{ "Event": { "analysis": "1", "date": "2026-06-03", "extends_uuid": "", "info": "[Threat Intel] The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP", "protected": false, "publish_timestamp": "1782537224", "published": true, "threat_level_id": "3", "timestamp": "1782537218", "uuid": "636a805b-58f3-442e-9a0a-72b9d7e7f244", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#7eb739", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Msiexec - T1218.007\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#4f539c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Invalid Code Signature - T1036.001\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#98f3da", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#14b0bf", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Logon Script (Windows) - T1037.001\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Havoc\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted/Encoded File - T1027.013\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"malaysia\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"KongTuke\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Windows\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"googleapis\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:software-vendor=\"microsoft\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570822", "to_ids": false, "type": "link", "uuid": "eae3bcf8-7341-452b-9a41-148b6d4b175d", "value": "https://www.levelblue.com/blogs/spiderlabs-blog/the-demon-arrives-later-a-havoc-stager-hides-behind-microsoft-defender-dlp" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780570822", "to_ids": false, "type": "text", "uuid": "8bbab89e-915f-4300-a92b-61a2ce7b7ea6", "value": "Cybercriminals in Brazil are exploiting the country's electronic invoice system (Nota Fiscal eletr\u00f4nica) to deliver Havoc framework implants. The campaign surfaced during May 2026, coinciding with tax season when accountants routinely process invoice-related emails. Attackers distribute malicious ZIP files disguised as legitimate invoices, containing VBScript droppers that download MSI installers from Google Cloud Storage. These installers deploy a fake Microsoft Defender DLP module (endpointdlp.dll) alongside a legitimate signed executable. The stager DLL downloads Havoc demon shellcode from command-and-control infrastructure at runtime, never writing the final payload to disk. Analysis reveals nine stager variants originating from a single builder, distributed through multiple channels including Brazilian NF-e-themed lures and Malaysia-registered domains. The implant establishes persistence through the rarely-monitored UserInitMprLogonScript registry key and employs advanced anti-forensic techniques incl..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780570822", "to_ids": false, "type": "text", "uuid": "c3c814d5-e692-45d1-9e75-86957be4fa64", "value": "Name: The Demon Arrives Later: A Havoc Stager Hides Behind Microsoft Defender DLP\nAuthor: AlienVault\nAdversary: \nTags: [\"brazil tax lure\", \"invoice phishing\", \"kongtuke\", \"havoc\", \"banana rat\"]\nTgtd countries: [\"Brazil\"]\nMlwr families: [\"Havoc\", \"Banana RAT\", \"KongTuke\"]\nAttack_ids: [\"T1036.005\", \"T1497.001\", \"T1566.002\", \"T1218.007\", \"T1140\", \"T1055\", \"T1218\", \"T1112\", \"T1090\", \"T1547.001\", \"T1562.001\", \"T1027\", \"T1036.001\", \"T1071.001\", \"T1059.005\", \"T1574.002\", \"T1105\", \"T1037.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624416", "to_ids": true, "type": "domain", "uuid": "26c7ecea-9749-4ac6-a455-e3ad24fc09bd", "value": "thomphon.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624438", "to_ids": true, "type": "domain", "uuid": "4357bd90-e5f5-4c89-876f-f30b3110c938", "value": "e4wxbrg5277.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624459", "to_ids": true, "type": "domain", "uuid": "0827e03d-bd70-4cfc-812c-2c0567a70533", "value": "49xb5hoiqsr.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624480", "to_ids": true, "type": "domain", "uuid": "38830fe1-b701-40a8-98b9-5ce6d8785d52", "value": "jh038x18gy9.