2d0e35-a757-461a-84e4-95df36dd1ffa", "value": "0563003ab11d053b0401740023170a85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101836", "to_ids": true, "type": "sha1", "uuid": "c5485dca-663d-414d-ae84-01d80a326ca3", "value": "b57202161938bdbe5666260bf90864399a9b66d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101836", "to_ids": true, "type": "sha256", "uuid": "7e1ceab7-aaee-4736-9066-eb55fa2b6661", "value": "4fa8d9a20ce9098eddc065cc427e3ccb035bf3306e236c17a67104d79ca040e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101004", "to_ids": true, "type": "ssdeep", "uuid": "a689c4b4-3d75-474e-b4ca-fc3bb6e4d52b", "value": "768:too8Dx+NsOu61ScMtKNmZgJpfcvh6g2BFgsQqFkGheuv04FrAo:too8Dx0bScmAm49Yh6fBFtv0yAo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101004", "to_ids": false, "type": "size-in-bytes", "uuid": "0bd85571-b8e3-4575-8fbe-26d1bf7c4695", "value": "68672" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101004", "to_ids": true, "type": "vhash", "uuid": "5c038d63-7334-4693-a9f4-8e8540113f04", "value": "31a2c89f6c46061a2d1e9f67764c1a09" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101004", "to_ids": true, "type": "filename", "uuid": "6228f1f7-c6cc-4794-a15e-dd8532118772", "value": "tbcun9d.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101004", "to_ids": false, "type": "text", "uuid": "ddb1035b-fce4-4aed-a973-c340763dadf6", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:22/63\nFirst Submission:2026-02-19T17:42:16.000000+00:00\nLast Submission:2026-02-19T17:42:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106260", "uuid": "3ad0a894-4060-4b2e-9cbc-1b77efba8d80", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106260", "to_ids": true, "type": "md5", "uuid": "f835de17-84bd-4a16-bc6e-08d4b1eb147b", "value": "fe80bedf14eea44460d2829b39806a26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101837", "to_ids": true, "type": "sha1", "uuid": "c39425b1-2a17-4c50-9f2b-823cf74fa6d0", "value": "fafcb402f10ff6d1137268dfb0308b0b0eaaaafc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101837", "to_ids": true, "type": "sha256", "uuid": "2180bd76-52c1-4bae-a035-80869e6c1d03", "value": "4fe36d2cdb90cadd834ecd6d42269e7406b439788a405bca35f0b9f7640e008a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101026", "to_ids": true, "type": "ssdeep", "uuid": "a4af445c-cdc3-438b-989f-9d67919495c8", "value": "768:HmQfAN/BkDLw7bTWub8ReLYlFGBwQVa+3LkQwRRj1O0+qGBicDXQYAz3TlEoQDo2:2AaFIs" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101026", "to_ids": false, "type": "size-in-bytes", "uuid": "d7c0657e-f5fb-4897-a061-b33d7c68dc2f", "value": "33755" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101026", "to_ids": true, "type": "filename", "uuid": "41f2d8b1-396a-4360-9de9-2c8674a3256d", "value": "documet.docx" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101026", "to_ids": false, "type": "text", "uuid": "6ceda591-f1e4-4b40-9468-b1f83e8b751f", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/Wacatac.C!ml\nVT Total Detection:2/60\nFirst Submission:2026-06-02T20:10:04.000000+00:00\nLast Submission:2026-06-02T20:10:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106281", "uuid": "b821dd70-d8fd-45ea-9b53-8fb730399d5c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106281", "to_ids": true, "type": "md5", "uuid": "1174296b-5e9f-4dae-affc-ae7bf5460a47", "value": "bb50affb3c87fb4061a59a3f64b808ac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101839", "to_ids": true, "type": "sha1", "uuid": "cde8ff8b-3d83-4f4f-8a48-966ea616469a", "value": "c2b37f4cc2928b2b59061d34bdc52756a7a4562d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101839", "to_ids": true, "type": "sha256", "uuid": "7b05dae1-26d8-458c-84b4-0e2241aefe14", "value": "5070ad8f45e6ee70e1b8a4fdbf78b2c823ca2c47a817fc29b5042b15880f92d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101048", "to_ids": true, "type": "ssdeep", "uuid": "80965498-bd6b-46e6-b9bc-d8c61ab20b9c", "value": "786432:q0mPB1IviSGQd4uCBUHvmwHlne3x0H9rHZ:tiSGoymvjne3x69r" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101048", "to_ids": false, "type": "size-in-bytes", "uuid": "b1223176-075c-4a7e-be84-4f257024660c", "value": "58371144" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101048", "to_ids": true, "type": "vhash", "uuid": "ee75b5dc-8486-4140-8f9c-85c6ced37fe3", "value": "0570f6655d55551555757az3-z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101048", "to_ids": true, "type": "filename", "uuid": "cdd4af83-c8b9-491f-b9ca-c6dd6592007a", "value": "azcopy.