{ "Event": { "analysis": "1", "date": "2026-07-06", "extends_uuid": "", "info": "[Threat Intel] From Phishing to Persistence: A CrySome RAT Infection Chain Analysis", "protected": false, "publish_timestamp": "1784321928", "published": true, "threat_level_id": "2", "timestamp": "1784321927", "uuid": "5db90de9-32b9-4956-a0c3-fc3a61ec733e", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#d74cce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#e28dcd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Image File Execution Options Injection - T1546.012\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"XenoRAT\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120044", "local": false, "name": "rectifyq:sub-category=\"intrusion-analysis\"", "relationship_type": "" }, { "colour": "#d92121", "local": false, "name": "rectifyq:target=\"targeted\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783508407", "to_ids": false, "type": "link", "uuid": "d7ea7417-0658-4ab8-86fc-4ba126197a3f", "value": "https://www.levelblue.com/blogs/spiderlabs-blog/from-phishing-to-persistence-a-crysome-rat-infection-chain-analysis" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783508407", "to_ids": false, "type": "text", "uuid": "d317eb7d-60ba-4adb-a057-be9ac4070380", "value": "A sophisticated multi-stage infection chain was analyzed following successful containment by MDR SOC operations. Initial access occurred through spear-phishing using a logistics rate confirmation lure, delivering CrySome remote access trojan via multiple stages. The attack chain leveraged living-off-the-land techniques, ICMLuaUtil COM interface for UAC bypass, and in-memory AMSI patching. WinDefCtl, an open-source Defender disruption tool, was deployed to weaken endpoint protections before the final payload. CrySome RAT established persistence through scheduled tasks and provided operators with capabilities including hidden VNC, remote command execution, system reconnaissance, and credential theft targeting Chromium-based browsers. The campaign demonstrated modern threat actors' reliance on publicly available tooling combined with legitimate Windows processes to minimize detection while achieving comprehensive system compromise." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783508407", "to_ids": false, "type": "text", "uuid": "38f9949d-edc4-4ae5-bb6b-4d1115bc1859", "value": "Name: From Phishing to Persistence: A CrySome RAT Infection Chain Analysis\nAuthor: AlienVault\nAdversary: \nTags: [\"spear-phishing\", \"credential theft\", \"living-off-the-land\", \"amsi bypass\", \"browser hijacking\", \"crysome rat\", \"uac bypass\", \"windefctl\"]\nTgtd countries: []\nMlwr families: [\"CrySome RAT\", \"WinDefCtl\"]\nAttack_ids: [\"T1053.005\", \"T1113\", \"T1056.001\", \"T1548.002\", \"T1036.005\", \"T1204.002\", \"T1566.002\", \"T1082\", \"T1140\", \"T1219\", \"T1055\", \"T1112\", \"T1555.003\", \"T1546.012\", \"T1059.001\", \"T1562.001\", \"T1027\", \"T1071.001\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306749", "to_ids": true, "type": "domain", "uuid": "2436be0a-995b-485d-8263-b54a394a72b6", "value": "signindat.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306770", "to_ids": true, "type": "url", "uuid": "dee65ab9-26cd-4ae8-8c71-7e71b21d16dd", "value": "https://signindat.com/ElevatorShellCode.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306792", "to_ids": true, "type": "url", "uuid": "839141ca-c6a8-4161-ac04-bd447e6ed7e8", "value": "https://signindat.com/update.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306813", "to_ids": true, "type": "url", "uuid": "8729afc7-0cb8-431d-bdd8-1766d0aca025", "value": "https://signindat.com/patch.