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624501", "to_ids": true, "type": "ip-dst", "uuid": "b8509298-69e6-4dde-bd58-a95bcafb4a9c", "value": "194.62.55.81", "Tag": [ { "colour": "#0e8620", "local": false, "name": "asn:asn=\"61084\"", "relationship_type": "" }, { "colour": "#f8d373", "local": false, "name": "asn:as-owner=\"SIBERDC\"", "relationship_type": "" }, { "colour": "#0c8c8d", "local": false, "name": "asn:as-country=\"TR\"", "relationship_type": "" }, { "colour": "#ae20ff", "local": false, "name": "misp-galaxy:country=\"turkey\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570822", "to_ids": false, "type": "vulnerability", "uuid": "09c7fa19-6f34-4834-b7bc-305a8c36b437", "value": "CVE-2026-45585" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623512", "to_ids": true, "type": "sha256", "uuid": "acd9ad39-e7fb-4fa8-a556-953094b08db1", "value": "eca5c297008e7c07a5c6fc9070c03121d702ef093b4a8e508b712040d87fed36", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623513", "to_ids": true, "type": "sha256", "uuid": "fb1f3289-e280-4b53-b3c3-24245a904198", "value": "ced6b0f4441085bb9c54a32da9ab4ba14c6e21daf6e34fd61d54923f87baacd0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623514", "to_ids": true, "type": "md5", "uuid": "337e2cf3-dc6b-4bfc-a250-4f7ea5650e32", "value": "07d0d4c580ac76ac3ffb63353c9b6b85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623515", "to_ids": true, "type": "md5", "uuid": "6339363b-e595-444f-a12c-99bab6a3826e", "value": "7d384886720c8e576c3ca9d68cb5f08b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624526", "to_ids": true, "type": "ip-dst", "uuid": "092a073b-8581-481b-b1a8-a3089b275a03", "value": "194.59.31.192", "Tag": [ { "colour": "#5dbc62", "local": false, "name": "asn:asn=\"399486\"", "relationship_type": "" }, { "colour": "#455150", "local": false, "name": "asn:as-owner=\"VIRTUO\"", "relationship_type": "" }, { "colour": "#1273fb", "local": false, "name": "asn:as-country=\"CA\"", "relationship_type": "" }, { "colour": "#813aa0", "local": false, "name": "misp-galaxy:country=\"canada\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623516", "to_ids": true, "type": "sha1", "uuid": "4bcab272-70e9-4908-892a-b1f406f3c778", "value": "b032d4ec4e24714f59e853da9b6e63794aacdbcb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624547", "to_ids": true, "type": "url", "uuid": "ee22a243-cb05-44ad-86f4-7c48ecf75b66", "value": "https://tr.ee/lAZ5yi", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624569", "to_ids": true, "type": "url", "uuid": "78987259-a803-4c78-8d77-b242dc9bb172", "value": "https://storage.googleapis.com/nodesdownload/update.msi", "Tag": [ { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624590", "to_ids": true, "type": "url", "uuid": "14a2b3b5-a430-40a9-ad3a-7747a16ed547", "value": "https://e4wxbrg5277.com/dl/update.zip?tk=", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624611", "to_ids": true, "type": "url", "uuid": "e34006ac-1b15-43d4-ab89-6119679f97e0", "value": "https://49xb5hoiqsr.com/dl/update.zip?tk=", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624632", "to_ids": true, "type": "url", "uuid": "5bb0b189-b8a0-4d06-adef-d6776316b961", "value": "https://jh038x18gy9.com/dl/update.zip?tk=", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 8443", "deleted": false, "disable_correlation": false, "timestamp": "1780618890", "to_ids": true, "type": "ip-dst|port", "uuid": "5a29ea69-d3bf-458c-a217-ad9b0955ee71", "value": "194.59.31.192|8443" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780624653", "to_ids": true, "type": "ip-dst", "uuid": "1e3b767c-1bcc-435a-8d6a-b95f95f6f3cb", "value": "143.198.183.46", "Tag": [ { "colour": "#c2074e", "local": false, "name": "asn:asn=\"14061\"", "relationship_type": "" }, { "colour": "#d7952a", "local": false, "name": "asn:as-owner=\"DIGITALOCEAN-ASN\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name) along with its version.