{ "Event": { "analysis": "1", "date": "2026-06-16", "extends_uuid": "", "info": "[Threat Intel] Gamers beware: malicious wallpapers on Steam found stealing accounts", "protected": false, "publish_timestamp": "1782352624", "published": true, "threat_level_id": "3", "timestamp": "1782352624", "uuid": "51c79e71-685f-4c88-b907-1579de218020", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#9c8729", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#4985d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"", "relationship_type": "" }, { "colour": "#e76389", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hide Artifacts - T1564\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#d4fd6f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"", "relationship_type": "" }, { "colour": "#c9dbdd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Stage Capabilities - T1608\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#ad5a96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hijack Execution Flow - T1574\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#57b2ae", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"", "relationship_type": "" }, { "colour": "#a05856", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"", "relationship_type": "" }, { "colour": "#50bcaa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#098efb", "local": false, "name": "misp-galaxy:target-information=\"British Indian Ocean Territory\"", "relationship_type": "" }, { "colour": "#1faf16", "local": false, "name": "misp-galaxy:target-information=\"Canada\"", "relationship_type": "" }, { "colour": "#52d590", "local": false, "name": "misp-galaxy:target-information=\"China\"", "relationship_type": "" }, { "colour": "#5ed128", "local": false, "name": "misp-galaxy:target-information=\"Germany\"", "relationship_type": "" }, { "colour": "#e459c3", "local": false, "name": "misp-galaxy:target-information=\"Hong Kong\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#15cd0b", "local": false, "name": "misp-galaxy:target-information=\"Russia\"", "relationship_type": "" }, { "colour": "#7dbb86", "local": false, "name": "misp-galaxy:target-information=\"Singapore\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781665231", "to_ids": false, "type": "link", "uuid": "965255d0-be6f-4f1e-b1d1-476d55387728", "value": "https://securelist.com/dozens-of-malicious-wallpapers-found-on-steam-workshop/120186/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781665231", "to_ids": false, "type": "text", "uuid": "02524b6e-67f0-45e2-8eb0-2294c93dd6c4", "value": "Since late 2025, cybercriminals have been exploiting Wallpaper Engine, a popular live wallpaper application on Steam, to distribute malware through Steam Workshop. Attackers target primarily Chinese and Russian gamers by embedding malicious code within application wallpapers shared on the platform. These compromised wallpapers deliver various malware types including infostealers, backdoors, crypto miners, and ransomware. One analyzed sample dropped DarkKomet backdoor while hijacking Steam sessions to steal account credentials. The malware modifies system libraries to locate Steam installations and exfiltrate data to attacker-controlled servers. Compromised accounts are then used to upload additional malicious wallpapers. The diverse malware families suggest multiple independent hacking groups are exploiting this distribution method. Infected wallpapers received thousands of downloads before removal, with 89% of infections occurring in China." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781665231", "to_ids": false, "type": "text", "uuid": "a6084429-011a-4d5e-97a8-335df03ae288", "value": "Name: Gamers beware: malicious wallpapers on Steam found stealing accounts\nAuthor: AlienVault\nAdversary: \nTags: [\"account hijacking\", \"vidar\", \"wallpaper engine\", \"infostealer\", \"steam workshop\", \"lumma\", \"gaming platform\", \"renengine\", \"credential theft\", \"darkkomet\", \"crypto miner\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"Canada\", \"China\", \"Germany\", \"Hong Kong\", \"India\", \"Russian Federation\", \"Singapore\"]\nMlwr families: [\"DarkComet - S0334\", \"DarkKomet\", \"Fynloski\", \"Krademok\", \"FYNLOS\", \"Lumma\", \"Vidar\", \"RenEngine\"]\nAttack_ids: [\"T1543\", \"T1539\", \"T1547\", \"T1564\", \"T1071\", \"T1140\", \"T1562\", \"T1555\", \"T1055\", \"T1560\", \"T1608\", \"T1204\", \"T1574\", \"T1078\", \"T1027\", \"T1573\", \"T1496\", \"T1485\", \"T1518\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346619", "to_ids": true, "type": "url", "uuid": "d0e4ae21-935e-40eb-9144-ac528ac984f2", "value": "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346640", "to_ids": true, "type": "url", "uuid": "c7bf32cb-268b-4003-8cdd-c67bc811fbff", "value": "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346008", "to_ids": true, "type": "md5", "uuid": "7e466b5a-d387-4493-9462-445b8967da22", "value": "5620f01284329f561b1839a36be55355", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346009", "to_ids": true, "type": "md5", "uuid": "51eb4629-a335-4447-8d80-9a574a9ea352", "value": "74414ed4b63aadec039b603c32762b80", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346661", "to_ids": true, "type": "ip-dst", "uuid": "0fb19164-5edd-40b7-b47c-304380298062", "value": "120.48.156.17", "Tag": [ { "colour": "#7f95b7", "local": false, "name": "asn:asn=\"38365\"", "relationship_type": "" }, { "colour": "#53ae20", "local": false, "name": "asn:as-owner=\"BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd.\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346682", "to_ids": true, "type": "url", "uuid": "662c38fc-d49f-4b24-98d2-faba0f22f1bc", "value": "http://202.144.192.29/download2/Themes2.zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=JP ASN=AS63916 iptelecom global", "deleted": false, "disable_correlation": false, "timestamp": "1782346703", "to_ids": true, "type": "ip-dst", "uuid": "86814e60-e81b-4a22-8088-844ff3428e27", "value": "202.144.192.29", "Tag": [ { "colour": "#8cc040", "local": false, "name": "asn:asn=\"63916\"", "relationship_type": "" }, { "colour": "#3ed617", "local": false, "name": "asn:as-owner=\"IPTELECOM-AS-AP IPTELECOM Global\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346724", "to_ids": true, "type": "url", "uuid": "99db83ae-7209-4bb4-bd29-c45dafaba825", "value": "http://202.144.192.29/audit.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346746", "to_ids": true, "type": "url", "uuid": "a4fc92aa-db05-4a30-aa5e-caf6ce154f38", "value": "http://brightly.to/download2/Themes2.zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346010", "to_ids": true, "type": "md5", "uuid": "c0f1fa50-bf7c-432b-949e-b0ec4cce97bc", "value": "20965254e29104986e11939decd39549", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346011", "to_ids": true, "type": "md5", "uuid": "8b30db52-f97f-4f16-a9b8-5ed681c415b2", "value": "0f4f01c6d495abb37403072dd017ce8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346012", "to_ids": true, "type": "md5", "uuid": "4a812e15-22b5-4011-9b00-44143ace5eda", "value": "fe1f6485013cd5e6d5cf718049b0b8d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346766", "to_ids": true, "type": "url", "uuid": "4a00d164-a1ee-4341-bcf6-387b608bdb2d", "value": "http://202.144.192.29", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346787", "to_ids": true, "type": "url", "uuid": "9c24981d-22dc-41b9-b699-3b1800098a53", "value": "http://120.48.156.17", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346808", "to_ids": true, "type": "url", "uuid": "acbdb336-09ec-450b-992b-51b04a1f4d47", "value": "http://120.48.156.17/ey.php?ka=user1&id", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346829", "to_ids": true, "type": "url", "uuid": "28082b00-a049-42e6-b64a-a70cde207942", "value": "http://brightly.to", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346850", "to_ids": true, "type": "url", "uuid": "68ddf136-0151-4697-9743-da64877c1457", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3603213159", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346872", "to_ids": true, "type": "url", "uuid": "d9227688-85fb-43c6-8ecc-4285353a0ee0", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3591930233", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346893", "to_ids": true, "type": "url", "uuid": "c8889c51-fb3d-43a4-bf2c-517691a48b39", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3584318845", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346914", "to_ids": true, "type": "url", "uuid": "8434ab2d-adb4-4c87-9189-88da4ee4233d", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3436875036", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346935", "to_ids": true, "type": "url", "uuid": "8b32f442-0a08-4d7b-8a6d-7c69c91b017e", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3633494498", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346956", "to_ids": true, "type": "url", "uuid": "b5441201-b0cc-4dfa-b51e-755eaffff183", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3556591375", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346978", "to_ids": true, "type": "url", "uuid": "dd42b36e-4b14-4089-ba2e-c94e0063dbe3", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3635875825", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782346999", "to_ids": true, "type": "url", "uuid": "a75ed6d1-5ae5-408e-b679-db770cef949b", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3601924072", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347020", "to_ids": true, "type": "url", "uuid": "cdceca33-6cec-42ba-b0fc-b194896b9af9", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3605588743", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347041", "to_ids": true, "type": "url", "uuid": "58ade911-6ccf-4825-8917-28083af64513", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3553253793", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347063", "to_ids": true, "type": "url", "uuid": "795cda2d-cd21-488a-8298-0f1fab513108", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3462675635", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347084", "to_ids": true, "type": "url", "uuid": "5518fb6e-8918-46bb-bb63-4bbc7dbbda02", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3605621824", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347105", "to_ids": true, "type": "url", "uuid": "ad4d7e04-496f-4d1b-90a4-feebee32cb13", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3610240788", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347127", "to_ids": true, "type": "url", "uuid": "452e838f-bfde-44b6-bf37-355485033abf", "value": "https://steamcommunity.com/sharedfiles/filedetails/?id=3610366547", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782347148", "uuid": "8a4f5667-1b28-4e01-84aa-79364e62a3f2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782347148", "to_ids": true, "type": "md5", "uuid": "ab9cca5d-a938-4791-a653-040f9d23673f", "value": "c133c3dd9f7d6934598025047df41abf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782345998", "to_ids": true, "type": "sha1", "uuid": "a03beb24-caaf-4927-bc73-0801d514b1be", "value": "59868381885b33f6c8809cd3d945da7d167439a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782345998", "to_ids": true, "type": "sha256", "uuid": "09db7b96-0d55-42dc-a943-a0517157b401", "value": "fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782343682", "to_ids": true, "type": "ssdeep", "uuid": "ca6871a9-5c8e-4da8-9aab-7acee9b8b2f6", "value": "12288:0xLowk7kC0RedAM+hzUJcWOLEZ/TmELIswqq4uOQiGj2yqdieXp:0xLows+RedA3hgJcpLS/o1iGj2T5p" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782343682", "to_ids": false, "type": "size-in-bytes", "uuid": "cae35dab-0826-481f-a0f7-5726513f584c", "value": "888832" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782343682", "to_ids": true, "type": "vhash", "uuid": "8a7fa68f-67bd-49d5-aa44-60a1a48082e9", "value": "085046655d555050204005200867z6125z22z9c2z120a7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782343682", "to_ids": true, "type": "filename", "uuid": "9028fa4c-e88c-4120-be79-2214307825e1", "value": "svchost.dll" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782343682", "to_ids": false, "type": "text", "uuid": "6651494e-c519-426c-9e91-d382d68e99ab", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:52/69\nFirst Submission:2025-12-14T08:05:31.000000+00:00\nLast Submission:2026-01-02T09:22:23.