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306834", "to_ids": true, "type": "url", "uuid": "c6144500-9c20-4ec1-b727-6758cc7f0d92", "value": "https://signindat.com/stage.ps1", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306855", "to_ids": true, "type": "url", "uuid": "dc3778af-e105-4d18-b87e-05f0e6ce1671", "value": "https://signindat.com/Rate_Confirmation_LD-2026-0847.pdf", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306876", "to_ids": true, "type": "url", "uuid": "46f73033-4aac-452b-af8a-32e655f2abe8", "value": "https://signindat.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306897", "to_ids": true, "type": "ip-dst", "uuid": "c4832c48-d30e-4cd4-94a6-81bf13bc94bb", "value": "193.26.115.42", "Tag": [ { "colour": "#5ba9b8", "local": false, "name": "asn:asn=\"23470\"", "relationship_type": "" }, { "colour": "#91a53d", "local": false, "name": "asn:as-owner=\"RELIABLESITE\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 5555", "deleted": false, "disable_correlation": false, "timestamp": "1784299144", "to_ids": true, "type": "ip-dst|port", "uuid": "8bb8be52-b018-4f88-be24-0794d1e5288c", "value": "193.26.115.42|5555" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784299144", "to_ids": true, "type": "email-src", "uuid": "ae2834b5-97cf-4a2b-983f-da562d7bea6d", "value": "loadofferstender@gmail.com" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306918", "uuid": "f9d2ea69-ad14-4c3b-a5b3-d6c2103baa23", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "md5", "timestamp": "1784306918", "to_ids": true, "type": "md5", "uuid": "2d163083-da1c-437f-b97e-c4c52df1ce6e", "value": "2f4b5a0d98bc4e5616f2dd04337ae674", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "sha1", "timestamp": "1784305102", "to_ids": true, "type": "sha1", "uuid": "79e97dda-0f91-4693-9338-61e7d031ca7e", "value": "f8a3f28ecbd0b08ecab73ef571f16c3d0bd5e009", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "sha256", "timestamp": "1784305102", "to_ids": true, "type": "sha256", "uuid": "6a835e18-6308-4db1-a5ef-dec037aef646", "value": "ff5dbdcf6d7ae5d97b6f3ef412df0b977ba4a844c45b30ca78c0eeb2653d69a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "text", "timestamp": "1784304212", "to_ids": false, "type": "text", "uuid": "f03538a4-1c49-4f26-ae51-7a7bd31f8f33", "value": "Type Description: Win32 EXE\nOriginal name: wsftprm.sys\nVerified: Signed\nSigning date: 08:51 PM 02/27/2023\nSigners: TPZ SOLUCOES DIGITAIS LTDA; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 7/74\nFirst Seen In The Wild: 2024-05-27T08:49:23+00:00\nFirst Submission: 2023-04-10T17:42:50+00:00\nLast Submission: 2026-07-16T16:53:47+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "creation-time", "timestamp": "1784304212", "to_ids": false, "type": "datetime", "uuid": "e82d9138-30f1-4795-8cae-d5dbe747dd03", "value": "2023-02-27T20:51:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "ssdeep", "timestamp": "1784304212", "to_ids": true, "type": "ssdeep", "uuid": "25e232f6-1fd8-4886-a15e-ce314028c97f", "value": "384:fWT7WKllIBt9dS6Bn/amID5aUAtAcwHbftAVBMIYioQrHvPxh8E9VF0NyQEvxXhD:L6OQlKVrYioQjPxWEauXhIf3Wx9zpQ5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304212", "to_ids": false, "type": "size-in-bytes", "uuid": "d5a570c1-f1ea-4f3d-a9de-4e2179ea914f", "value": "38816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "vhash", "timestamp": "1784304212", "to_ids": true, "type": "vhash", "uuid": "d796d96d-1eec-4dd1-8d26-c75410a8b67a", "value": "034076651d651615151iz21xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-04-10T17:42:50+00:00", "last_seen": "2026-07-16T16:53:47+00:00", "object_relation": "filename", "timestamp": "1784304212", "to_ids": true, "type": "filename", "uuid": "dbc8cedd-d56a-41ca-ab07-a01d9cd332fe", "value": "wsftprm.