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "7", "timestamp": "1780618868", "uuid": "2f0a317c-8cbf-4d91-bc73-903a0a01685e", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1780618868", "to_ids": false, "type": "text", "uuid": "5e4b6c67-598e-4848-bfbb-0f29594064da", "value": "Havoc_endpointdlp_Stager_2026" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1780618868", "to_ids": false, "type": "comment", "uuid": "36804f65-1404-48b3-8d6a-7a3f97471281", "value": "Havoc stager: fake Defender DLP VERSIONINFO, zero sig, operator imphash or /stage/ + /api/v2/telemetry/diag strings" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1780618868", "to_ids": true, "type": "yara", "uuid": "cf4233b4-00aa-4c7c-854f-d6ece53370f4", "value": "import \"pe\"\r\n\r\nrule Havoc_endpointdlp_Stager_2026\r\n{\r\n meta:\r\n description = \"Havoc stager: fake Defender DLP VERSIONINFO, zero sig, operator imphash or /stage/ + /api/v2/telemetry/diag strings.\"\r\n author = \"LevelBlue SpiderLabs\"\r\n date = \"2026-05-18\"\r\nstrings:\r\n $ms_dlp = \"Microsoft Defender Endpoint DLP\" wide\r\n $dragon = \"Dragon Data Protection\" wide\r\n $msver = \"4.18.26100.1\" wide\r\n $stage_path = \"/stage/\" wide\r\n $diag_path = \"/api/v2/telemetry/diag\" wide\r\n $msdo_ua = \"Microsoft-Delivery-Optimization\" wide\r\ncondition:\r\n (uint16(0) == 0x5A4D) and pe.number_of_signatures == 0\r\n and (\r\n (1 of ($ms_dlp, $dragon) and $msver\r\n and (pe.imphash() == \"07d0d4c580ac76ac3ffb63353c9b6b85\"\r\n or pe.imphash() == \"7d384886720c8e576c3ca9d68cb5f08b\"))\r\n or all of ($stage_path, $diag_path, $msdo_ua)\r\n )\r\n}" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624674", "uuid": "c52adf47-52b4-45dd-8239-7249907606e0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624674", "to_ids": true, "type": "md5", "uuid": "d676e35f-5f8c-49cc-9121-87a1fa743ac8", "value": "347a3f5f2ed2f503a22f68c4951c78c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623487", "to_ids": true, "type": "sha1", "uuid": "796f2dbb-9e1d-4c5e-8fcf-97abb199325b", "value": "fd8e880cc32377af08327c9d187f6220c6ac449f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623487", "to_ids": true, "type": "sha256", "uuid": "687af571-6cd0-4a52-8082-2358615ef2c0", "value": "fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622271", "to_ids": true, "type": "ssdeep", "uuid": "acea72e8-28b3-4c0b-88da-2c4887d9599a", "value": "24576:PZmEAFPua6zEDBiqGEpHFSwB3Qnc9PYUqdsc9lY+WZVWgH:P/aAUsp4rg+PYUxcg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622271", "to_ids": false, "type": "size-in-bytes", "uuid": "fb98a32f-5a6a-4ad6-ab8c-099210075541", "value": "1490944" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622271", "to_ids": true, "type": "vhash", "uuid": "af695865-ac3c-4ed9-8321-4c1541681d0b", "value": "116066655d6555151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622271", "to_ids": true, "type": "filename", "uuid": "c43169d4-fdde-40b7-a1e8-fdfee5ea117f", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 02/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622271", "to_ids": false, "type": "text", "uuid": "507e5fff-47ea-4c83-b524-51ae996160ca", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Havoc.MX!MTB\nVT Total Detection:44/71\nFirst Submission:2026-04-20T13:24:15.000000+00:00\nLast Submission:2026-04-20T14:38:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624695", "uuid": "6753361b-ebcd-4ef5-8bf1-434116171824", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624695", "to_ids": true, "type": "md5", "uuid": "7f34717f-d8f9-4d8d-9274-58dd0246aaf9", "value": "3fe903c9d39790de3bf6c1a8a2217d29", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623488", "to_ids": true, "type": "sha1", "uuid": "38b25e91-65f1-4769-98d2-70a52da48fe2", "value": "1922bd8df7bf2964c03fcc7dff510e9ea283ae3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623488", "to_ids": true, "type": "sha256", "uuid": "7afb5360-e059-46ce-8508-21edc1d0332f", "value": "0743154262c5ccf24794168ee331feeefc6539386715307ee44d5d9b6b321077", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622293", "to_ids": true, "type": "ssdeep", "uuid": "1eb53222-b0e7-4bc7-b8ab-1539930d45ef", "value": "24576:DN+47oyrLhUM0VYroHgQHHpbCw+sYA/AnQMUIJDQQbetfJw0Uhza2z4Li42GD7Vu:DNoOeeusmYA/JyJD190Uhu557VVl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622293", "to_ids": false, "type": "size-in-bytes", "uuid": "9d97f066-8bfd-45b0-8577-3d26d77b7b30", "value": "2426880" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622293", "to_ids": true, "type": "vhash", "uuid": "760a4426-51ac-4a94-9a98-2c78d8484078", "value": "ad48d7750921ab06b999e8564035f19c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622293", "to_ids": true, "type": "filename", "uuid": "371f4522-7181-444c-8c3a-6aa1b09af91c", "value": "0743154262c5ccf24794168ee331feeefc6539386715307ee44d5d9b6b321077.tar" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622293", "to_ids": false, "type": "text", "uuid": "32dcdea0-bb6c-4745-9cd9-7780b105f47d", "value": "Type Description: TAR\nMicrosoft: None\nVT Total Detection:36/63\nFirst Submission:2026-04-29T14:36:57.000000+00:00\nLast Submission:2026-04-29T14:36:57.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624717", "uuid": "58b342bc-643a-4c67-936c-8b2bff87a107", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624717", "to_ids": true, "type": "md5", "uuid": "fe2fa7ae-2954-44c6-a040-04fa53cf6aa5", "value": "63e45ffa6d0c22cb04646ef549d61065", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623489", "to_ids": true, "type": "sha1", "uuid": "d9bbe392-caab-486a-9e28-9a86a63dc1f0", "value": "34e20e58b54e241596dfb2b87451b42f6bbaea95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623489", "to_ids": true, "type": "sha256", "uuid": "6fa18c1c-c41f-4461-a291-495006e43b7b", "value": "d24216d0b82747e9406a696da76960183926145f9621947e34a772137f5e22a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622315", "to_ids": true, "type": "ssdeep", "uuid": "dafcfd38-d358-424a-9a70-aa927265f537", "value": "24576:JZozSag/f5OBxUNt0/imuoIYTxsiA8MFMn/9LTfKSGgqW6:Jxag/Ixa0/i8BTxsiA8F/9vKHgy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622315", "to_ids": false, "type": "size-in-bytes", "uuid": "dc2db5cd-2f44-421a-a41a-47a3ecd6cb93", "value": "1122304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622315", "to_ids": true, "type": "vhash", "uuid": "b4d7ef63-46cd-4e32-b1c7-d1f27bdaa76d", "value": "c0898bab35bfdb4cf79d4dc80efd6624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622315", "to_ids": true, "type": "filename", "uuid": "920c33b1-1bfb-417d-ba0a-2aa1a833d54a", "value": "NFE-43250902055205000108550010000269881023835318-1.msi" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 07/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622315", "to_ids": false, "type": "text", "uuid": "638ce017-2c06-4263-8f1a-ed6bc6ba5de2", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nVT Total Detection:32/62\nFirst Submission:2026-05-02T19:52:08.000000+00:00\nLast Submission:2026-05-13T20:29:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624740", "uuid": "eb759788-2af4-4bf7-823b-66172831e9dd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624740", "to_ids": true, "type": "md5", "uuid": "5125ae74-a37a-4081-bf50-2702064173d6", "value": "ce9abf0dab1facd7afeb70dc34925a78", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623490", "to_ids": true, "type": "sha1", "uuid": "22fb611f-b1eb-4382-a1df-43c86148965b", "value": "149f5cfe98e06f9f7fb6d29dd271830c02250f9d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623491", "to_ids": true, "type": "sha256", "uuid": "0979ed02-4ec4-448c-98e6-a42861262318", "value": "f2357e70f359803d42298d016c7e1631e9fba6c7e01e5df1eb8fb9ff7eb3df4e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622336", "to_ids": true, "type": "ssdeep", "uuid": "6387c12f-3d83-4479-ae68-257224cc146e", "value": "12:vYvAGThYaFR9pHySlQA5Y9FaLlZFg05tADJRA57zd/A57jHMJ4dk:v0AEpFly6EFmZFg0DA9mVxIBHzk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622336", "to_ids": false, "type": "size-in-bytes", "uuid": "71e7e64d-4604-4176-8426-7a75a325b753", "value": "503" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622336", "to_ids": true, "type": "vhash", "uuid": "e4a841fa-f394-4132-a961-9f41e5b147e7", "value": "b3f17acf2ceed0dba7c3aeb27a31465d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622336", "to_ids": true, "type": "filename", "uuid": "f975d158-9a1a-4eb6-9122-c8748f315cb0", "value": "NFE-43250902055205000108550010000269881023835318-1.vbs" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622336", "to_ids": false, "type": "text", "uuid": "0b122527-3ff0-43fd-bc17-f73fb194c0ef", "value": "Type