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782347171", "uuid": "c0c4f91b-4bff-4577-bd44-40376cc952b9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782347171", "to_ids": true, "type": "md5", "uuid": "dfd2e8d3-0034-4a35-8aed-e852ade66b45", "value": "18dedc0009f0927cba6425c84cce9883", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782345999", "to_ids": true, "type": "sha1", "uuid": "bfb903c5-1abb-4717-87a1-e697255c5888", "value": "d4dfd361d36f5bb9d8483563e1ec81c46b34a742", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782345999", "to_ids": true, "type": "sha256", "uuid": "6c57b0b9-0dc7-4b1e-9659-2d62b6d1df0b", "value": "828cbcc61180b4064024401e7698fd1ab08348e6cea69451555b4c8851c5a585", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782343704", "to_ids": true, "type": "ssdeep", "uuid": "3e30dd96-8096-4e06-9d28-54e4151da24a", "value": "192:kV4ebjNPKt2MjGfrcm5HKB/3LT0g2dJGC+u7LzuEC6Z/jsX12Rj:64erm6r7M3Xv2deu7XuEjQX12Rj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782343704", "to_ids": false, "type": "size-in-bytes", "uuid": "35ec04a5-ab57-4568-b83c-20192f12507d", "value": "9265" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782343704", "to_ids": true, "type": "filename", "uuid": "f76c2e52-a30a-4c81-9d11-09239325c4e6", "value": "aggregatorhost__main__.pyc" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782343704", "to_ids": false, "type": "text", "uuid": "3c9771bd-1d32-4f81-98af-7f7c83b3cf46", "value": "Type Description: Python byte-compiled\nMicrosoft: None\nVT Total Detection:23/60\nFirst Submission:2025-11-18T07:23:16.000000+00:00\nLast Submission:2025-11-18T17:26:07.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782347193", "uuid": "ce0a6446-178f-485d-8222-e3269f74c0d6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782347193", "to_ids": true, "type": "md5", "uuid": "71c8fa85-9859-45d9-9373-45e2ea62bcd5", "value": "8c2cc585ad8a13a72a704c0fda0c9854", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346000", "to_ids": true, "type": "sha1", "uuid": "36687f67-58f4-4031-97ff-3a4912c575a1", "value": "f1f78656e2ab70e800f5808822600fa205507c74", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346000", "to_ids": true, "type": "sha256", "uuid": "92de2bf9-f423-438e-9eb0-8420e3beff1e", "value": "cd6253b30fefb564e8c58a1b997c81b370c2fa6e178b2d4a36faa874bd9727a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782343768", "to_ids": true, "type": "ssdeep", "uuid": "31217c35-5686-4855-a712-983365b434f3", "value": "12288:9+Dl2L37kC0RedAM+hzUJcWOLEZ/TmELIswqq4uOQiGj2yPdieXp:9+Dl6L+RedA3hgJcpLS/o1iGj2a5p" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782343768", "to_ids": false, "type": "size-in-bytes", "uuid": "271394e9-cffe-4641-bd1f-637e14827d74", "value": "888832" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782343768", "to_ids": true, "type": "vhash", "uuid": "d71752d8-fe21-45d3-8799-148c655318a8", "value": "085046655d555050204005200867z6125z22z9c2z120a7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782343768", "to_ids": true, "type": "filename", "uuid": "832fe43f-2aff-41e2-977c-f58ab5122611", "value": "win32.dll" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782343768", "to_ids": false, "type": "text", "uuid": "6f078b86-4f99-43cd-b2e4-afddceea5b01", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Detplock\nVT Total Detection:54/69\nFirst Submission:2025-11-16T14:37:41.000000+00:00\nLast Submission:2025-11-16T14:37:41.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782347214", "uuid": "c6fc3834-1eb4-41ef-a108-ae2837c5d5f8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782347214", "to_ids": true, "type": "md5", "uuid": "bdd73d4a-3b78-4e93-bdd7-56d8ad99788a", "value": "95856f2ce428c728d9781d3296558068", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346002", "to_ids": true, "type": "sha1", "uuid": "2a0fdfd3-909a-4e95-bcfc-6a17918d7ea7", "value": "35b7f2da994c99346135594418748d22e3110eb2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346002", "to_ids": true, "type": "sha256", "uuid": "c7a37683-5b79-4d4b-a63c-b10c9e4a23dc", "value": "ad545928f9efd3fe147eb464fe6f2a1a3f5bd0efb55448d534613002547ef8f3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782343790", "to_ids": true, "type": "ssdeep", "uuid": "3cf82b1d-04c4-4cf7-be0d-5aff14c9fabb", "value": "12288:4yckw77kC0RedAM+hzUJcWOLEZ/TmELIswqq4uOQiGj2yOdieXW:4yckwf+RedA3hgJcpLS/o1iGj275W" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782343790", "to_ids": false, "type": "size-in-bytes", "uuid": "d1f4de66-f571-4c4a-96fe-bde50c43c945", "value": "888832" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782343790", "to_ids": true, "type": "vhash", "uuid": "1b7ec7e8-0aa4-4e79-805e-b9732970a7eb", "value": "085046655d555050204005200867z6125z22z9c2z120a7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782343790", "to_ids": true, "type": "filename", "uuid": "d2164fc8-32f9-43a1-bc12-bdc5202dab06", "value": "win32.dll" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782343790", "to_ids": false, "type": "text", "uuid": "e2a0953e-722f-4057-94a4-aea4896bb21c", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:55/70\nFirst Submission:2025-09-06T04:21:53.000000+00:00\nLast Submission:2025-09-08T14:49:55.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782347239", "uuid": "4dae934b-9ee2-4f66-8efd-8cce8d5c5e58", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782347239", "to_ids": true, "type": "md5", "uuid": "cb2eb9ad-e45a-4416-9ca9-08c7ecc8f7eb", "value": "ded08ae5df7f1b12e5fdb767dbbed0b1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346003", "to_ids": true, "type": "sha1", "uuid": "a039aa3c-bb1b-4f3e-9bca-4f797c9eed91", "value": "2f6692ab628c3e73855aa1ee7b87a69e29b22eed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346003", "to_ids": true, "type": "sha256", "uuid": "fe939637-5387-4181-8ad5-f3a8018d509b", "value": "287cfee849fb039c74d55222db58512d597381c3c30fbd2f1bb1a2500e9a7129", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782343811", "to_ids": true, "type": "ssdeep", "uuid": "0f589348-7118-4122-bb2d-33fe5f6c4404", "value": "12288:fMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V98I:fnsJ39LyjbJkQFMhmC+6GD9v" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782343811", "to_ids": false, "type": "size-in-bytes", "uuid": "cba1eebc-7626-4951-ab80-9c892b36a04e", "value": "761856" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782343811", "to_ids": true, "type": "vhash", "uuid": "6e7c3ee6-9827-41a2-8efb-6e0e37b70d0e", "value": "0750866d5c0d5c051565603162z41z32z13z1035z23z40305bz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782343811", "to_ids": true, "type": "filename", "uuid": "3929f553-a640-4631-9e3f-2fec47a199e5", "value": "zUC7EuS1.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782343811", "to_ids": false, "type": "text", "uuid": "54e5432b-9591-4ef8-ae0e-92639613ecda", "value": "Type Description: Win32 EXE\nMicrosoft: Worm:Win32/AutoRun!atmn\nVT Total Detection:52/69\nFirst Submission:2025-09-26T21:52:29.000000+00:00\nLast Submission:2026-06-20T14:22:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782347260", "uuid": "4942fd97-8a46-452a-b613-42cef5a3b907", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782347260", "to_ids": true, "type": "md5", "uuid": "acec0865-2d18-4b3b-bc07-4b9caf26ea71", "value": "af080780cca2acd1d082ce01e7cc346a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346005", "to_ids": true, "type": "sha1", "uuid": "b1f8673c-ddb7-4f6d-be9f-4f4d0aa6b737", "value": "d84317be70d8a1e3af037aa6cf56e01a25098174", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346005", "to_ids": true, "type": "sha256", "uuid": "e3ac49ff-c4f9-4e97-bec9-0f517e61364b", "value": "348608d523b8123b5d2dde8ddd6f0aa9e23eaf85044a90d35a7dc4705ee406f3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782343833", "to_ids": true, "type": "ssdeep", "uuid": "954c0772-57b2-443a-ba43-2b3287810ebc", "value": "24576:GG+1DccaJpXvvTar+Z/EVhTZN2bRlFPUGhDnXXGR8+8Xx3:214jpXTaKiTZNgX6GtXXGR8+8Xx3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782343833", "to_ids": false, "type": "size-in-bytes", "uuid": "fd199b2a-455f-4358-9c7f-8a24ff2242e9", "value": "844612" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782343833", "to_ids": true, "type": "vhash", "uuid": "a3ff238a-f6d1-400d-8d9b-076344139df8", "value": "82c740663575558a2dd70b6057517068" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782343833", "to_ids": true, "type": "filename", "uuid": "7b5dbfa8-fb67-4324-bb42-e62c31f881b0", "value": "library.zip" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 