{ "Event": { "analysis": "1", "date": "2026-07-16", "extends_uuid": "", "info": "[Threat Intel] Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaign", "protected": false, "publish_timestamp": "1784588140", "published": true, "threat_level_id": "2", "timestamp": "1784588140", "uuid": "567b7fce-6874-49ad-b693-a20dcc8baeca", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#7c6ad9", "local": false, "name": "misp-galaxy:producer=\"Cisco Talos Intelligence Group\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Asynchronous Procedure Call - T1055.004\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#5ed128", "local": false, "name": "misp-galaxy:target-information=\"Germany\"", "relationship_type": "" }, { "colour": "#9f5dac", "local": false, "name": "misp-galaxy:target-information=\"Romania\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Venezuela\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"MobaXterm\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784257230", "to_ids": false, "type": "link", "uuid": "ae6e0f27-3683-48aa-afce-7f9c6c999e49", "value": "https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784257230", "to_ids": false, "type": "text", "uuid": "0dca5caf-e7bf-46e6-aa1b-5bb0d5a60f1e", "value": "A sophisticated Russian-speaking financially motivated adversary designated UAT-11795 has been conducting malicious operations targeting users in the United States and Europe since June 2025. The campaign delivers a Python-based remote access tool called Starland RAT and a PowerShell-based command-and-control memory implant known as the WLDR agent. The actor distributes trojanized installers disguised as legitimate software including MobaXterm, WebEx, Zoom, DBeaver, and FACEIT through likely ClickFix social engineering techniques. The operation targets victims' credentials and cryptocurrency wallet assets while establishing persistent connections for additional payload delivery. Alternative payloads include CastleStealer and Remcos RAT. The infrastructure utilizes distributed staging and C2 domains, Telegram bots for notifications, and a Polygon smart contract as a fallback mechanism for C2 domain resolution. The WLDR agent features encrypted beaconing, task queuing, and a Runspace execution engine for exe..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784257230", "to_ids": false, "type": "text", "uuid": "faca21a0-2508-455c-998f-de2d4d0cec46", "value": "Name: Novel Starland RAT and bespoke WLDR C2 implant deployed in financially motivated campaign\nAuthor: AlienVault\nAdversary: UAT-11795\nTags: [\"credential harvesting\", \"trojanized installers\", \"python rat\", \"powershell implant\", \"starland rat\", \"clickfix\", \"wldr agent\", \"castlestealer\", \"remcos rat\", \"cryptocurrency theft\"]\nTgtd countries: [\"United States of America\", \"Germany\", \"Romania\", \"Venezuela, Bolivarian Republic of\"]\nMlwr families: [\"Starland RAT\", \"WLDR agent\", \"CastleStealer\", \"Remcos RAT\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1033\", \"T1056.001\", \"T1573.001\", \"T1082\", \"T1140\", \"T1036\", \"T1555.003\", \"T1090\", \"T1083\", \"T1055.004\", \"T1204\", \"T1059.001\", \"T1547.001\", \"T1566\", \"T1562.001\", \"T1027\", \"T1059.003\", \"T1071.001\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784257230", "to_ids": false, "type": "threat-actor", "uuid": "7053ab39-b1b6-4b16-a77a-f951084e3a27", "value": "UAT-11795" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586660", "to_ids": true, "type": "domain", "uuid": "4b850698-387a-428e-a957-3d192ce57a4f", "value": "windowscreenrepairnearme.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586682", "to_ids": true, "type": "ip-dst", "uuid": "0cfd64e3-9f5c-4b20-a6d6-3cce04715fba", "value": "193.149.176.254", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586703", "to_ids": true, "type": "ip-dst", "uuid": "ce8658e4-eb5c-49d2-a4ca-bdd48dd39194", "value": "74.114.119.201", "Tag": [ { "colour": "#184a1a", "local": false, "name": "asn:asn=\"215724\"", "relationship_type": "" }, { "colour": "#426d5e", "local": false, "name": "asn:as-owner=\"EDGEVANA-AS-RP\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586724", "to_ids": true, "type": "domain", "uuid": "e42f26f4-3dcd-4918-b910-9552dfcfb5e0", "value": "zynaris.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585111", "to_ids": true, "type": "sha256", "uuid": "34267661-b4e9-480f-aed7-605bf1cd3a37", "value": "162e436f18fe6099c57855c8d63fd747493624e87702dc749b242eb9a6b758ca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585113", "to_ids": true, "type": "sha256", "uuid": "34464fb6-627e-4f37-8e4f-6a4977b25b4b", "value": "17e41d66ebfd56edc960f58f4285697ceceaa812514bb15092672c747979896e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585114", "to_ids": true, "type": "sha256", "uuid": "52337b28-bbea-4637-88b0-b5f471b2b4a9", "value": "1b46f761719dce44baa2d7b417c5214fc41c080f7f9ba485e7e489d949097f1f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585115", "to_ids": true, "type": "sha256", "uuid": "388bb613-e63b-4cac-955f-4975014a191c", "value": "2a27b3415114b874da295c19cce5227a8b8d9525cc2da331034a1f45528eecae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585116", "to_ids": true, "type": "sha256", "uuid": "359087e2-73ae-47d4-8818-34df0bb1d9d5", "value": "47dedb08385449d48d8b6543030310317c92cddafa25e14ee0cb9a32d53ced5c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585117", "to_ids": true, "type": "sha256", "uuid": "81a1603a-b885-4dee-a94c-cc9c6ba8a38b", "value": "d52540621dec5ed56cac8532f0e4fe10a7575c3e17e984f59646909fa587dd35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 21/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784585118", "to_ids": true, "type": "sha256", "uuid": "8607c946-47bc-44ce-873a-e99a91163121", "value": "f8da52ff98e66b137b5d31908f0a5d0fa1eb446034337f8bba3d5bba60f586be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586745", "to_ids": true, "type": "url", "uuid": "18195982-37bc-4c80-a3e5-c00de730a0cf", "value": "https://eorthopaedics.com/feed/cew78zwvd2/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586766", "to_ids": true, "type": "url", "uuid": "0a7049ae-d851-44bc-9a09-7c765492fb2a", "value": "https://eorthopaedics.com/feed/gnsmetadyx54/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586787", "to_ids": true, "type": "url", "uuid": "813ea510-823d-4072-949d-98b661992ae0", "value": "https://eorthopaedics.com/feed/note", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586808", "to_ids": true, "type": "url", "uuid": "1a2cb9b7-e2b6-4e68-a10a-ad8aa7f106c5", "value": "https://sastoro.com/alpha/dpyb8w3ycih8/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586830", "to_ids": true, "type": "url", "uuid": "27c4f0bc-7df6-4370-861a-078654c0059e", "value": "https://sastoro.com/alpha/nrpilqjnut/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586851", "to_ids": true, "type": "url", "uuid": "e62350df-c0c4-4218-bdb6-6895b2deedd3", "value": "https://web-devtools.com/dopfile", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586872", "to_ids": true, "type": "url", "uuid": "9cd05849-42af-4025-8699-a91c9c85ae6d", "value": "https://web-devtools.com/file.zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586894", "to_ids": true, "type": "url", "uuid": "1362e631-a14b-47c1-9879-31ff05056743", "value": "https://web-devtools.com/starlandfox", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586915", "to_ids": true, "type": "url", "uuid": "ce9fdb5e-5f53-42c2-8d74-f287089fe49d", "value": "https://web-devtools.com/x32remka", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586936", "to_ids": true, "type": "url", "uuid": "3c74d6a0-9242-42d7-90b3-b56aa9bfe69b", "value": "https://windowscreenrepairnearme.com/command", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586957", "to_ids": true, "type": "domain", "uuid": "4c39823a-23d5-4e27-84bf-937c37e60c00", "value": "aipythondevs.