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 17/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101048", "to_ids": false, "type": "text", "uuid": "4389e9de-fd4a-4b5a-afbf-dfaa399cb329", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:0/67\nFirst Submission:2026-01-07T00:32:26.000000+00:00\nLast Submission:2026-02-13T18:29:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106302", "uuid": "f3417f25-6a19-4d0b-8b2f-bab204797ae6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106302", "to_ids": true, "type": "md5", "uuid": "8cbb9edb-c4af-4e18-9a2c-e0cccad6d609", "value": "a1d6bc4caba73c65c12476b72ff13aa0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101840", "to_ids": true, "type": "sha1", "uuid": "ebe4d849-f2e5-45ee-b366-50cc97887f18", "value": "56d3af47bac41801579fbc53aac05458f1672be7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101840", "to_ids": true, "type": "sha256", "uuid": "4296e1d5-1181-4744-a2fa-4171e4d9bf8d", "value": "5b7ee3d9f851363d4291689f9ac1a02e18ea024c7ab28009b032a60701639a5d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101070", "to_ids": true, "type": "ssdeep", "uuid": "bdf8d692-51ad-401b-8c9e-c94457f39db6", "value": "12288:jYgbCe+BhXJ4kSsz22dCl0uNngdrCpKd4LAywCE:j9Ge+BhZ/SGdClTngoYdBJv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101070", "to_ids": false, "type": "size-in-bytes", "uuid": "ad523dbd-d576-4ac0-8c1f-5665b573d75b", "value": "475028" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101070", "to_ids": true, "type": "vhash", "uuid": "fe4d56df-2292-4d3b-aed3-a138737041fc", "value": "1184b8ed6dfd06ea345d95c21640fecc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101070", "to_ids": true, "type": "filename", "uuid": "b99a45ce-a607-4e94-86ab-8dfa63183e5d", "value": "RLOGdaQAR" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101070", "to_ids": false, "type": "text", "uuid": "2c7f5a37-b404-4580-8403-5d54252216e3", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:13/65\nFirst Submission:2026-02-16T09:35:06.000000+00:00\nLast Submission:2026-02-16T09:35:06.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106323", "uuid": "3dae96dd-bed3-4ca5-959a-c3900515bc8f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106323", "to_ids": true, "type": "md5", "uuid": "8a30e1a5-3c2b-43e2-aa8b-6b035852b859", "value": "c4091f8f3752d06947c9f1ccbca9e5e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101841", "to_ids": true, "type": "sha1", "uuid": "cd512451-e83c-4c01-a694-715d6295d911", "value": "9dac36d3d735d66539287338691d217bc34937f3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101841", "to_ids": true, "type": "sha256", "uuid": "f4e642e4-9214-4463-bdeb-4a93e492f430", "value": "705127c9730dcdebfa0f30103952107098d164d1941c400ea1f3ff454951c225", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101112", "to_ids": true, "type": "ssdeep", "uuid": "ea2b9214-9280-4aa4-a98e-e13880f1f3d7", "value": "768:N0+NfrVZSwInhE6ONfDO2QUHTYMYr4vz2YIw3NNi9HuVLwjaiPy/L9o8v/8LJTUm:owIudNiNjkRo8vF4sZXq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101112", "to_ids": false, "type": "size-in-bytes", "uuid": "7229a778-daca-4561-9cb0-191c2c2dda89", "value": "33276" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101112", "to_ids": true, "type": "filename", "uuid": "ce041a2f-9282-442a-a9c6-596a98bd023b", "value": "documet.docx" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101112", "to_ids": false, "type": "text", "uuid": "4a5dbecb-189c-4e4d-a20f-90cfc79a1373", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/Wacatac.C!ml\nVT Total Detection:1/61\nFirst Submission:2026-04-29T20:28:18.000000+00:00\nLast Submission:2026-04-29T20:28:18.