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306940", "uuid": "75eb1aef-754d-4c7b-a1c0-a93689bffe9d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "object_relation": "md5", "timestamp": "1784306940", "to_ids": true, "type": "md5", "uuid": "1e3f46d0-12ff-4c60-95c2-d985487335ac", "value": "b770cfe08912225f3a6daacf092a379d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "object_relation": "sha1", "timestamp": "1784305104", "to_ids": true, "type": "sha1", "uuid": "bdc146dd-76ec-4d6a-a29b-6d1c9f65f5f1", "value": "7fe995b6bdbfdc8af3d6475c7f94a86925386d83", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "object_relation": "sha256", "timestamp": "1784305104", "to_ids": true, "type": "sha256", "uuid": "b76a8d01-581f-4f61-b5d9-8a23b1484a75", "value": "ec68666e8f0a3b9870d7177bab684c8dcfb8ca0bc7c8c484a71b2b33ea4e26f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "object_relation": "text", "timestamp": "1784304233", "to_ids": false, "type": "text", "uuid": "31f74301-37ca-456a-9b3a-f732c215dc2e", "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-06-22T14:26:24+00:00\nLast Submission: 2026-06-22T14:26:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "object_relation": "ssdeep", "timestamp": "1784304233", "to_ids": true, "type": "ssdeep", "uuid": "8277de2e-1b6a-4f86-b165-a66a1e489a46", "value": "24:0k9zLw1PKC2M9xs4H3gJhkwSFpjTi+efuhSLw1PKC2jVbLw1PKC2AkRQ7b0TGESZ:l9w1P3jS7qF8+Sg1P3eo1P3zaQ7lqBPO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304233", "to_ids": false, "type": "size-in-bytes", "uuid": "9b83917b-7526-4188-9e3e-90f24295d84b", "value": "1191" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "object_relation": "vhash", "timestamp": "1784304233", "to_ids": true, "type": "vhash", "uuid": "53c56c34-dc6a-43e6-a17a-b63725b0442b", "value": "9a821fd542dd892f9ebd94d8ed9f7812" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-22T14:26:24+00:00", "last_seen": "2026-06-22T14:26:24+00:00", "object_relation": "filename", "timestamp": "1784304233", "to_ids": true, "type": "filename", "uuid": "6b851096-366d-43b5-9f71-34e2619e7557", "value": "Rate_Confirmation_LD-2026-0847.bat" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306961", "uuid": "13705aad-2c8b-48c0-bd54-b99f70756d3a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "md5", "timestamp": "1784306961", "to_ids": true, "type": "md5", "uuid": "48e0876b-c747-441e-b25d-e8f0c01e9690", "value": "dcf817f2fa93f01ee0654f5cbcbc50b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "sha1", "timestamp": "1784305105", "to_ids": true, "type": "sha1", "uuid": "012d4dc4-ba3c-47d6-9092-f4f82055b56c", "value": "8813148f78c668d91fdf7af4e9b62727af4a8557", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "sha256", "timestamp": "1784305105", "to_ids": true, "type": "sha256", "uuid": "609019bb-d6b8-4df5-9ae8-6d64537bf55b", "value": "53f1da8a032115aa682749a114f4cfebcb5ef933400a89b4bbfa84f2057222ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "text", "timestamp": "1784304254", "to_ids": false, "type": "text", "uuid": "3fbec70b-7186-4e01-8dbd-92e851cf8370", "value": "Type Description: Win32 EXE\nMicrosoft: TrojanDownloader:Win64/CrysomeRAT!MSR\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2026-06-19T16:31:06+00:00\nLast Submission: 2026-06-19T16:31:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "creation-time", "timestamp": "1784304255", "to_ids": false, "type": "datetime", "uuid": "3ed7923a-c402-4ad9-829e-640c3d65a781", "value": "2026-06-19T00:48:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "ssdeep", "timestamp": "1784304254", "to_ids": true, "type": "ssdeep", "uuid": "9d9d53f6-faa6-4890-9e6b-37a1e9c40951", "value": "3072:pREfAG3/KHOfLndXFMBLlE5d8nBeiO4JoX7KPFTtZ4jum:pR2H3/nEgMnB53Wum" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304254", "to_ids": false, "type": "size-in-bytes", "uuid": "fdf5e02b-aa9e-4faa-ac6d-101c5d230f57", "value": "175616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "vhash", "timestamp": "1784304254", "to_ids": true, "type": "vhash", "uuid": "523d931d-7029-4739-9457-7be2977fbe2a", "value": "015066655d155d055az52!