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586978", "to_ids": true, "type": "domain", "uuid": "e9f0b195-ecfd-428f-85dd-825e5b74ffe8", "value": "alphabitcapital.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784586999", "to_ids": true, "type": "domain", "uuid": "319af1f3-10e9-4986-bea7-7156d206d6f6", "value": "eorthopaedics.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587020", "to_ids": true, "type": "domain", "uuid": "d0e33d2c-fa13-4668-9ba4-3213ff09c47e", "value": "niggerdemon.in", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587041", "to_ids": true, "type": "domain", "uuid": "bb9c8717-62e6-45ad-bebd-ac34d760746d", "value": "sastoro.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587062", "to_ids": true, "type": "domain", "uuid": "1dc3fa6a-b012-43e8-b1cc-eb404166a7f1", "value": "web-devtools.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587083", "to_ids": true, "type": "ip-dst", "uuid": "b3648c36-3406-4c97-8229-3a9179eb199b", "value": "104.248.233.104", "Tag": [ { "colour": "#c2074e", "local": false, "name": "asn:asn=\"14061\"", "relationship_type": "" }, { "colour": "#d7952a", "local": false, "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587105", "to_ids": true, "type": "ip-dst", "uuid": "abe302bd-9711-4ded-93d1-43ffdd92c1fa", "value": "192.81.216.250", "Tag": [ { "colour": "#c2074e", "local": false, "name": "asn:asn=\"14061\"", "relationship_type": "" }, { "colour": "#d7952a", "local": false, "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587127", "to_ids": true, "type": "ip-dst", "uuid": "45c3997b-0da1-45fb-bf17-4fe6dcccfd0e", "value": "178.255.126.39", "Tag": [ { "colour": "#57fb9f", "local": false, "name": "asn:asn=\"56694\"", "relationship_type": "" }, { "colour": "#3e3478", "local": false, "name": "asn:as-owner=\"SMARTAPE\"", "relationship_type": "" }, { "colour": "#fdd220", "local": false, "name": "asn:as-country=\"RU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587148", "to_ids": true, "type": "ip-dst", "uuid": "fed224dd-cfdd-4f62-9621-532f139dec91", "value": "185.238.191.234", "Tag": [ { "colour": "#227569", "local": false, "name": "asn:asn=\"213702\"", "relationship_type": "" }, { "colour": "#e1d314", "local": false, "name": "asn:as-owner=\"QWINS-LTD QWINS AS-SET: ~ # AS213702:AS-CUSTOMERS\"", "relationship_type": "" }, { "colour": "#e1449b", "local": false, "name": "asn:as-country=\"GB\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united kingdom\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587169", "uuid": "1b58c87f-cc2f-4225-9631-33a637cb1712", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "object_relation": "md5", "timestamp": "1784587169", "to_ids": true, "type": "md5", "uuid": "0a479562-934e-4ef8-8e8d-90e002838d99", "value": "c33f097fdb2b69b4cbb1c3f29ae88b43", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "object_relation": "sha1", "timestamp": "1784585084", "to_ids": true, "type": "sha1", "uuid": "fb0723c7-9385-45a8-9b16-5c7e05343b10", "value": "650e751e8ee5f5958c6a70288a24a4e3d19904a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "object_relation": "sha256", "timestamp": "1784585084", "to_ids": true, "type": "sha256", "uuid": "da6c6147-9e8a-4d39-ad26-1595f804646f", "value": "a6821c7e9bfe2e6af0f690d906ec6a26161e2198c256fb60f3b4731c317f3ad9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "object_relation": "text", "timestamp": "1784583827", "to_ids": false, "type": "text", "uuid": "508b191d-93db-4e2b-8f9d-3a97aa0d29d4", "value": "Type Description: HTML\nMicrosoft: None\nClamAV: Html.Downloader.Agent-10060314-0\nVT Total Detection: 34/74\nFirst Seen In The Wild: 2025-08-23T12:02:01+00:00\nFirst Submission: 2025-08-23T11:27:24+00:00\nLast Submission: 2025-08-23T12:11:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "object_relation": "ssdeep", "timestamp": "1784583827", "to_ids": true, "type": "ssdeep", "uuid": "b4f68007-db54-40a2-a28c-2de598531618", "value": "48:5vZmUlqL01FbGM+F3A0oFiyfjA+S+oOmxpzT:5hnlbMynLgf" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583827", "to_ids": false, "type": "size-in-bytes", "uuid": "f968c945-d1c2-4c4f-a7b1-5610555c24c0", "value": "2093" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "object_relation": "vhash", "timestamp": "1784583827", "to_ids": true, "type": "vhash", "uuid": "1032dcf9-636d-4e1f-9441-232fbc71d992", "value": "2ba8698b79439589fdd2b0f7218d8b07" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-08-23T11:27:24+00:00", "last_seen": "2025-08-23T12:11:38+00:00", "object_relation": "filename", "timestamp": "1784583827", "to_ids": true, "type": "filename", "uuid": "714277d7-e1a0-443d-a0d6-957f2a9969da", "value": "1045697156.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587190", "uuid": "75bdd47b-8de2-464f-bc7d-5feba7b34ad0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "md5", "timestamp": "1784587190", "to_ids": true, "type": "md5", "uuid": "01a36b4e-987e-4a29-b0af-87e1417aa3d0", "value": "3ebda340fb53eb683b7c9abadf72c9f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "sha1", "timestamp": "1784585085", "to_ids": true, "type": "sha1", "uuid": "b0e4920f-418f-4501-bfc6-8ed44b92bfaa", "value": "566c16fefa42b4a2500e902a254f6eb1d1fd84f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "sha256", "timestamp": "1784585085", "to_ids": true, "type": "sha256", "uuid": "5c6f4420-417c-4683-86a7-810a3adbef8a", "value": "1a01ad25712d306f27f526332fdccf959f2de53207b54e4e80f60faa804d6cb6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "text", "timestamp": "1784583891", "to_ids": false, "type": "text", "uuid": "3af63aa5-65f2-41c5-8300-a7b638f1638d", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 20/74\nFirst Submission: 2026-04-22T13:30:49+00:00\nLast Submission: 2026-04-22T13:30:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "creation-time", "timestamp": "1784583891", "to_ids": false, "type": "datetime", "uuid": "018352af-3763-4fc4-b342-fbb91be19bef", "value": "2016-07-25T00:55:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "ssdeep", "timestamp": "1784583891", "to_ids": true, "type": "ssdeep", "uuid": "9318bf3c-d1bd-479f-8a8f-1c95983a28cb", "value": "3145728:Qu4nboIEVkoitf+K7whbofGZAuN2rhaChvN:PeboPDitx7wtAoXCtN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583891", "to_ids": false, "type": "size-in-bytes", "uuid": "269c93d3-e47d-4bd8-966a-295404a3b8df", "value": "136627604" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "vhash", "timestamp": "1784583891", "to_ids": true, "type": "vhash", "uuid": "cd11af75-e413-4588-ac98-860723d71072", "value": "018056655d1c0510d043z800427z47z62z41fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-22T13:30:49+00:00", "last_seen": "2026-04-22T13:30:49+00:00", "object_relation": "filename", "timestamp": "1784583891", "to_ids": true, "type": "filename", "uuid": "7ff27fa7-1225-4d99-b1ca-fc439f9eaa3f", "value": "FaceitInstaller_x64.