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106344", "uuid": "b320dfe4-60bf-440b-9510-a1cfff0bc4e0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106344", "to_ids": true, "type": "md5", "uuid": "e9e87c9b-6d14-4e03-92d6-598fafe29666", "value": "ab148f179e7610c0cd3332109bb9e265", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101842", "to_ids": true, "type": "sha1", "uuid": "c63f2d34-4a26-434d-b152-07bcda892a11", "value": "74c902372802933880bbe0b2a4a8682cf2a755e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101842", "to_ids": true, "type": "sha256", "uuid": "72db6c5d-a8fe-469e-9236-627213586306", "value": "7d13460fb3a6c918bd9866e1209fbcd18603304c35240f22571c432c204dc363", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101134", "to_ids": true, "type": "ssdeep", "uuid": "fa5e1089-2f4f-41ba-8e13-26aaac8438cd", "value": "98304:xnHFAzbNEjpcRaQ27v6ChaJfPSlt05HI3rNC9q9clQLiuGMeo/mNAuPzbqNe21o:xnlAz5Eia/6tf6gK3rsJymu4UCAu3qNC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101134", "to_ids": false, "type": "size-in-bytes", "uuid": "4b53bd1a-6955-4dbc-ba34-5214afd69c94", "value": "5380952" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101134", "to_ids": true, "type": "vhash", "uuid": "baffcf6f-5d18-480d-99a3-0eb6fdfca34c", "value": "a0a190469333a86b8ba263ba9d84300b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101134", "to_ids": true, "type": "filename", "uuid": "cfe10252-af71-4594-a4df-1a1753c8b764", "value": "Java.jar" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101134", "to_ids": false, "type": "text", "uuid": "856f4d5a-b21f-482d-80ab-55617f40f8ad", "value": "Type Description: JAR\nMicrosoft: None\nVT Total Detection:14/66\nFirst Submission:2026-03-19T13:56:49.000000+00:00\nLast Submission:2026-03-19T13:56:49.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106365", "uuid": "16de6521-fa49-43d2-ab4a-f5299847cf65", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106365", "to_ids": true, "type": "md5", "uuid": "2583c5f6-3f4c-4445-a695-6f183da78952", "value": "1e22ee1f8dd6655b226ccb8c476c2d59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101844", "to_ids": true, "type": "sha1", "uuid": "3cf802bf-4196-465b-b147-b39222c17dcd", "value": "948633ff0ddb9b4e48342ffee0ac6ec300570efa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101844", "to_ids": true, "type": "sha256", "uuid": "0cd3063e-d7f6-45d2-b6fd-a039aacb6024", "value": "83b32b8cf59dbd718d04749fd05f78e9ac8efdb0ffec5dc219a010f124937e6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101156", "to_ids": true, "type": "ssdeep", "uuid": "0a21d84d-4c71-46b6-bde4-7d0a6de43da6", "value": "24576:AEzuPGlLQJHtmebs6M3E0ypdxTgD6ZcqcSRW1rF7pz3Hp01vqs:ZeGOHttd0ypXTeJqZRW17" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101156", "to_ids": false, "type": "size-in-bytes", "uuid": "1c774f21-d591-48d7-a70a-171f1a9435f8", "value": "1662464" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101156", "to_ids": true, "type": "vhash", "uuid": "c5da77dd-e6cd-4f19-8579-11a3d1ac48cc", "value": "1160766d556555151551z53z600290b5z77z72z14eze" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101156", "to_ids": true, "type": "filename", "uuid": "766436a5-86cc-460c-be6e-cf7ddc425309", "value": "Apps.conf.txt" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 18/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101156", "to_ids": false, "type": "text", "uuid": "754b56ad-7489-485a-bbe7-45c3be55fdba", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:26/70\nFirst Submission:2026-06-11T21:10:28.000000+00:00\nLast Submission:2026-06-11T21:10:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106386", "uuid": "82ebcc20-5b15-43d2-aedf-32b1c9409a03", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106386", "to_ids": true, "type": "md5", "uuid": "a4637b09-4389-4c79-818d-eee7c8653087", "value": "9864968b7f6eacaa9edf43500801ce5d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101845", "to_ids": true, "type": "sha1", "uuid": "bfb48e6b-3d5f-43b1-b697-214239ae10d9", "value": "7838a04a21d9bb9eab3ad3960322359e073512d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101845", "to_ids": true, "type": "sha256", "uuid": "5f44674a-5475-4c20-abe3-727419d4c0f1", "value": "84d824231a73df2bfb1793d251f69b30fe32bba0693ff6471ac410dedbdd1d9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101178", "to_ids": true, "type": "ssdeep", "uuid": "c2199bb9-8850-42b4-8755-3499849bbe6e", "value": "96:eLaCQ48O1wpWy5iowQmccmM4x3UtHMXUbbJEN6jH3N+8:XCf8O6bi/QmccmM4xQHMiJEN6jHdR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101178", "to_ids": false, "type": "size-in-bytes", "uuid": "fe0023b9-08e6-4cb3-a398-14935f089037", "value": "4202" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101178", "to_ids": true, "type": "vhash", "uuid": "146f5ad4-5311-495f-b934-72e4e1150a53", "value": "703bbc4ba8c8221a8d2c886136997052" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101178", "to_ids": true, "type": "filename", "uuid": "063cbeda-3064-46a8-a049-cb843c999b78", "value": "oA9hPq" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101178", "to_ids": false, "type": "text", "uuid": "031285bc-392b-4ca3-b85f-43fdb681f880", "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:5/60\nFirst Submission:2025-11-21T12:11:18.000000+00:00\nLast Submission:2026-03-04T09:40:40.