Description: VBA\nMicrosoft: Trojan:Script/Wacatac.B!ml\nVT Total Detection:9/61\nFirst Submission:2026-05-02T19:52:08.000000+00:00\nLast Submission:2026-05-12T13:40:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624762", "uuid": "cc53e201-5f37-4c62-80eb-9a9b4d33391e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624762", "to_ids": true, "type": "md5", "uuid": "df21d192-1b13-4d32-a620-e52b39c2dc7f", "value": "659575cb45a67b4d0c70e7361709fb03", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623492", "to_ids": true, "type": "sha1", "uuid": "2d63e71b-5829-451e-8b37-63baa5f9134a", "value": "2b258b5cd3fc997d537ab92b7ebe2d42349a6f92", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623492", "to_ids": true, "type": "sha256", "uuid": "a1de5701-311d-42c7-9f60-146c96439590", "value": "3578e1588846a805ee806fa6151b5801d0acb88879a93d378300e2ee7665736e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622358", "to_ids": true, "type": "ssdeep", "uuid": "d07a4f6c-511e-4400-a0de-e767554939a6", "value": "24576:Q9SzEaM/nxKBxsNtYbiguo6uTxs+bYFonJHT9fAKilGc:Q1aM/QxiYbii/TxsonJHNAfGc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622358", "to_ids": false, "type": "size-in-bytes", "uuid": "245cc0de-1403-4118-8f58-9c9296ac759d", "value": "1094969" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622358", "to_ids": true, "type": "vhash", "uuid": "fe5228e6-756c-43bc-a505-2d7b29ceecce", "value": "662dc2d71feb19965c34250d776c7371" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622358", "to_ids": true, "type": "filename", "uuid": "2d5e5e46-e868-496d-ac25-9d2947fcc8a4", "value": "NFE-43250902055205000108550010000269881023835318-1.zip" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622358", "to_ids": false, "type": "text", "uuid": "f7e04194-c44f-467b-8583-59352db42b9d", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:33/66\nFirst Submission:2026-05-02T19:46:26.000000+00:00\nLast Submission:2026-05-02T19:46:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624783", "uuid": "51f6b055-8e64-4cb2-ab04-5ce78c8c4e1c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624783", "to_ids": true, "type": "md5", "uuid": "9b0fadc2-15a7-46b6-981a-04f273db3e21", "value": "9d066964414cff647beeecb75affb5b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623493", "to_ids": true, "type": "sha1", "uuid": "4c399d0e-e980-4d24-822c-7b90f49ac501", "value": "e47d2c9f62adbffff5353e21e212d98de869c81d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623493", "to_ids": true, "type": "sha256", "uuid": "c5eef1d8-8944-4910-9db4-3f0fc8696c71", "value": "7d4fb94f6b4623690daea67ed52e97705cb102f443988ff605f2a9c4898244dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622380", "to_ids": true, "type": "ssdeep", "uuid": "0decbf31-0e0f-4311-854d-256297770bde", "value": "24576:ZLPAAWVt+5pxI929P2V7np67rSs2E4HNjn:Z8gk929+7p6H2D" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622380", "to_ids": false, "type": "size-in-bytes", "uuid": "bc4193e1-7ab3-4486-85c5-853f0739b9a1", "value": "1187840" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622380", "to_ids": true, "type": "vhash", "uuid": "42d94bd1-3eab-4d15-9482-d89d0df41015", "value": "116066655d6555151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622380", "to_ids": true, "type": "filename", "uuid": "5c7d9f7a-e7c6-4901-b747-e4a5bee9f284", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 05/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622380", "to_ids": false, "type": "text", "uuid": "539175c4-3f07-44fa-8b1f-a0ec2d74038f", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Havoc.MX!MTB\nVT Total Detection:48/71\nFirst Submission:2026-05-02T19:53:44.000000+00:00\nLast Submission:2026-05-02T19:53:44.