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587211", "uuid": "7d8e78ef-9ecc-48f3-a100-ca64e24f885f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "object_relation": "md5", "timestamp": "1784587211", "to_ids": true, "type": "md5", "uuid": "6fa4ead3-38c9-4f17-9749-d7ca22b6cd5e", "value": "4c5f5bf60ead01a535f8c593d86e3128", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "object_relation": "sha1", "timestamp": "1784585086", "to_ids": true, "type": "sha1", "uuid": "0e2c69e9-6d76-479d-af2c-cd89ea1436a4", "value": "63ef0def8306c804d855fe2065c88de47458e39b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "object_relation": "sha256", "timestamp": "1784585087", "to_ids": true, "type": "sha256", "uuid": "46cc99ec-b097-4feb-ae05-d62f1a161767", "value": "2751281d3800d82ecd3fad7c1d2293f3b947875a343b0672b4f4024a261165d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "object_relation": "text", "timestamp": "1784583934", "to_ids": false, "type": "text", "uuid": "65c0dfe6-3749-4661-a631-973d0fa03d72", "value": "Type Description: 7ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 5/74\nFirst Submission: 2026-04-07T14:10:38+00:00\nLast Submission: 2026-04-07T14:10:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "object_relation": "ssdeep", "timestamp": "1784583934", "to_ids": true, "type": "ssdeep", "uuid": "f89fb378-c605-4429-8e96-6eb69983a967", "value": "393216:OnZc9pwEGe8HuFTpEYYTkzDNHLErKCdngP3/ChckuoVIMionB0sChledxGQj:S+ge5FEzwDxLtAnUPCh5q90B/6lKQQj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583934", "to_ids": false, "type": "size-in-bytes", "uuid": "616d9977-e0f0-47db-bf99-a45c976e7406", "value": "20155024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "object_relation": "vhash", "timestamp": "1784583934", "to_ids": true, "type": "vhash", "uuid": "c5c66108-61c4-4d20-96cd-71226a7d2a8d", "value": "2f6a866a95e37171bc50fabf04205b5e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:10:38+00:00", "last_seen": "2026-04-07T14:10:38+00:00", "object_relation": "filename", "timestamp": "1784583934", "to_ids": true, "type": "filename", "uuid": "bdbd1f7e-9267-4edb-bd33-f248f5b87fdd", "value": "plugins.7z" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587232", "uuid": "d3185d27-f196-4af5-bbf0-6ef88c90b6b6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "object_relation": "md5", "timestamp": "1784587232", "to_ids": true, "type": "md5", "uuid": "c044355e-28ef-4fbc-9196-06fc8e207b90", "value": "d7390ef13c119daedf2350978786696f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "object_relation": "sha1", "timestamp": "1784585088", "to_ids": true, "type": "sha1", "uuid": "5fccec66-0f91-4468-8fc3-eb43cea0c669", "value": "8ffb47c2eb9f76ed7a0f8a68d2019c11a4bba291", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "object_relation": "sha256", "timestamp": "1784585088", "to_ids": true, "type": "sha256", "uuid": "103feb8d-2773-45b6-9140-3300ce51a0ce", "value": "2c7a99f137efd718f89cf8b260379c99af89ea1939568df09314918f2c5999a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "object_relation": "text", "timestamp": "1784583976", "to_ids": false, "type": "text", "uuid": "72ccc5ef-712c-4d87-ba0d-b4fb6dff5257", "value": "Type Description: HTML\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-03-18T12:23:59+00:00\nLast Submission: 2026-03-21T13:57:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "object_relation": "ssdeep", "timestamp": "1784583976", "to_ids": true, "type": "ssdeep", "uuid": "294c3000-ba50-4e18-8884-310d34d95775", "value": "48:5vZmEuZ0mC2lBOtuSiclOix7lLw1N6UMT:5haZ7l7K5wTK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583976", "to_ids": false, "type": "size-in-bytes", "uuid": "e1ac3dba-ef74-4325-9b99-3486b39948af", "value": "1710" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "object_relation": "vhash", "timestamp": "1784583976", "to_ids": true, "type": "vhash", "uuid": "a5e9dc43-a263-4c99-80b5-820f39b2a33e", "value": "2ba8698b79439589fdd2b0f7218d8b07" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T12:23:59+00:00", "last_seen": "2026-03-21T13:57:14+00:00", "object_relation": "filename", "timestamp": "1784583976", "to_ids": true, "type": "filename", "uuid": "36dea2bd-1e12-4c70-b6aa-edad85862062", "value": "Unknown.hta" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-27T02:13:48+00:00", "last_seen": "2026-05-27T02:13:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587253", "uuid": "542f1248-b985-4df2-8530-962203b98020", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T02:13:48+00:00", "last_seen": "2026-05-27T02:13:48+00:00", "object_relation": "md5", "timestamp": "1784587253", "to_ids": true, "type": "md5", "uuid": "f6649f5b-20c4-405e-afdb-cb3e848340e9", "value": "38167e35c0ceb08f2d11dc271243db3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T02:13:48+00:00", "last_seen": "2026-05-27T02:13:48+00:00", "object_relation": "sha1", "timestamp": "1784585089", "to_ids": true, "type": "sha1", "uuid": "55955e3b-b984-4616-902e-84b064f3da3b", "value": "cde28e9377846d975c2ee66458107ab1175db584", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T02:13:48+00:00", "last_seen": "2026-05-27T02:13:48+00:00", "object_relation": "sha256", "timestamp": "1784585089", "to_ids": true, "type": "sha256", "uuid": "ce5e15f3-eb74-4f79-8b95-045da2fb4863", "value": "365024336c7681ac0854321ac6c140a245b9593285da02d2a590124cdc592370", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T02:13:48+00:00", "last_seen": "2026-05-27T02:13:48+00:00", "object_relation": "text", "timestamp": "1784583997", "to_ids": false, "type": "text", "uuid": "c41db03b-7b5b-48d2-aa80-1b790448e700", "value": "Type Description: Powershell\nMicrosoft: None\nClamAV: Ps1.Trojan.Agent-10060317-0\nVT Total Detection: 11/74\nFirst Submission: 2026-05-27T02:13:48+00:00\nLast Submission: 2026-05-27T02:13:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T02:13:48+00:00", "last_seen": "2026-05-27T02:13:48+00:00", "object_relation": "ssdeep", "timestamp": "1784583997", "to_ids": true, "type": "ssdeep", "uuid": "9eca5908-ed90-4fed-a870-1322628106b6", "value": "768:pW+dL9VgiVTuXitgYW89Cxow42PquSXGmFlTteYWNxqx7QoJfVyyieIml1bpTm1M:4IxVgiZTtPg6FVtjWOxfanmfwuhfh7" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T02:13:48+00:00", "last_seen": "2026-05-27T02:13:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784583997", "to_ids": false, "type": "size-in-bytes", "uuid": "b87f9091-e09e-4c4c-81cc-bf3153b51632", "value": "207893" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T02:13:48+00:00", "last_seen": "2026-05-27T02:13:48+00:00", "object_relation": "filename", "timestamp": "1784583997", "to_ids": true, "type": "filename", "uuid": "59cb55fc-eb08-4e8c-8aeb-c31103862dc4", "value": "page" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587274", "uuid": "c85de480-6932-4588-a7df-15df53ca9639", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "object_relation": "md5", "timestamp": "1784587274", "to_ids": true, "type": "md5", "uuid": "61986b9d-df2a-4316-8028-a2084be4e989", "value": "844c462e920593242594050f82643f7b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "object_relation": "sha1", "timestamp": "1784585090", "to_ids": true, "type": "sha1", "uuid": "c7cb895b-4810-4a58-a0eb-3eb675c1fde4", "value": "53f7efb132c92cbb3f41627fe3fb30b80773379b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "object_relation": "sha256", "timestamp": "1784585090", "to_ids": true, "type": "sha256", "uuid": "55f08392-09ca-4e76-ab67-e680c4c9b89d", "value": "36e3838d07978f49ebe6546d57d2f311b8d6566558bcd58448e921c988cc346a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "object_relation": "text", "timestamp": "1784584019", "to_ids": false, "type": "text", "uuid": "e76d4c17-2bd1-49d7-82b3-20a37647dd80", "value": "Type