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106407", "uuid": "40f09e13-7ff4-4328-af7a-0cb8bb92893d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106407", "to_ids": true, "type": "md5", "uuid": "6167587a-7935-4ddf-ab58-9d97d7426574", "value": "4e5b77c8a0afbda7c1c45ef908c3e22d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101846", "to_ids": true, "type": "sha1", "uuid": "7f2aaf81-bae4-4442-8715-25defd1552df", "value": "ac828d639876693ee06ea96fe4a7f9f7ee6e286d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101846", "to_ids": true, "type": "sha256", "uuid": "e9c0ada8-8901-4155-87e0-34c6b3b49ade", "value": "85b8522ab6252a67c812bcfbe3adce392ce715b14cdeaf34d5102d3634d69433", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101199", "to_ids": true, "type": "ssdeep", "uuid": "10c1c9c9-8119-4bb4-bb6f-de4c4e3db718", "value": "768:yUeubF4F2ghPltrdsjCCKtmqdfz80Tby6s9iadQBzX1wQfhiWZ4i4C7L91fUBiMQ:1668xqrCD/tf3YP6qlTC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101199", "to_ids": false, "type": "size-in-bytes", "uuid": "174faa76-5085-4e72-8a3b-7243452d9ba8", "value": "34126" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101199", "to_ids": true, "type": "filename", "uuid": "76b21c66-62f3-4a05-8b00-8e08da9d7b15", "value": "template.txt" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101199", "to_ids": false, "type": "text", "uuid": "93f87ead-314b-4fdf-aedf-36c96a5b59cd", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/Wacatac.C!ml\nVT Total Detection:2/60\nFirst Submission:2026-03-16T19:29:56.000000+00:00\nLast Submission:2026-03-16T19:29:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106428", "uuid": "769aafe9-aeec-4432-9abe-f43481d4ac73", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106428", "to_ids": true, "type": "md5", "uuid": "82921d2a-d2a1-4b4d-a93b-bcdb6cfaa54d", "value": "2179ca6334259b549863763f6ad35a3b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101847", "to_ids": true, "type": "sha1", "uuid": "0ce6a9ac-bdde-4d84-9b8b-e2a03c40cbb2", "value": "827a34563a46d04bd1a1e4c6c6d38b9e1e7a474d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101847", "to_ids": true, "type": "sha256", "uuid": "45052adf-558d-474d-aaae-ad6d844738ae", "value": "89759f741606e3e9e3004978c08a3d8f5d8a887f13dd749c6a3653d9db9283df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101221", "to_ids": true, "type": "ssdeep", "uuid": "09c17c0f-9ddd-4b8d-a3c0-fbca99e9ba20", "value": "196608:rHxcp9ym3nltDUJVJHxcp9ym34Hxcp9ym3cHxcp9ym3bHxcp9ym3nHxcp9ym34Hk:1GplpSGpGGp6GplGpRGpGGp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101221", "to_ids": false, "type": "size-in-bytes", "uuid": "ce8fd6db-d846-4938-acc1-1e4eacc87850", "value": "13447168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101221", "to_ids": true, "type": "vhash", "uuid": "3a242bd4-e792-436a-8358-940619628976", "value": "45155b83172cd3ff230fec9025027227" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101221", "to_ids": true, "type": "filename", "uuid": "fb8e256e-2b23-4771-8803-c41835a29d45", "value": "33YE" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101221", "to_ids": false, "type": "text", "uuid": "0c72521c-fc1d-4ece-99e5-13f8564a1d0b", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:30/61\nFirst Submission:2026-02-15T17:30:23.000000+00:00\nLast Submission:2026-02-15T17:30:23.