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624804", "uuid": "27cbaec3-89dd-477a-b50e-e9c79aef29f0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624804", "to_ids": true, "type": "md5", "uuid": "1b027982-d231-46b7-b4b2-79471e3a053a", "value": "01b43dad62e56164771db696827a30ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623494", "to_ids": true, "type": "sha1", "uuid": "7e03930c-970a-4b1b-be61-cb64cfe070a6", "value": "b14e1f931f602b1e1985d1362db0e17dd2d2131f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623495", "to_ids": true, "type": "sha256", "uuid": "bb9b29c9-19d4-40b4-863a-0ebebeb2ffa9", "value": "1d09357b6a096fdc35cd5c873eed15665d6b3c879d20c8cf01e6bca0005512cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622422", "to_ids": true, "type": "ssdeep", "uuid": "92f67570-c28a-44ad-8698-63043c70667e", "value": "24576:DN+47oyrLhUM0VYroHgQHHpbCw+sYA/AnQM:DNoOeeusmYA/J" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622422", "to_ids": false, "type": "size-in-bytes", "uuid": "4c1a6bdc-2834-40ce-b61e-5efc556a85b3", "value": "1205760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622422", "to_ids": true, "type": "vhash", "uuid": "f8ae8b64-8903-4a94-b06e-77f735ae38b6", "value": "116066655d6555151038z1c7z2dz2eze" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622422", "to_ids": true, "type": "filename", "uuid": "b554a07d-e7f3-4d4e-937c-189ddfc20f0b", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 05/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622422", "to_ids": false, "type": "text", "uuid": "467f878b-ba1f-4a00-9900-23160aa7aedc", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:35/70\nFirst Submission:2026-04-29T08:57:54.000000+00:00\nLast Submission:2026-04-29T08:57:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624825", "uuid": "da36ad3b-ee2c-4486-b7f2-6155cc32d764", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624825", "to_ids": true, "type": "md5", "uuid": "ccd44f2f-b5df-4610-8f5b-486642371e2a", "value": "4442897e3b772dfa4f7af109bec8924d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623496", "to_ids": true, "type": "sha1", "uuid": "b84dcef1-b308-47c2-a7c5-74fb2d4372c7", "value": "aeb63fc27339747fa922f52ae58d32f8c978ee71", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623496", "to_ids": true, "type": "sha256", "uuid": "e5cab791-d7ab-4bf2-9cd7-418765636a0d", "value": "d2c637235d62ad766f961f9b8563f6a0e6db2ec0a343470385991b4df826afbc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622444", "to_ids": true, "type": "ssdeep", "uuid": "ed4a90ac-ae3f-423e-af6f-d541388f6234", "value": "24576:FN+47oyrLhUM0VYroHgQHHpbCw+sYA/AnQM:FNoOeeusmYA/J" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622444", "to_ids": false, "type": "size-in-bytes", "uuid": "c107e02d-a453-45a6-b386-f72e08dbcb59", "value": "1205760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622444", "to_ids": true, "type": "vhash", "uuid": "1ebc542b-c8f9-49ba-88bf-c643ab1ec3a9", "value": "116066655d6555151038z1c7z2dz2eze" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622444", "to_ids": true, "type": "filename", "uuid": "4a3c82e3-3abf-4392-8d53-2f49e01b94e7", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622444", "to_ids": false, "type": "text", "uuid": "7ef1cfbf-83c6-45fe-a4f3-919e0709a3d3", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Zusy!MTB\nVT Total Detection:47/71\nFirst Submission:2026-04-29T14:37:26.000000+00:00\nLast Submission:2026-05-01T13:01:15.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624849", "uuid": "9ce8cd41-a278-4ede-851b-6fc84da75820", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624849", "to_ids": true, "type": "md5", "uuid": "116217ad-b471-46c7-9ab4-50ada3de06bd", "value": "a9198c1497481b2fea007ea5f13eafbf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623497", "to_ids": true, "type": "sha1", "uuid": "43aee3f4-99f4-48a6-a231-190b148814a5", "value": "29b38a57b22f0a442e4e731525aeada927ea2f56", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623497", "to_ids": true, "type": "sha256", "uuid": "2b084a40-1839-4833-b584-45d2e341612f", "value": "1fc515870c681bf3e1b7947e2248bbcfe9918db2978117e91134de20bd42fd6a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622466", "to_ids": true, "type": "ssdeep", "uuid": "24bd0401-676f-45da-812a-a8b568ec2bb7", "value": "24576:ZLPAAWVt+5pxI929P2V7np67rSs2E4HNjn:Z8gk929+7p6H2D" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622466", "to_ids": false, "type": "size-in-bytes", "uuid": "bc659f21-1fed-4564-9444-805d98195c43", "value": "1187840" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622466", "to_ids": true, "type": "vhash", "uuid": "85999e9e-9e88-4efa-a719-88ef53e76153", "value": "116066655d6555151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622466", "to_ids": true, "type": "filename", "uuid": "f976f374-27ee-4242-a661-e511ca59560f", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 