Description: HTML\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: Html.Downloader.Agent-10060313-0\nVT Total Detection: 26/74\nFirst Submission: 2025-07-22T12:51:46+00:00\nLast Submission: 2025-07-22T12:51:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "object_relation": "ssdeep", "timestamp": "1784584019", "to_ids": true, "type": "ssdeep", "uuid": "2f4c8d5d-e612-4788-bb6d-a1cdc75b7b2d", "value": "48:5vZm+p7P/PCx2gkCf2GmCYDBOtuSiSOUxRdLXqZYT:5hDuVzqj7CxaZG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584019", "to_ids": false, "type": "size-in-bytes", "uuid": "7f9bc217-8120-4de6-bd99-0bc312b7c07c", "value": "2127" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "object_relation": "vhash", "timestamp": "1784584019", "to_ids": true, "type": "vhash", "uuid": "425a9656-f11f-4eb9-aec5-30d504a69590", "value": "2ba8698b79439589fdd2b0f7218d8b07" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-22T12:51:46+00:00", "last_seen": "2025-07-22T12:51:46+00:00", "object_relation": "filename", "timestamp": "1784584019", "to_ids": true, "type": "filename", "uuid": "5b7dc53f-7633-469e-a074-3ccb8a5f31cd", "value": "ru.hta" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-26T05:39:49+00:00", "last_seen": "2026-05-26T05:39:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587296", "uuid": "80eada0a-fac3-408c-b284-47281f3ba92c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T05:39:49+00:00", "last_seen": "2026-05-26T05:39:49+00:00", "object_relation": "md5", "timestamp": "1784587296", "to_ids": true, "type": "md5", "uuid": "c0083a5f-bc5f-4eb8-8c77-5ff046d4c935", "value": "7ed31a99036b9aecb028707ae082b108", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T05:39:49+00:00", "last_seen": "2026-05-26T05:39:49+00:00", "object_relation": "sha1", "timestamp": "1784585091", "to_ids": true, "type": "sha1", "uuid": "a6c88bbc-2c44-4cb0-a069-68a83a24f4da", "value": "04ce0e52ebeb37167300ea1442eecbc4a0c5e179", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T05:39:49+00:00", "last_seen": "2026-05-26T05:39:49+00:00", "object_relation": "sha256", "timestamp": "1784585091", "to_ids": true, "type": "sha256", "uuid": "854dd96c-be4e-40b7-b9c1-427336b1cb5a", "value": "451ac8ca34d5bcdfe476465f69eb517b2608f267c7e8d69f8ef36197a6f1d949", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T05:39:49+00:00", "last_seen": "2026-05-26T05:39:49+00:00", "object_relation": "text", "timestamp": "1784584040", "to_ids": false, "type": "text", "uuid": "425b2cdf-3939-4308-b4aa-1c31b85598b1", "value": "Type Description: Powershell\nMicrosoft: Trojan:Script/Wacatac.C!ml\nClamAV: Ps1.Trojan.Agent-10060317-0\nVT Total Detection: 16/74\nFirst Submission: 2026-05-26T05:39:49+00:00\nLast Submission: 2026-05-26T05:39:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T05:39:49+00:00", "last_seen": "2026-05-26T05:39:49+00:00", "object_relation": "ssdeep", "timestamp": "1784584040", "to_ids": true, "type": "ssdeep", "uuid": "b50a11ce-ed80-4b09-9ce9-3be362962651", "value": "768:hbS/GKT6RpLOpzh75vns4Nv6TEnjZ1EPdbFzyqVs8ckeBorHziNtjuU9+BWCkwcI:hbSvT6czhGGSyKtYqVs4drHmXy/2A" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T05:39:49+00:00", "last_seen": "2026-05-26T05:39:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584040", "to_ids": false, "type": "size-in-bytes", "uuid": "35161f1b-4fe8-4ee5-b113-3feaa6ec8a20", "value": "208919" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T05:39:49+00:00", "last_seen": "2026-05-26T05:39:49+00:00", "object_relation": "filename", "timestamp": "1784584040", "to_ids": true, "type": "filename", "uuid": "838c73a2-3fe0-4f0a-b1d3-9a1cf1aff299", "value": "49rts6s1.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-08-08T16:31:11+00:00", "last_seen": "2025-08-08T16:31:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587317", "uuid": "c26f8674-b916-43f5-baad-ecb5dd463c39", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-08T16:31:11+00:00", "last_seen": "2025-08-08T16:31:11+00:00", "object_relation": "md5", "timestamp": "1784587317", "to_ids": true, "type": "md5", "uuid": "2cec171e-edc1-4011-ad25-6f4983555a13", "value": "0ddc62ec74a816a8a0607b16f2be9073", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-08T16:31:11+00:00", "last_seen": "2025-08-08T16:31:11+00:00", "object_relation": "sha1", "timestamp": "1784585093", "to_ids": true, "type": "sha1", "uuid": "99081a11-2ab2-40f2-87f2-b57aa2b6a60a", "value": "98d3bdabe6abe260e77ff2834e48c634514fa325", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-08T16:31:11+00:00", "last_seen": "2025-08-08T16:31:11+00:00", "object_relation": "sha256", "timestamp": "1784585093", "to_ids": true, "type": "sha256", "uuid": "7306a38a-1334-470a-9c1a-e892f81214b9", "value": "575ce92c473e6d47810321e309a4e29dd7f52f4152526b0bdca80f54b53aed2f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-08-08T16:31:11+00:00", "last_seen": "2025-08-08T16:31:11+00:00", "object_relation": "text", "timestamp": "1784584083", "to_ids": false, "type": "text", "uuid": "1f5f110c-600f-48a6-8061-acc03a2a2ce1", "value": "Type Description: HTML\nMicrosoft: Trojan:VBS/Remcos.EAR!MTB\nClamAV: Html.Downloader.Agent-10060313-0\nVT Total Detection: 22/74\nFirst Submission: 2025-08-08T16:31:11+00:00\nLast Submission: 2025-08-08T16:31:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-08T16:31:11+00:00", "last_seen": "2025-08-08T16:31:11+00:00", "object_relation": "ssdeep", "timestamp": "1784584083", "to_ids": true, "type": "ssdeep", "uuid": "7c5330d9-de3d-40e9-8a40-bf25132c9cad", "value": "24:k3vH5iQJZSKu2fqgYBZ8EOgEAuRnYs8Xx4Nd:ivZc8CgMCEOgEAuRnYs8XeNd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-08-08T16:31:11+00:00", "last_seen": "2025-08-08T16:31:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584083", "to_ids": false, "type": "size-in-bytes", "uuid": "fdfd8fe7-dfce-4fb8-807f-3136e6721d09", "value": "1010" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-08-08T16:31:11+00:00", "last_seen": "2025-08-08T16:31:11+00:00", "object_relation": "vhash", "timestamp": "1784584083", "to_ids": true, "type": "vhash", "uuid": "a70822b3-2a64-4250-84e2-fec7ef232397", "value": "2ba8698b79439589fdd2b0f7218d8b07" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587338", "uuid": "98eefe8d-f584-4bdc-b79f-9987f4c63754", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "object_relation": "md5", "timestamp": "1784587338", "to_ids": true, "type": "md5", "uuid": "37004fbd-8b1e-4cbd-923a-8a57a4d0aaf9", "value": "9000b4d28f2736cf84147ddc0ff3b59e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "object_relation": "sha1", "timestamp": "1784585094", "to_ids": true, "type": "sha1", "uuid": "f90cae8d-a4d5-47a7-9b75-1d335772a661", "value": "37f237f1905a9a07efd9c0af5031d02ae2fb92df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "object_relation": "sha256", "timestamp": "1784585094", "to_ids": true, "type": "sha256", "uuid": "42282893-d390-4b4a-9dc4-bbc23aa113dc", "value": "5b9bf7957a9f8869c87ace1a6d76b48e2623073e72739ad0636b5dfa4bb2e0c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "object_relation": "text", "timestamp": "1784584105", "to_ids": false, "type": "text", "uuid": "33786316-57e5-44d7-9ff2-240b008e23ca", "value": "Type