19/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782343833", "to_ids": false, "type": "text", "uuid": "105e3d74-b76b-441c-8af1-954708aa7278", "value": "Type Description: Python Wheel package\nMicrosoft: None\nVT Total Detection:16/65\nFirst Submission:2025-03-02T02:57:39.000000+00:00\nLast Submission:2026-02-02T23:08:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782347282", "uuid": "3acf1cc2-12f3-46ec-a16b-f552e8eaa04d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782347282", "to_ids": true, "type": "md5", "uuid": "a4101ddf-28c6-44ee-b3cc-676f2ca570c7", "value": "d1693bbff456ae8fa3360446706df6da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346006", "to_ids": true, "type": "sha1", "uuid": "4e35d1fe-d99e-4176-b270-1185da83af88", "value": "d16c705513bfbe13e67d60ecaed057ba7fe7d0c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346006", "to_ids": true, "type": "sha256", "uuid": "a1402009-0bc0-4cf2-8d40-f3a084fe62f7", "value": "3ec4589bc6793f4029d52960bc87bf481570df63eb4066faaa2e167bf343dbad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782343855", "to_ids": true, "type": "ssdeep", "uuid": "b8d6299b-0d95-451f-9784-ae0a65b1fb32", "value": "12288:lT6Y0Mr5pLa5/wfgtDbQJcmPod1a1UNkcG1H9PrwMqCWSAQdUxtBjvDxnBxDn+1d:pUMrrLaRwf2QimmNkcGjw5C7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782343855", "to_ids": false, "type": "size-in-bytes", "uuid": "47c8c5ab-c74f-4776-9d47-f3ae06a94091", "value": "819200" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782343855", "to_ids": true, "type": "vhash", "uuid": "b7c60be1-93cc-408e-b437-2d2ab00770c9", "value": "085046651d555050204005200857z3035z22z9c2z120a7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782343855", "to_ids": true, "type": "filename", "uuid": "dad1468a-f673-445f-b30e-7531f60a5ee6", "value": "game1.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782343855", "to_ids": false, "type": "text", "uuid": "a6e7314c-1c7c-40c7-bf09-758d003bd581", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.A!ml\nVT Total Detection:43/69\nFirst Submission:2025-10-28T04:43:32.000000+00:00\nLast Submission:2026-01-13T14:03:48.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782347305", "uuid": "bd968210-d68c-453b-8d82-a4769d1b4831", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782347305", "to_ids": true, "type": "md5", "uuid": "e390f830-9789-4ae0-93a9-af4996c24b09", "value": "b9fa763a53da3eea742d0f3c845a8c09", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346007", "to_ids": true, "type": "sha1", "uuid": "30adb68c-ab9c-495f-89fb-88711f7afe0c", "value": "08cd724f90966cee626d72b354837ff47105a893", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346007", "to_ids": true, "type": "sha256", "uuid": "1c797537-a2c4-4940-9fb5-1d888a411988", "value": "0d9d31e08560618d3c39c1a34dcbf7801eb1c745500b8d8c009592b8a2a79296", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782343877", "to_ids": true, "type": "ssdeep", "uuid": "b0c7752b-df31-4d35-900f-f77a7738ba41", "value": "24576:GnsJ39LyjbJkQFMhmC+6GD9FBMcbbKBQvkAiWMNkcm0SSK/:GnsHyjtk2MYC5GDjlPeAiJy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782343877", "to_ids": false, "type": "size-in-bytes", "uuid": "0f0d6838-272b-4756-926e-acfb27821525", "value": "1581056" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782343877", "to_ids": true, "type": "vhash", "uuid": "bab3b90f-cefa-42d0-86ac-31b933ec21cd", "value": "0160866d5c0d5c051565603162z41z32z13z1035z23z40305bz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782343877", "to_ids": true, "type": "filename", "uuid": "63277ac9-a819-47fc-9624-7548c33ebe0f", "value": "GAME.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782343877", "to_ids": false, "type": "text", "uuid": "d557fea5-d89b-42e1-b275-1cd96fff2fd1", "value": "Type Description: Win32 EXE\nMicrosoft: Worm:Win32/AutoRun!atmn\nVT Total Detection:45/69\nFirst Submission:2025-11-29T00:46:00.000000+00:00\nLast Submission:2026-01-24T10:08:09.000000+00:00" } ] } ] } }