31/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622466", "to_ids": false, "type": "text", "uuid": "26e0dc13-0db9-46f7-aada-51215046ad17", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Havoc.MX!MTB\nVT Total Detection:46/71\nFirst Submission:2026-05-08T08:37:34.000000+00:00\nLast Submission:2026-05-08T08:37:34.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624870", "uuid": "a8e4940f-55ce-4868-9dbf-4b3784268dea", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624870", "to_ids": true, "type": "md5", "uuid": "e74fcde2-81fa-4e23-8eb2-195c4c31010b", "value": "6b8ec32dc76fa3138f00616156962f4f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623498", "to_ids": true, "type": "sha1", "uuid": "1857f1a1-52a7-4ed0-a0b1-16434731fe98", "value": "deb10789274bf903060d700b3472fdf094a14763", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623499", "to_ids": true, "type": "sha256", "uuid": "8c142190-c1e5-4dbd-8695-b61559cb7790", "value": "afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622509", "to_ids": true, "type": "ssdeep", "uuid": "1a6983be-f9b7-4d7a-9065-87fea4b19ef5", "value": "24576:cNzdl3kHK1wimsrF3dwmo1DfPVUjmElHWIRw5QTOJug77:mmK1zHFKmoBVoN5WGp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622509", "to_ids": false, "type": "size-in-bytes", "uuid": "fae7c4a8-6ee9-49b7-a3c7-09980d43430b", "value": "1388544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622509", "to_ids": true, "type": "vhash", "uuid": "a7ac4869-0ea4-4df2-9923-920dba83557a", "value": "116066655d6555151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622509", "to_ids": true, "type": "filename", "uuid": "7c06ce49-6c16-4563-b745-4323177960f4", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622509", "to_ids": false, "type": "text", "uuid": "92304597-7500-40f8-aa2e-989f736a8aeb", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Cobaltstrike!MSR\nVT Total Detection:41/71\nFirst Submission:2026-04-14T23:23:12.000000+00:00\nLast Submission:2026-04-14T23:23:12.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624892", "uuid": "a7d20960-095e-47e3-9934-30cfeb32e968", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624892", "to_ids": true, "type": "md5", "uuid": "b315a566-5582-4907-b392-aceccbad3b50", "value": "08060143ea9b55b480746b415af22e3a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623500", "to_ids": true, "type": "sha1", "uuid": "93f538fb-46d9-40f2-945c-f680cb795f04", "value": "4b7dbb7d5bc8938747b39faf602d85c3587ae261", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623500", "to_ids": true, "type": "sha256", "uuid": "174a0790-c8cd-4bff-9101-40bd1a9c8722", "value": "2cd88d5280a61714836f5f07a16df190911c5b952af2998dbbcda910b3b1c494", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622531", "to_ids": true, "type": "ssdeep", "uuid": "047aa0b7-3860-45c2-a010-2f519901bbf2", "value": "24576:+yUQiaFkWiqFYJGy1FDZYBr3IdjAg9Ogj1/:+yzHKdbl7HN" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622531", "to_ids": false, "type": "size-in-bytes", "uuid": "148d0c02-62b4-4619-b5b8-f0dc5585305c", "value": "1527296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622531", "to_ids": true, "type": "vhash", "uuid": "9c56268c-18c0-4500-a0af-48d044c3a456", "value": "116066655d6555151038z137z2dz2ezd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622531", "to_ids": true, "type": "filename", "uuid": "8b886248-e86f-4af8-be67-7bfdfd4946d9", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 28/04/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622531", "to_ids": false, "type": "text", "uuid": "804d55ca-a7f3-4266-b53e-977186cbcb6c", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:37/71\nFirst