Description: HTML\nMicrosoft: None\nClamAV: Html.Downloader.Agent-10060313-0\nVT Total Detection: 25/74\nFirst Submission: 2026-03-18T15:24:25+00:00\nLast Submission: 2026-03-18T15:24:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "object_relation": "ssdeep", "timestamp": "1784584105", "to_ids": true, "type": "ssdeep", "uuid": "63fe415f-8040-44bc-bf8b-85b688235078", "value": "48:5vZmEuZ6mC2lBOtuSiclOix7lLw1N6UMT:5haZRl7K5wTK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584105", "to_ids": false, "type": "size-in-bytes", "uuid": "485d8f58-fc5b-45d6-9008-c45e6e008bb5", "value": "1699" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "object_relation": "vhash", "timestamp": "1784584105", "to_ids": true, "type": "vhash", "uuid": "7bd34ad0-2e4e-461f-a824-d265f4046f93", "value": "2ba8698b79439589fdd2b0f7218d8b07" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:24:25+00:00", "last_seen": "2026-03-18T15:24:25+00:00", "object_relation": "filename", "timestamp": "1784584105", "to_ids": true, "type": "filename", "uuid": "2961dfc9-6691-4ccc-b45d-b9a136b9a127", "value": "ru1[1].hta" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587360", "uuid": "ac2683ec-f3e3-4ee7-a58b-1d096fe4796d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "md5", "timestamp": "1784587360", "to_ids": true, "type": "md5", "uuid": "75641345-acef-43eb-b04f-7199a876cdfa", "value": "c79bd62a52f245fc3d48ee97f0c426c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "sha1", "timestamp": "1784585095", "to_ids": true, "type": "sha1", "uuid": "43a466a2-56cd-48f5-9ba5-9ec5f667b266", "value": "552c42807466b5eca7ba8d881853ec2d8a024158", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "sha256", "timestamp": "1784585095", "to_ids": true, "type": "sha256", "uuid": "8c44bc94-f3a0-484b-b8b4-142107c8ceaa", "value": "603fd9724de346a06e00c1b8502c2ac1180812a18bbf30032dab8d469e5c18e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "text", "timestamp": "1784584126", "to_ids": false, "type": "text", "uuid": "444bbe1d-01ea-41b6-8a7c-f840ade9e272", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 11:43 AM 03/19/2026\nSigners: GANGWORKS SOFTWARE YAZILIM TEKNOLOJ\u0130 L\u0130M\u0130TED \u015e\u0130RKET\u0130; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 13/74\nFirst Submission: 2026-05-05T23:53:46+00:00\nLast Submission: 2026-05-05T23:59:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "creation-time", "timestamp": "1784584126", "to_ids": false, "type": "datetime", "uuid": "1ab7a7dd-8637-46be-9685-10820993bfad", "value": "2016-07-25T00:55:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "ssdeep", "timestamp": "1784584126", "to_ids": true, "type": "ssdeep", "uuid": "571b37ca-044d-4648-83bf-7760b435a9eb", "value": "3145728:cu4nboIEVkoitf+K7whbofGZACD1+1Chvu:TeboPDitx7wtAHCtu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584126", "to_ids": false, "type": "size-in-bytes", "uuid": "0f3b3f67-d90e-4bc0-b5f0-445f77767a6a", "value": "136864848" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "vhash", "timestamp": "1784584126", "to_ids": true, "type": "vhash", "uuid": "c0cd4875-01bb-44e6-a43b-dba26d01e45c", "value": "018056655d1c0510d043z800427z47z62z41fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-05T23:53:46+00:00", "last_seen": "2026-05-05T23:59:36+00:00", "object_relation": "filename", "timestamp": "1784584126", "to_ids": true, "type": "filename", "uuid": "e890798c-d482-4585-9673-130f38817373", "value": "dbeaver_ce_windows_x86_64.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587381", "uuid": "03c04e6e-b155-49b4-9748-0b62d66e0350", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "md5", "timestamp": "1784587381", "to_ids": true, "type": "md5", "uuid": "c38626ff-802d-4297-96be-3b82dc8c3eb9", "value": "c322d26db6a905449989128892353e25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "sha1", "timestamp": "1784585097", "to_ids": true, "type": "sha1", "uuid": "71dd02e8-8b4c-4520-8b9b-0defa8aa8f8b", "value": "629848afd5732929dd586e24602e03c863bc21ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "sha256", "timestamp": "1784585097", "to_ids": true, "type": "sha256", "uuid": "b8d2519f-c38e-414c-9317-c51b33025bbf", "value": "6ae334ce60d1a9b7fb96d1d0d0eda5ec7c2c31d3f0cf3e4d7e3056504d50043d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "text", "timestamp": "1784584148", "to_ids": false, "type": "text", "uuid": "b808c072-0b08-47ac-b18a-9606930f64a6", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 09:59 PM 03/06/2026\nSigners: Teryaki Insaat Nak. Oto Yedek Parca San. ve Tic. Ltd. Sirketi; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 22/74\nFirst Submission: 2026-03-18T15:35:01+00:00\nLast Submission: 2026-03-18T15:35:02+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "creation-time", "timestamp": "1784584148", "to_ids": false, "type": "datetime", "uuid": "f49898d9-9a81-4444-8372-1bb0eb1b987e", "value": "2016-07-25T00:55:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "ssdeep", "timestamp": "1784584148", "to_ids": true, "type": "ssdeep", "uuid": "e5548130-88eb-436c-bf38-2c48d5154382", "value": "3145728:yu4nboIEVkoitf+K7whbofGZAbioHChvO:JeboPDitx7wtArCtO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584148", "to_ids": false, "type": "size-in-bytes", "uuid": "f38ba8a0-f260-4df7-9396-c75b055a925c", "value": "137809680" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "vhash", "timestamp": "1784584148", "to_ids": true, "type": "vhash", "uuid": "4f87e810-7c92-4742-9cfa-04a38c151fce", "value": "018056655d1c0510d043z800427z47z62z41fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:35:01+00:00", "last_seen": "2026-03-18T15:35:02+00:00", "object_relation": "filename", "timestamp": "1784584148", "to_ids": true, "type": "filename", "uuid": "006225b7-8362-4b00-a22b-62609a926098", "value": "WebEx_Client.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587402", "uuid": "55fe3c9d-a1e3-4ede-bc29-3b845bde8277", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "md5", "timestamp": "1784587402", "to_ids": true, "type": "md5", "uuid": "844b5413-54ba-4aa6-a56c-54bc5dd7298d", "value": "90dc1e26741120859d97cd287da38a78", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "sha1", "timestamp": "1784585098", "to_ids": true, "type": "sha1", "uuid": "722b528c-373d-429a-a1a5-f8faf6dd472f", "value": "178fe2fe351a8de923da71c784aba607bc2d1cd1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "sha256", "timestamp": "1784585098", "to_ids": true, "type": "sha256", "uuid": "4032ebd2-2f11-46dd-a44c-6c1efc27f00d", "value": "6ca7a458985350ac082a9c9820d7f8d39128a4c4bda2f5d32f169a45b7b22bc6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "text", "timestamp": "1784584169", "to_ids": false, "type": "text", "uuid": "5863f962-7a12-400a-9e31-5b3a1d6e817f", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 11:47 AM 03/19/2026\nSigners: GANGWORKS SOFTWARE YAZILIM TEKNOLOJ\u0130 L\u0130M\u0130TED \u015e\u0130RKET\u0130; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 16/74\nFirst Submission: 2026-04-07T14:06:59+00:00\nLast Submission: 2026-04-07T14:06:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "creation-time", "timestamp": "1784584169", "to_ids": false, "type": "datetime", "uuid": "acf90748-0750-4d59-94ff-a33ec6725fc7", "value": "2016-07-25T00:55:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "ssdeep", "timestamp": "1784584169", "to_ids": true, "type": "ssdeep", "uuid": "9a288e02-1013-4af1-bc39-88d007fe1c5e", "value": "3145728:Xs6V+4Ykqu4nboIEVkoitf+K7whbofGZAnb0DChvq:c6UceboPDitx7wtAUCtq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584169", "to_ids": false, "type": "size-in-bytes", "uuid": "72ea7cc1-2f84-46ed-904c-7e0e38240791", "value": "153713968" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "vhash", "timestamp": "1784584169", "to_ids": true, "type": "vhash", "uuid": "82ba4eeb-ee3a-4335-be99-42473bb6a66e", "value": "018056655d1c0510d043z800427z47z62z41fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-07T14:06:59+00:00", "last_seen": "2026-04-07T14:06:59+00:00", "object_relation": "filename", "timestamp": "1784584169", "to_ids": true, "type": "filename", "uuid": "88d60599-8c31-4a5f-8247-1df7e76fbf7b", "value": "MobaXterm_v26.1.