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106449", "uuid": "30d15744-cb76-40a3-a63d-5865b9d43d4d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106449", "to_ids": true, "type": "md5", "uuid": "eddc3715-b2be-4ac5-9aa5-df5e684dfadc", "value": "c9dd39ca17829449d8990c17dc0191b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101849", "to_ids": true, "type": "sha1", "uuid": "0ecb8ae6-b22f-4fc6-84ab-dc1c18235b00", "value": "993c30acf0b1f71b2476d0784a060ebe444d1f3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101849", "to_ids": true, "type": "sha256", "uuid": "b37ed017-c914-4cc5-8d51-47abeb21c010", "value": "8cc335a675f86c691ae04f31b4098fc5761d4e41abfdcbdf3c1016c9e9440490", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101244", "to_ids": true, "type": "ssdeep", "uuid": "5a9253ed-94fb-4e0a-82bf-606d70f284cc", "value": "192:K/l1HPGwpe3r4ulc04nuilB/cySw78r4Kon9:ql1HPG8K4ulc04nuilB/cySw78rkn9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101244", "to_ids": false, "type": "size-in-bytes", "uuid": "c4b8e650-f7fa-46d8-8550-e6016eae6501", "value": "14778" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101244", "to_ids": true, "type": "vhash", "uuid": "8c49708a-3ce3-480d-8710-2dfc66d1ec77", "value": "10116e5dd8ccdeb507a42f26ee1d39e1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101244", "to_ids": true, "type": "filename", "uuid": "2d234d52-7992-4b30-96fb-ad7bb946d160", "value": "mlvej.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101244", "to_ids": false, "type": "text", "uuid": "d301d5b6-5ade-40d3-b851-dde555ac99ba", "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:23/61\nFirst Submission:2026-04-01T08:37:02.000000+00:00\nLast Submission:2026-04-01T08:37:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106470", "uuid": "db469c9a-2abb-4e6b-995c-1998f2f53fc8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106470", "to_ids": true, "type": "md5", "uuid": "403ca2d4-bc8a-46d1-b619-696c63381b31", "value": "d591afed6ac70d8b47f3e5ae1fe2e63e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101849", "to_ids": true, "type": "sha1", "uuid": "8a037962-96fc-45b1-aee6-2d8981829268", "value": "fadfc3d5690aef0cc3247e7182eaced11200cde4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101850", "to_ids": true, "type": "sha256", "uuid": "c61ec2f9-4cd2-4973-9035-46c966a5fdd8", "value": "9a0b069640a404939e48af5acec26c922bae44a8fdf26444f20ee4f7989640bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101266", "to_ids": true, "type": "ssdeep", "uuid": "e2b18ed2-0815-4c1e-8564-f9ba906949ef", "value": "768:GDLRlX+bwTdG0t92P4sIzHsMpSo32kjZLgTb6jQ4XmwBqkUu0:GDPjTdGIcmFpSo32kjZQQWV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101266", "to_ids": false, "type": "size-in-bytes", "uuid": "7f52c339-1c78-48bd-b055-34119bd6e930", "value": "68488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101266", "to_ids": true, "type": "vhash", "uuid": "4cd70a09-639c-42de-8ca4-2a63b2c38f87", "value": "f096a27e51f2759f69d23ed7f1e9d7a5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101266", "to_ids": true, "type": "filename", "uuid": "d2cb7409-ed6d-438f-ae53-7a5c550579b7", "value": "cyajy4uxc.exe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101266", "to_ids": false, "type": "text", "uuid": "a618dd6e-64e9-46ea-a0f2-936833dd32df", "value": "Type Description: ELF\nMicrosoft: Trojan:Script/Wacatac.C!ml\nVT Total Detection:6/62\nFirst Submission:2026-02-17T17:33:56.000000+00:00\nLast Submission:2026-02-17T17:33:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106491", "uuid": "22c0e166-f9d6-40bc-9cac-65fb8e393289", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106491", "to_ids": true, "type": "md5", "uuid": "8d8e83ff-8431-4206-b8f1-75937a0fb95e", "value": "affe3d367b0f1a8c1fd1cf1c79469a1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101851", "to_ids": true, "type": "sha1", "uuid": "748176b7-23af-4b53-b2b2-dfe40737ce6a", "value": "ce9d7f766dc5824a093caa86940c90a1cdf92231", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101851", "to_ids": true, "type": "sha256", "uuid": "4b8e2e63-b2b2-4045-bfc7-228f5b06dd0a", "value": "a4d0ea40eb9cdcd2da83afbe4d36a634ac85c2cb6d16a83729791cadfeb1f298", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101287", "to_ids": true, "type": "ssdeep", "uuid": "120f0aed-257c-4be1-bdac-5b61f3ae8972", "value": "3072:Zn9M8UPt8n7CWqPCYueapMxEepxIYMHCoHSgPjkFS0:VG8A47FUFDapMWeLIYhoygPjwS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101287", "to_ids": false, "type": "size-in-bytes", "uuid": "902d6162-494a-4842-a6f3-642490041368", "value": "159232" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101287", "to_ids": true, "type": "vhash", "uuid": "aa968bc0-a5a5-402a-9d61-07dc8a33d1a9", "value": "115066651d05150516z221z8nzeez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101287", "to_ids": true, "type": "filename", "uuid": "b0a7516c-75c8-4c24-ae60-af6dbe78e5fe", "value": "a4d0ea40eb9cdcd2da83afbe4d36a634ac85c2cb6d16a83729791cadfeb1f298.