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T16:31:06+00:00", "last_seen": "2026-06-19T16:31:06+00:00", "object_relation": "filename", "timestamp": "1784304254", "to_ids": true, "type": "filename", "uuid": "32b12a94-2193-46fe-9a7e-d8fc73481271", "value": "ElevatorShellCode.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306983", "uuid": "7fc16f75-a661-497d-8063-6fa6a2a81bf2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "object_relation": "md5", "timestamp": "1784306983", "to_ids": true, "type": "md5", "uuid": "d72217c2-beb0-4f93-948d-ba760e57b7d1", "value": "af46b89c4eadabc82097c34a3a106715", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "object_relation": "sha1", "timestamp": "1784305106", "to_ids": true, "type": "sha1", "uuid": "8570cd13-f062-47bc-8403-4455b7509fa3", "value": "79a617ac7b0b041901b319384950cc255762a4bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "object_relation": "sha256", "timestamp": "1784305106", "to_ids": true, "type": "sha256", "uuid": "3731f4d4-4f0a-48bf-85f6-b2635390d59f", "value": "ced4407f4ac7e43c1a3010a394d111d2ad1b50a2e95668b4e9cfe739235e67bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "object_relation": "text", "timestamp": "1784304276", "to_ids": false, "type": "text", "uuid": "f21558f8-fa6d-4961-ad74-4cdfe5886105", "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 14/74\nFirst Seen In The Wild: 2026-07-10T05:04:55+00:00\nFirst Submission: 2026-07-07T08:02:50+00:00\nLast Submission: 2026-07-07T08:02:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "object_relation": "ssdeep", "timestamp": "1784304276", "to_ids": true, "type": "ssdeep", "uuid": "cfdf23c5-c9ea-4179-b9b8-38ec9e536a03", "value": "48:lPoDSZDOOWIvn2mbROyerDlQMDl4MDlr+MDlryMDBI1n+1RBu9EebWGPTiDTWIBM:l9EOfumbE1r/F9BIN+d2EW98CwtK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304276", "to_ids": false, "type": "size-in-bytes", "uuid": "de7844b7-7666-42ad-ab0d-beceb0d5debe", "value": "3000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "object_relation": "vhash", "timestamp": "1784304276", "to_ids": true, "type": "vhash", "uuid": "99015d0c-8079-4c29-b7eb-76201405e24c", "value": "1d488e553640010736df0c39dc76c146" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-07T08:02:50+00:00", "last_seen": "2026-07-07T08:02:50+00:00", "object_relation": "filename", "timestamp": "1784304276", "to_ids": true, "type": "filename", "uuid": "264ea608-470a-47b3-8c4c-50ee9ff32aab", "value": "stage.ps1" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307004", "uuid": "696ea8d1-9a05-4c3b-bd28-3cdcddf1e20a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "md5", "timestamp": "1784307004", "to_ids": true, "type": "md5", "uuid": "d80d3905-f87b-4fa6-b008-1a192a9b9546", "value": "45a2228e44257169210cc5dc06e12a6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "sha1", "timestamp": "1784305107", "to_ids": true, "type": "sha1", "uuid": "bccd9aec-e01c-43c1-8da2-df8761aa910a", "value": "de2df0905ece1a1e7f0a70adf36c75deb06b4e4b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "sha256", "timestamp": "1784305108", "to_ids": true, "type": "sha256", "uuid": "e4a3dd90-a484-4451-ab9a-2a9426a8931e", "value": "b7ca8fd9ebe0a76f16deea315fac7ee94dcb18e6ac2832b5c4cb562fbc6e0ed3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "text", "timestamp": "1784304298", "to_ids": false, "type": "text", "uuid": "53ba1635-21ae-4d87-982a-9d7b4852160d", "value": "Type