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587423", "uuid": "71321006-9851-4169-b767-6362abfb1b28", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "object_relation": "md5", "timestamp": "1784587423", "to_ids": true, "type": "md5", "uuid": "397bf08b-17bb-4b31-93b6-79c1c6e2d80c", "value": "a86b42c731d12b5a4fb156ee3175fe86", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "object_relation": "sha1", "timestamp": "1784585099", "to_ids": true, "type": "sha1", "uuid": "2d6aa00a-9a8d-406e-8300-4d60ff4b4486", "value": "d4e3dfaa735bf5c59f6bbd92eabb91d5b3847248", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "object_relation": "sha256", "timestamp": "1784585099", "to_ids": true, "type": "sha256", "uuid": "f4e0ab74-61a5-4127-b6fb-46279b8e9a00", "value": "7dc77a5abab119960fbe42b1535c957020cce1b8e0a3cf58d4eddc51b5bf9940", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "object_relation": "text", "timestamp": "1784584191", "to_ids": false, "type": "text", "uuid": "d12023f1-c44d-427b-8498-53724601ec9e", "value": "Type Description: HTML\nMicrosoft: TrojanDownloader:VBS/Vigorf.A\nClamAV: Html.Downloader.Agent-10060313-0\nVT Total Detection: 28/74\nFirst Seen In The Wild: 2025-07-05T13:55:38+00:00\nFirst Submission: 2025-07-05T13:31:52+00:00\nLast Submission: 2025-07-05T13:31:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "object_relation": "ssdeep", "timestamp": "1784584191", "to_ids": true, "type": "ssdeep", "uuid": "c7da39b9-1a86-4500-9961-39f6a4714137", "value": "24:kIvH5iWMiKoiYBYBZdEOBEA7Rn5NRZYMW:HvZzpiYBMPEOBEA7Rn5NTPW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584191", "to_ids": false, "type": "size-in-bytes", "uuid": "66cb9993-bb62-47a4-a54a-8c0c8b6408e6", "value": "1033" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "object_relation": "vhash", "timestamp": "1784584191", "to_ids": true, "type": "vhash", "uuid": "b28d8af2-441d-4333-a2a8-6c3264929e6f", "value": "2ba8698b79439589fdd2b0f7218d8b07" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-05T13:31:52+00:00", "last_seen": "2025-07-05T13:31:52+00:00", "object_relation": "filename", "timestamp": "1784584191", "to_ids": true, "type": "filename", "uuid": "5fc9567a-14f7-4391-a4ea-9bd75184a6b1", "value": "378126200" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587444", "uuid": "e752d908-cfd2-446a-b6c9-c18aeff02117", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "md5", "timestamp": "1784587444", "to_ids": true, "type": "md5", "uuid": "3b762b18-d943-4217-ae4d-fb7fa2616563", "value": "b2b25a59e1e0cc74804344d631629fd2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "sha1", "timestamp": "1784585101", "to_ids": true, "type": "sha1", "uuid": "95cf2fe7-26f8-4ec5-97d2-6a9ae421b0e3", "value": "54193e8751aa3c0bcf786fa49eabe34a9cd10edc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "sha256", "timestamp": "1784585101", "to_ids": true, "type": "sha256", "uuid": "73341c6a-6260-4603-a0bb-e333072befe5", "value": "896185a89bd7eb0520b03fdcfb8db0be98b43cf15f14041d73b23d3988c1bcab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "text", "timestamp": "1784584212", "to_ids": false, "type": "text", "uuid": "ab78cd69-e200-4ffe-8b6b-74a822470338", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:MSIL/CastleStealer.CZ!MTB\nClamAV: Win.Trojan.CastleStealer-10060341-0\nVT Total Detection: 48/74\nFirst Submission: 2026-05-27T01:00:13+00:00\nLast Submission: 2026-05-27T01:00:13+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "creation-time", "timestamp": "1784584212", "to_ids": false, "type": "datetime", "uuid": "3a0b70e7-3c65-4f04-9779-43880e46a42d", "value": "2026-03-30T10:44:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "ssdeep", "timestamp": "1784584212", "to_ids": true, "type": "ssdeep", "uuid": "cb7937c7-3f4b-4abb-b112-294d82a79475", "value": "3072:sjRiwnGBFkugQje3Rj4edprhZKYhkbOMOAGrIhyu:sh+Fkwj6d4itcYWbNL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584212", "to_ids": false, "type": "size-in-bytes", "uuid": "f5c3ceeb-a4b4-4c18-9a97-e9111c8fddb2", "value": "228352" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "vhash", "timestamp": "1784584212", "to_ids": true, "type": "vhash", "uuid": "06130c2e-72f4-453b-9f34-46d756998c6b", "value": "225036551511404832112050" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T01:00:13+00:00", "last_seen": "2026-05-27T01:00:13+00:00", "object_relation": "filename", "timestamp": "1784584212", "to_ids": true, "type": "filename", "uuid": "cbd9a63b-a7bd-4ad5-810b-9eca626add6f", "value": "1zcok.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587465", "uuid": "eaf6d388-9ccd-4959-8832-821f16cf4e49", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "object_relation": "md5", "timestamp": "1784587465", "to_ids": true, "type": "md5", "uuid": "09259607-07c2-4430-b66c-78c7578ed5a3", "value": "6337c9dcd6b6c7c122e26b008032e8ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "object_relation": "sha1", "timestamp": "1784585102", "to_ids": true, "type": "sha1", "uuid": "48b22a0d-0ddc-411b-ad29-71aad537b2fd", "value": "9c100ac6c66ddb61df36dd6a37268a985856b59a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "object_relation": "sha256", "timestamp": "1784585103", "to_ids": true, "type": "sha256", "uuid": "ed8181fc-eb42-4ddd-878a-1286e0948ca4", "value": "964256d3259b6e0c701ec04116c45cf0ec381c1c209dc29b09a7930cd7a4810b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "object_relation": "text", "timestamp": "1784584234", "to_ids": false, "type": "text", "uuid": "ec5519c4-c5a3-4532-8f75-c944de950d24", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.C!ml\nClamAV: Html.Downloader.Agent-10060313-0\nVT Total Detection: 14/74\nFirst Submission: 2026-03-05T16:42:15+00:00\nLast Submission: 