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101287", "to_ids": false, "type": "text", "uuid": "4d7fa2be-630f-429a-bca5-a76de571b832", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Etset!rfn\nVT Total Detection:40/70\nFirst Submission:2026-03-11T21:43:25.000000+00:00\nLast Submission:2026-03-12T17:26:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106512", "uuid": "2a310af3-d0c4-4abf-86ed-c7933744f152", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106512", "to_ids": true, "type": "md5", "uuid": "5237c0fb-6b8e-4a16-8bbc-9423e12deb8b", "value": "71fa4baecafc55ad640fd35793ea5641", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101852", "to_ids": true, "type": "sha1", "uuid": "da81198c-8968-4ffc-b6d7-f5d30ffdb415", "value": "3322fb01a7c37e09891fd1ceb30bfa8ae09473d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101852", "to_ids": true, "type": "sha256", "uuid": "59a6e26f-fac3-4f2b-b567-d6948a5635fb", "value": "a9b68f8e125da256ab5fe48e3bb4a72423927d943fe7502e20915b5ad24a5bc2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101309", "to_ids": true, "type": "ssdeep", "uuid": "5862692e-372c-486e-b148-662eea41fd6d", "value": "3072:P5ndDJWXYy/cnH5tGYvRR3SodtGhD04t3omcTC3iDaUcKwlB+2wTiC6LdVGXout:P5dDGy5Y8Yoa3i9W3caUcn3TGXoS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101309", "to_ids": false, "type": "size-in-bytes", "uuid": "6db651b8-ce4e-43e3-9108-a77235adabe4", "value": "171520" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101309", "to_ids": true, "type": "vhash", "uuid": "fe1e2fed-5d0b-4977-957a-0f433abf7c2d", "value": "11503e0f7d1019z21z1dz1019z16z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101309", "to_ids": true, "type": "filename", "uuid": "cbfdf4fb-f06e-4782-8da4-ac8790699bdc", "value": "cleaninform.dll" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101309", "to_ids": false, "type": "text", "uuid": "ee9309b1-b513-45c9-b30e-e7a3a5c320e7", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/CryptInject.EC!MTB\nVT Total Detection:50/70\nFirst Submission:2024-02-21T18:30:46.000000+00:00\nLast Submission:2024-03-01T18:55:25.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106533", "uuid": "28196061-da7d-410f-8243-2526d25680d1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106533", "to_ids": true, "type": "md5", "uuid": "a3b55df6-3c78-4a9d-9a61-8e3835d19444", "value": "3f7c5879ee9e676e24e28cd2418266b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101854", "to_ids": true, "type": "sha1", "uuid": "deb31d88-64a6-4df8-ae51-dce55dbe08b4", "value": "4796428851533aed613fbe313376537141dd0f48", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101854", "to_ids": true, "type": "sha256", "uuid": "2e31a1a4-46a6-45f4-97e0-e7eaa4269ebd", "value": "b46a3f9a7917a0b0e08979f85c90ff802a3e96d23a19a8727d9d701d5e2088eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101331", "to_ids": true, "type": "ssdeep", "uuid": "cd27bed8-d41d-4daa-83ab-1e8070ba8128", "value": "1536:EvDxiLkB+wICMp5570pnzWwRxO24PTB4a:EvDxiMICMpHwRv4LB4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101331", "to_ids": false, "type": "size-in-bytes", "uuid": "c93c3bd9-c740-4f8e-ad9f-1254df59b631", "value": "65912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101331", "to_ids": true, "type": "vhash", "uuid": "1a5e1b04-6807-425d-acd2-781a3e84c566", "value": "12d6fd529252173f8f769f2e95668478" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101331", "to_ids": true, "type": "filename", "uuid": "e0127006-72a9-4c35-8ea4-9249a2b80d89", "value": "hueCe" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101331", "to_ids": false, "type": "text", "uuid": "54cdadc5-eb05-4609-a501-5c348cc777d9", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:27/63\nFirst Submission:2026-03-08T22:51:15.000000+00:00\nLast Submission:2026-03-18T20:01:18.