Description: Win32 EXE\nOriginal name: WinDefCtl.exe\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 36/74\nFirst Submission: 2026-05-28T08:51:18+00:00\nLast Submission: 2026-06-27T04:01:51+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "creation-time", "timestamp": "1784304298", "to_ids": false, "type": "datetime", "uuid": "8ec5f64c-9727-445c-965d-29105e611b23", "value": "2082-06-28T00:01:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "ssdeep", "timestamp": "1784304298", "to_ids": true, "type": "ssdeep", "uuid": "e9e6eb97-3887-4624-a423-960f9caf0e74", "value": "6144:9n/vVpsKlkUnz7bLW8RMtZdyq61P/gDHxkJsFNS+T9U6ST8x5vjA:/p/nzTRM3sF/gDiaNSu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304298", "to_ids": false, "type": "size-in-bytes", "uuid": "0e10d3d6-d3de-4273-af69-0ee020e69663", "value": "388096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "vhash", "timestamp": "1784304298", "to_ids": true, "type": "vhash", "uuid": "d02027b7-c007-4bfd-a8ed-e356768da30e", "value": "035076655d155d05655175z1006d7z37z12z18fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T08:51:18+00:00", "last_seen": "2026-06-27T04:01:51+00:00", "object_relation": "filename", "timestamp": "1784304298", "to_ids": true, "type": "filename", "uuid": "7d95ac75-cbb1-459b-866b-bcb069ed3f5d", "value": "WinDefCtl.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307025", "uuid": "6659f60a-e3a9-4589-b8e1-742a40dd5419", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "md5", "timestamp": "1784307025", "to_ids": true, "type": "md5", "uuid": "f2bb1a74-5fd2-4bec-b1d5-d93e9b4c1b4f", "value": "8567983c4fde4b108b2a7168ecbf7997", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "sha1", "timestamp": "1784305109", "to_ids": true, "type": "sha1", "uuid": "a8324de8-2fb6-41aa-a280-529e223721ac", "value": "3824e0677dd6d925bec4c2e99f1498ce2d0ad821", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "sha256", "timestamp": "1784305109", "to_ids": true, "type": "sha256", "uuid": "c822c3d3-c4e4-4520-a5b3-9d8e84ad7228", "value": "c380268d493e0cba914ce2bc55faa1d7c050c599893c3196fee01fa745e6466a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "text", "timestamp": "1784304319", "to_ids": false, "type": "text", "uuid": "2427049d-9f71-491c-9777-a78b82038fa5", "value": "Type Description: Win32 EXE\nOriginal name: Crysome.Client.exe\nMicrosoft: Trojan:MSIL/Crysome!AMTB\nClamAV: None\nVT Total Detection: 53/74\nFirst Seen In The Wild: 2026-07-10T16:16:07+00:00\nFirst Submission: 2026-06-17T16:39:06+00:00\nLast Submission: 2026-06-17T16:40:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "creation-time", "timestamp": "1784304320", "to_ids": false, "type": "datetime", "uuid": "002c7c8c-de73-451d-a216-444b2f725a5d", "value": "2053-10-07T04:59:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "ssdeep", "timestamp": "1784304319", "to_ids": true, "type": "ssdeep", "uuid": "9cd71af1-2972-43fe-9935-38a64c3d7a59", "value": "12288:fhoUZeviEqMeV89bROjl/1yJIRHqPuCA6H4pD0ai95WQHlTS:iUkn7eWBR5JIRR16zxvWaTS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304319", "to_ids": false, "type": "size-in-bytes", "uuid": "e30efae2-5721-4d63-a038-efe325871fe3", "value": "521943" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "vhash", "timestamp": "1784304319", "to_ids": true, "type": "vhash", "uuid": "3cc9048c-6d01-4a27-b175-6097a9421e9b", "value": "25503675151220c2aaa5db3f98" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T16:39:06+00:00", "last_seen": "2026-06-17T16:40:43+00:00", "object_relation": "filename", "timestamp": "1784304319", "to_ids": true, "type": "filename", "uuid": "0edecea4-63f2-4a9d-b9b2-8cc3b34fab68", "value": "Crysome.Client.exe" } ] } ] } }