2026-03-05T16:42:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "object_relation": "ssdeep", "timestamp": "1784584234", "to_ids": true, "type": "ssdeep", "uuid": "b4abe629-6086-4eaa-9d20-7ae9b3661063", "value": "48:op7P/PCx2gkCf2GmCYDBOtuSiSOUxRdLXqZx:8uVzqj7CxaZx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584234", "to_ids": false, "type": "size-in-bytes", "uuid": "4b900bc1-dad8-4d16-847f-753633b66efd", "value": "1828" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "object_relation": "vhash", "timestamp": "1784584234", "to_ids": true, "type": "vhash", "uuid": "3cbf09e6-2c10-4f3c-955c-fc9c006ad885", "value": "f3a7c41c688b0f646f2821da012006bf" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T16:42:15+00:00", "last_seen": "2026-03-05T16:42:15+00:00", "object_relation": "filename", "timestamp": "1784584234", "to_ids": true, "type": "filename", "uuid": "78ee03f6-0383-412b-8c76-c4295a199a3c", "value": "964256d3259b6e0c701ec04116c45cf0ec381c1c209dc29b09a7930cd7a4810b.js" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-27T02:19:19+00:00", "last_seen": "2026-05-27T02:19:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587486", "uuid": "ccc9774e-8ade-4ae1-b836-56c888ff2ef3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T02:19:19+00:00", "last_seen": "2026-05-27T02:19:19+00:00", "object_relation": "md5", "timestamp": "1784587486", "to_ids": true, "type": "md5", "uuid": "1b9c73b5-78d9-4116-930c-467f68980a95", "value": "57c6617c205f8dc296c41606ccc5cc16", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T02:19:19+00:00", "last_seen": "2026-05-27T02:19:19+00:00", "object_relation": "sha1", "timestamp": "1784585104", "to_ids": true, "type": "sha1", "uuid": "106af8c6-22c1-411f-9e1c-e92216643c99", "value": "8e964ee6ffbd389da853798c10ab2a8748324193", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T02:19:19+00:00", "last_seen": "2026-05-27T02:19:19+00:00", "object_relation": "sha256", "timestamp": "1784585104", "to_ids": true, "type": "sha256", "uuid": "4d93d026-94e5-47ab-aed8-7e20740f29e0", "value": "a080b5380ccc8fc40b24c02151d305efc32d931dc547881e01a2e6f2b070c7dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T02:19:19+00:00", "last_seen": "2026-05-27T02:19:19+00:00", "object_relation": "text", "timestamp": "1784584257", "to_ids": false, "type": "text", "uuid": "71444786-c152-4dd5-9234-e3491052de52", "value": "Type Description: Powershell\nMicrosoft: None\nClamAV: Ps1.Trojan.Agent-10060317-0\nVT Total Detection: 11/74\nFirst Submission: 2026-05-27T02:19:19+00:00\nLast Submission: 2026-05-27T02:19:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-27T02:19:19+00:00", "last_seen": "2026-05-27T02:19:19+00:00", "object_relation": "ssdeep", "timestamp": "1784584257", "to_ids": true, "type": "ssdeep", "uuid": "25aca40c-2c09-435b-a334-c16bbe22938b", "value": "1536:TQAnVdaV+uPqHugCzA9s2kx3mQOBdrcc0cKyOpNnDi521:s4dafPd09sHx3mQOBiMOpNnuo1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T02:19:19+00:00", "last_seen": "2026-05-27T02:19:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584257", "to_ids": false, "type": "size-in-bytes", "uuid": "5d8622cc-a717-42e9-8155-baea971921e1", "value": "208163" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-27T02:19:19+00:00", "last_seen": "2026-05-27T02:19:19+00:00", "object_relation": "filename", "timestamp": "1784584257", "to_ids": true, "type": "filename", "uuid": "089ec727-e5da-4b00-a29c-bc4565ea5b52", "value": "yellow" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587507", "uuid": "8d244bb1-76a1-42f6-8208-0558c5ac72b0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "md5", "timestamp": "1784587507", "to_ids": true, "type": "md5", "uuid": "b354acda-9d52-49c9-b088-a3be8a898190", "value": "b099fe4c46c53403b7657cbfe18b8ac4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "sha1", "timestamp": "1784585105", "to_ids": true, "type": "sha1", "uuid": "ad186da8-69e9-4494-8628-39ff980a588a", "value": "f9f979735931bfc3db41cb206088d6f0b29eeaac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "sha256", "timestamp": "1784585105", "to_ids": true, "type": "sha256", "uuid": "aee781bb-58cc-4755-aa3e-81de645552a9", "value": "a1835d333ac3db961a8ff1f4864e3c10a6f73a872c040599091390a009ac7804", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 21/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "text", "timestamp": "1784584278", "to_ids": false, "type": "text", "uuid": "d2f2148c-70f5-4fa6-8efb-f58f3bc18465", "value": "Type Description: Win32 EXE\nMicrosoft: Backdoor:Win32/Remcos.GA!MTB\nClamAV: Win.Trojan.Remcos-9841897-0\nVT Total Detection: 60/74\nFirst Seen In The Wild: 2025-12-27T01:22:31+00:00\nFirst Submission: 2025-12-27T00:22:28+00:00\nLast Submission: 2025-12-27T00:22:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "creation-time", "timestamp": "1784584278", "to_ids": false, "type": "datetime", "uuid": "fd7c7c18-c02a-4e1e-bd3d-2670efa534b2", "value": "2025-09-10T11:12:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "ssdeep", "timestamp": "1784584278", "to_ids": true, "type": "ssdeep", "uuid": "36863145-aceb-420e-b242-99c52fba2458", "value": "12288:9T1tInGFOPvn+ySVx6puG8pDxR+sPZQZd:9T1tIncO3s6puG8ZxRtZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584278", "to_ids": false, "type": "size-in-bytes", "uuid": "4030dc4a-c16e-4e1a-8b16-a9ba786a41dd", "value": "506880" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "vhash", "timestamp": "1784584278", "to_ids": true, "type": "vhash", "uuid": "80407c4f-2616-4547-bc6e-7feca86c2e3b", "value": "055056655d15156225za00a87z37z403022c1z40a117z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-27T00:22:28+00:00", "last_seen": "2025-12-27T00:22:28+00:00", "object_relation": "filename", "timestamp": "1784584278", "to_ids": true, "type": "filename", "uuid": "fd42249b-bd02-48bc-9c4e-ea0f302eacde", "value": "6p7kev.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-18T15:32:47+00:00", "last_seen": "2026-03-18T15:32:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587528", "uuid": "d9774abf-b14d-4007-9d15-67bca8802a39", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:32:47+00:00", "last_seen": "2026-03-18T15:32:47+00:00", "object_relation": "md5", "timestamp": "1784587528", "to_ids": true, "type": "md5", "uuid": "92d8c626-3b4f-43be-82cd-5f68e88d3b23", "value": "3111f846b1cb76de775eabb62625cdda", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:32:47+00:00", "last_seen": "2026-03-18T15:32:47+00:00", "object_relation": "sha1", "timestamp": "1784585106", "to_ids": true, "type": "sha1", "uuid": "57d2e3ac-9956-471c-8560-7aa90abf2778", "value": "7a22441a6d6a5a77df8cdbfd39ca694c627298f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:32:47+00:00", "last_seen": "2026-03-18T15:32:47+00:00", "object_relation": "sha256", "timestamp": "1784585106", "to_ids": true, "type": "sha256", "uuid": "7bf7638d-7536-4c05-94a7-3845a24b360e", "value": "a32ac345e39cb7606322e2155bd7b4d6941c1678619e48d1f14d9301ee53e6c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 21/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:32:47+00:00", "last_seen": "2026-03-18T15:32:47+00:00", "object_relation": "text", "timestamp": "1784584300", "to_ids": false, "type": "text", "uuid": "61fab9dc-e14d-4a42-b5f6-adff2d7042b4", "value": "Type Description: DOS batch file\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: Txt.Downloader.Agent-10060312-0\nVT Total Detection: 13/74\nFirst Submission: 2026-03-18T15:32:47+00:00\nLast Submission: 