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106554", "uuid": "2f41a02e-43b8-4779-90b9-590abf2ea4c0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106554", "to_ids": true, "type": "md5", "uuid": "f6bb5f5a-7440-4afa-b75f-6bb29e1f286e", "value": "2d26ad3663fa1cbb8ed0c555858c9dab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101854", "to_ids": true, "type": "sha1", "uuid": "2841a36a-4d8b-4b2a-9940-658cfc9e0d9b", "value": "a300c4e65302f12b56afa741244d8177ccb4cd50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101855", "to_ids": true, "type": "sha256", "uuid": "4de01049-8e8b-400d-b6fc-1afeef2b1688", "value": "b7b451db845d2fd97996e765156ab9b0a337f58957803896bef72834d8a4d158", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101353", "to_ids": true, "type": "ssdeep", "uuid": "9e994271-d8b1-4240-8ef8-93acd0e489f0", "value": "192:j/l1HPGwpe3r4ulc04nuilB/cySw78r4Kon9:zl1HPG8K4ulc04nuilB/cySw78rkn9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101353", "to_ids": false, "type": "size-in-bytes", "uuid": "2cd181e9-b6d1-44e9-aa2c-f22fbf840f8d", "value": "14780" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101353", "to_ids": true, "type": "vhash", "uuid": "dc1d7d3b-0971-4014-96fb-53ac4b74a877", "value": "10116e5dd8ccdeb507a42f26ee1d39e1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101353", "to_ids": true, "type": "filename", "uuid": "4fdfff83-923b-471f-b0e0-64e7fc473f72", "value": "8SCqrxAX" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101353", "to_ids": false, "type": "text", "uuid": "2e5823a1-a021-425d-917f-891ff708eefb", "value": "Type Description: Powershell\nMicrosoft: None\nVT Total Detection:14/64\nFirst Submission:2026-02-19T18:11:16.000000+00:00\nLast Submission:2026-02-19T18:11:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106575", "uuid": "b018dce3-d6c4-44ce-89ff-4c0b311e2994", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106575", "to_ids": true, "type": "md5", "uuid": "4912ee35-6641-4149-b95f-5acb7dab5ccd", "value": "f4d24682e67b49ba77430d3321305210", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101856", "to_ids": true, "type": "sha1", "uuid": "e0a6a5bb-3dbd-4d70-b6ad-9f95b1804426", "value": "1888e2f6f26d3589e6986cd07ab1a6d0e7d485ca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101856", "to_ids": true, "type": "sha256", "uuid": "d0e0c0de-cb72-4d4c-8638-a4c702945760", "value": "bc2b7627c5e02e5d8c6311955f1a5c09c62b511aba87b90e493c59c7d360c263", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101375", "to_ids": true, "type": "ssdeep", "uuid": "1777aa7e-9633-4863-a147-2dad3f7a6a25", "value": "384:G9q9ppbXMarr5NmNX1IH89m/bMdRV4yfxyhThCyRXomxgXnAzqaZIpOAJgHeAPVZ:Cq7ZXMaX/mNXWcM/bMvV4yfxglVGyWw1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101375", "to_ids": false, "type": "size-in-bytes", "uuid": "fd5023b7-3be0-467a-81b7-583aa1d25c2f", "value": "24450" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101375", "to_ids": true, "type": "filename", "uuid": "e8969b51-b3d3-47ae-9bcb-206be12ac126", "value": "template.txt" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101375", "to_ids": false, "type": "text", "uuid": "e3501b43-0b5a-448b-9991-95aed1e27d2d", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Script/Wacatac.C!ml\nVT Total Detection:4/60\nFirst Submission:2026-03-18T00:07:26.000000+00:00\nLast Submission:2026-03-18T00:07:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106596", "uuid": "9ab61f5d-2532-4104-910b-170cf05ec5cc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106596", "to_ids": true, "type": "md5", "uuid": "f577ca5f-196a-4e8f-b8ee-8c16f2c562c2", "value": "3a808046d31057efb3c1967bc6bcc367", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101857", "to_ids": true, "type": "sha1", "uuid": "974b5700-7f1e-4759-9af5-ba3e29494107", "value": "8580b5c58facc7410f125ce58b2712a6ca64bce4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101857", "to_ids": true, "type": "sha256", "uuid": "5f27bf1b-35d1-4c20-a668-67ec8e47467f", "value": "c96f1812e0a2d520e6e46e0ec6cd9ba8b5735c57847bea8634b017b7ed8dd8ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101397", "to_ids": true, "type": "ssdeep", "uuid": "c597c70a-5e89-437b-b7c8-04c7cce362a9", "value": "96:hHPBA4GJGORqWGOIjKA+23sFDuOo5oXzqUWENZl48yKW:JZNGJGMIevFDuOo0vNyj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101397", "to_ids": false, "type": "size-in-bytes", "uuid": "a8b55ae0-6204-40da-a6bc-3fa50ee316d5", "value": "4450" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101397", "to_ids": true, "type": "vhash", "uuid": "1731a1c6-70bd-4a61-8e80-5680c0634e6b", "value": "9e15659fb998d9b7d1a0fadb0099f873" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101397", "to_ids": true, "type": "filename", "uuid": "9970cf44-75db-478b-851e-02da1cb3ffe3", "value": "tEP5X63ziue" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 