2026-03-18T15:32:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-18T15:32:47+00:00", "last_seen": "2026-03-18T15:32:47+00:00", "object_relation": "ssdeep", "timestamp": "1784584300", "to_ids": true, "type": "ssdeep", "uuid": "6574890c-7a8a-4255-90af-246d15b3ca02", "value": "12:0G80qyzvPOg98JG3+0nZ7nVUVAUjHzgCOr:0oDz+a3+gZ7VUVA4HUJr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:32:47+00:00", "last_seen": "2026-03-18T15:32:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584300", "to_ids": false, "type": "size-in-bytes", "uuid": "506932ee-610f-470e-bce5-1c41924622cb", "value": "423" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-18T15:32:47+00:00", "last_seen": "2026-03-18T15:32:47+00:00", "object_relation": "filename", "timestamp": "1784584300", "to_ids": true, "type": "filename", "uuid": "9e108a1a-bd2e-4e36-a8f4-686dc3d14fc2", "value": "runexe.bat" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-17T10:29:58+00:00", "last_seen": "2026-07-17T10:29:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587549", "uuid": "39d04596-12d6-42c5-aa12-2753bddeb5e5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-17T10:29:58+00:00", "last_seen": "2026-07-17T10:29:58+00:00", "object_relation": "md5", "timestamp": "1784587549", "to_ids": true, "type": "md5", "uuid": "08a745f2-31d0-4739-b234-31e47812705e", "value": "d2289159e1a2f76941a2571f6318f7a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-17T10:29:58+00:00", "last_seen": "2026-07-17T10:29:58+00:00", "object_relation": "sha1", "timestamp": "1784585108", "to_ids": true, "type": "sha1", "uuid": "ed6f43b9-8456-4725-a857-51d736b14ce2", "value": "bf499a931075527954f582f8956bfefe3ee40481", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-17T10:29:58+00:00", "last_seen": "2026-07-17T10:29:58+00:00", "object_relation": "sha256", "timestamp": "1784585108", "to_ids": true, "type": "sha256", "uuid": "c422c3d7-900a-46e8-892e-0a0c77501ec8", "value": "a59742d3086924c5f511d248df01601bfbf723359590fb3f3ba355f2792cc455", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-17T10:29:58+00:00", "last_seen": "2026-07-17T10:29:58+00:00", "object_relation": "text", "timestamp": "1784584321", "to_ids": false, "type": "text", "uuid": "43ebdb11-9771-4bae-95fb-91b74ebbcbea", "value": "Type Description: JSON\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-07-17T10:29:58+00:00\nLast Submission: 2026-07-17T10:29:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-17T10:29:58+00:00", "last_seen": "2026-07-17T10:29:58+00:00", "object_relation": "ssdeep", "timestamp": "1784584321", "to_ids": true, "type": "ssdeep", "uuid": "6edee0b2-5a3c-4686-8688-a44e13e05db1", "value": "6144:WxPGDPlkrJG86OMWNn81zXDTGv+YGFJ2i9DTMR0G7FXYGoE9F5BN:WVJGd7VS5GFJ/DQ/oGBFV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-17T10:29:58+00:00", "last_seen": "2026-07-17T10:29:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584321", "to_ids": false, "type": "size-in-bytes", "uuid": "96d73b90-7a5c-4059-8c00-9d8d0c2f55be", "value": "293476" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-17T10:29:58+00:00", "last_seen": "2026-07-17T10:29:58+00:00", "object_relation": "filename", "timestamp": "1784584321", "to_ids": true, "type": "filename", "uuid": "e4ca4240-caec-4dc0-bb03-1b2958c90e7e", "value": "2693624903" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587570", "uuid": "b03f50aa-7db7-4184-84dc-46dbfec236bc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "md5", "timestamp": "1784587570", "to_ids": true, "type": "md5", "uuid": "3ba80b3b-8a30-49ef-b58a-32abca636861", "value": "81c1014848d27a4a069bb9d011e22d15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "sha1", "timestamp": "1784585109", "to_ids": true, "type": "sha1", "uuid": "fd6f6789-9fba-4cce-b213-7f57dfdea6ac", "value": "2c162594aa0b3e0d1491c612faef9ae81b7518d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "sha256", "timestamp": "1784585109", "to_ids": true, "type": "sha256", "uuid": "0c595c4f-aa8c-4dc6-8768-9955f5e01862", "value": "ddcf66ecc61dc6b8cd36748d284d8cb45a470201b5373dd2bfc47700c7da32e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 21/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "text", "timestamp": "1784584365", "to_ids": false, "type": "text", "uuid": "c92b860d-6e51-4814-801c-502909b448ee", "value": "Type Description: Win32 EXE\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 04:48 PM 02/17/2026\nSigners: Softguard Technology Yaz\u0131l\u0131m Hizmetleri Anonim \u015eirketi; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: Trojan:Win32/Etset!rfn\nClamAV: None\nVT Total Detection: 21/74\nFirst Submission: 2026-02-26T13:13:25+00:00\nLast Submission: 2026-02-26T17:13:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "creation-time", "timestamp": "1784584365", "to_ids": false, "type": "datetime", "uuid": "af16bc07-8a9a-4329-9b02-34ce4cdfd899", "value": "2016-07-25T00:55:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "ssdeep", "timestamp": "1784584365", "to_ids": true, "type": "ssdeep", "uuid": "dc938e1c-57e0-43a0-b963-530469ea7852", "value": "3145728:Yrznbetux7Naf+K7whbzfGZAaecmpChvs:STbew5ix7w4A1Cts" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584365", "to_ids": false, "type": "size-in-bytes", "uuid": "9ff1b6b7-c3e8-4fe0-afab-2167482d4324", "value": "136446952" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "vhash", "timestamp": "1784584365", "to_ids": true, "type": "vhash", "uuid": "29f9df1c-6e9d-4e71-844a-b51c060712f0", "value": "018056655d1c0510d043z800427z47z62z41fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T13:13:25+00:00", "last_seen": "2026-02-26T17:13:46+00:00", "object_relation": "filename", "timestamp": "1784584365", "to_ids": true, "type": "filename", "uuid": "4e373a35-980e-4e31-a08d-721b962ca231", "value": "dbeaver-ce-windows-x86_64.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587591", "uuid": "bdca8fc6-f230-4b70-a196-3b97dd55c52b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "object_relation": "md5", "timestamp": "1784587591", "to_ids": true, "type": "md5", "uuid": "eb05e228-4fe2-408c-86aa-cf15361b86aa", "value": "c0d00167c11bad09b618442045671663", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "object_relation": "sha1", "timestamp": "1784585110", "to_ids": true, "type": "sha1", "uuid": "30e0f421-fab8-4b1c-b0c2-1a409a7d4a9d", "value": "37a563d657cfaf0c8d10a73d80140d58b59c9671", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "object_relation": "sha256", "timestamp": "1784585110", "to_ids": true, "type": "sha256", "uuid": "bbc23454-35f1-4d1b-9c0b-bca25067e8cc", "value": "f4491736743a16f1278b8ba01649ee93343764e35ae5e1c0d5e0c0e1d7e32c14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 21/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "object_relation": "text", "timestamp": "1784584386", "to_ids": false, "type": "text", "uuid": "9e05dcb8-ee77-4406-8b57-0092e3cdce7a", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 09:41 PM 12/18/2025\nSigners: \u041e\u041e\u041e \u0421\u0422\u0420\u041e\u0419\u0421\u0415\u0420\u0412\u0418\u0421; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2025-12-27T00:05:46+00:00\nLast Submission: 2025-12-27T00:05:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "object_relation": "creation-time", "timestamp": "1784584386", "to_ids": false, "type": "datetime", "uuid": "6f26739d-0baf-4199-b482-eac7712f4b7f", "value": "2016-07-25T00:55:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "object_relation": "ssdeep", "timestamp": "1784584386", "to_ids": true, "type": "ssdeep", "uuid": "146feb37-4c36-4339-bb75-ad723e776037", "value": "3145728:+Al1yvJxu6FqnbfwepOEga8/5GQ3SxBJR6LaA07I02qEDGGHl6vIU2ChvF:+N5gfwg8/fibWLZorNED48CtF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584386", "to_ids": false, "type": "size-in-bytes", "uuid": "3b1bce55-a101-45ca-8164-dba72e453198", "value": "167729096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-27T00:05:46+00:00", "last_seen": "2025-12-27T00:05:46+00:00", "object_relation": "vhash", "timestamp": "1784584386", "to_ids": true, "type": "vhash", "uuid": "0f997c5a-4946-47ef-8994-53d6779b0b13", "value": "018056655d1c0550d043z800427z47z62z41fz" } ] } ] } }