17/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101397", "to_ids": false, "type": "text", "uuid": "45d61705-5092-481d-8fae-edb5c2d7a051", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:0/63\nFirst Submission:2026-04-01T08:31:43.000000+00:00\nLast Submission:2026-04-01T08:31:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106617", "uuid": "1dcb77ed-7c9b-458c-9c8c-e2af4478bb1b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106617", "to_ids": true, "type": "md5", "uuid": "47ae5ebf-bb77-442c-a96e-176a2cb88f80", "value": "ce629bdbf4af58f6057efd24a5cece59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101859", "to_ids": true, "type": "sha1", "uuid": "3c1046f9-cdaa-4851-b000-72d404e60bdc", "value": "a67a1ef50ffbd674a20c635c110b5e46d0a5735c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101859", "to_ids": true, "type": "sha256", "uuid": "a497445d-acaa-4778-b3be-616ead43035f", "value": "dea7885448e9a75ab45bd0b08a01f548c37e7d012cd519c4b8a85941d359e26b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101419", "to_ids": true, "type": "ssdeep", "uuid": "815cfb1e-92ab-4554-ac2b-a07826598810", "value": "768:BlP1wYSOUoE84hsJUKxjE49qOqv3GhHGMCKhn9qHlt4xWXdBL5RsWTj//4rAhZF1:3S6GFK9V9qvsW44XT/5njZ1qIRwG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101419", "to_ids": false, "type": "size-in-bytes", "uuid": "cf782d50-03ed-45d9-8031-2e941dec9222", "value": "55374" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101419", "to_ids": true, "type": "vhash", "uuid": "0172b000-432a-448c-a306-814ddb9c6fbf", "value": "94be8e9c54c6dd54da2bc45a369a57b2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101419", "to_ids": true, "type": "filename", "uuid": "353a8fb0-9cf6-4cd6-a82f-c7255ac872d0", "value": "debug.log" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 20/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101419", "to_ids": false, "type": "text", "uuid": "89d1e8e4-5635-4624-82c2-f1b4597bf5c6", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:26/60\nFirst Submission:2026-03-25T13:09:57.000000+00:00\nLast Submission:2026-04-08T03:31:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782106638", "uuid": "20bcbf2f-b160-45fc-86ca-98ea70e6f7e0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782106638", "to_ids": true, "type": "md5", "uuid": "87d0833f-9388-4a22-be6a-bf4c7f66c4f2", "value": "d93eb26895be50d20ae557061a6a8e00", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782101859", "to_ids": true, "type": "sha1", "uuid": "ded1484d-952c-48b5-b0a1-48322995b9a2", "value": "fda6d2cfbef75843f876b38380a5ad0fcc9ab2ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782101859", "to_ids": true, "type": "sha256", "uuid": "34a31755-5c7e-486a-80e8-cfda1322b52a", "value": "ee3e0a9f2b04ebd4badd04e2ce6d4b24a1d0811c1c51e86d147d38919ef8b90f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782101440", "to_ids": true, "type": "ssdeep", "uuid": "d578f3a0-006a-43e0-bf7c-833c14b4bacc", "value": "196608:rHxcp9ym3nltDUJVFHxcp9ym34Hxcp9ym3cHxcp9ym3bHxcp9ym3nHxcp9ym3uHk:1GplpaGpGGp6GplGpRGp8Gp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782101440", "to_ids": false, "type": "size-in-bytes", "uuid": "d0b70d63-b36e-4a97-af4c-407a94635e41", "value": "13447168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782101440", "to_ids": true, "type": "vhash", "uuid": "568a5511-d29a-40ba-8fea-485511ae4e4d", "value": "45155b83172cd3ff230fec9025027227" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782101440", "to_ids": true, "type": "filename", "uuid": "6febe57a-1e1d-43be-b8bb-62307a556468", "value": "Pha377oyjk" }, { "category": "Other", "comment": "Checked: 22/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782101440", "to_ids": false, "type": "text", "uuid": "d9d49836-4272-490a-9e4a-21dd25f9d2de", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:33/61\nFirst Submission:2026-03-19T00:50:33.000000+00:00\nLast Submission:2026-03-19T00:50:33.000000+00:00" } ] } ] } }