Submission:2026-04-13T20:14:52.000000+00:00\nLast Submission:2026-04-13T20:14:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624913", "uuid": "6cbf0cf7-f0ee-4291-82e9-821beb04b1ac", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624913", "to_ids": true, "type": "md5", "uuid": "b361330a-e86a-4606-9cea-b73624a31769", "value": "f799ea5df9ec08690385d0972aefb59d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623501", "to_ids": true, "type": "sha1", "uuid": "ca362fb9-41e5-4951-849c-c077c44a7982", "value": "86ff1313888780942c6a0ad2f683312911582498", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623501", "to_ids": true, "type": "sha256", "uuid": "22ad8cbe-1206-4a67-a3c5-c94d5e262144", "value": "00d979bdb1b29b2859f2120580f101f40e8e13de0b3b7bc29675e2c31098a03c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622553", "to_ids": true, "type": "ssdeep", "uuid": "6fb65f66-3153-4325-916e-e5863029e208", "value": "12288:HIxGkj68RDwFb75W0LI8PrkNfTvnPGAmqLG87nIOBgGT5EYKYJxDL49FKeX8qPI:EGkj6NF0ETzkheARy87dNEVYDfcpBI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622553", "to_ids": false, "type": "size-in-bytes", "uuid": "7a0a812b-138a-4317-90a4-e2fc7027984d", "value": "959488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622553", "to_ids": true, "type": "vhash", "uuid": "67d9f6d3-39f7-4b3b-b416-5b75d26b521c", "value": "195066655d6555151038z137z2dz2ezc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622553", "to_ids": true, "type": "filename", "uuid": "95618da2-9c44-45d9-b527-718726e326d4", "value": "endpointdlp.dll" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622553", "to_ids": false, "type": "text", "uuid": "29803021-f2d9-4cf5-af9b-fcdc1025e402", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win64/Havoc.MX!MTB\nVT Total Detection:43/71\nFirst Submission:2026-05-03T21:47:37.000000+00:00\nLast Submission:2026-05-03T21:47:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624934", "uuid": "913258ca-87d7-41a3-8c12-9bc7c78ae3f0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624934", "to_ids": true, "type": "md5", "uuid": "82e25215-8f7e-474c-9f1e-527416cdf617", "value": "e6c69f14d7b0dabff5c67e54cf87aba2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623502", "to_ids": true, "type": "sha1", "uuid": "cc78509b-6e49-4882-916e-17b524e75179", "value": "70bee643d79fd82f7835b208e15a6d722f64dd7a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623503", "to_ids": true, "type": "sha256", "uuid": "b593328c-1649-4f1c-8539-000e3a75fce7", "value": "ae8cded2822c56dd85f52bba09d9285cb2db3e6317227530b848ea143afb067c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622575", "to_ids": true, "type": "ssdeep", "uuid": "326b6355-5f5c-45fa-8ad7-fd9addfc685b", "value": "1536:SkJIalOYktfCM83v6pq9UVE/kGE5+Kb+LwoMSJZNx5FOpdbX:xlITtfCMT2UVE/kOXMSJZDPOpdb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622575", "to_ids": false, "type": "size-in-bytes", "uuid": "4218697c-6fd7-4420-9084-613e48973450", "value": "102400" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622575", "to_ids": true, "type": "vhash", "uuid": "ee957997-dd50-4f27-b10c-28cebed29ea5", "value": "0150665d15551d051\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622575", "to_ids": true, "type": "filename", "uuid": "1401263c-b957-4f2e-98ca-8a9ed31d5978", "value": "demon.x64.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 02/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622575", "to_ids": false, "type": "text", "uuid": "18608c54-ed71-42db-b4ed-0cd47ddf34bf", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Havokiz.C\nVT Total Detection:53/71\nFirst Submission:2026-05-01T21:03:46.000000+00:00\nLast Submission:2026-05-01T21:03:46.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624956", "uuid": "7ef92829-9ba7-44e4-8014-482c6903549c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624956", "to_ids": true, "type": "md5", "uuid": "008381e3-4302-4616-8428-baef2ba2ac5c", "value": "6ee4050ac0c5192961c9f34568ca68fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623504", "to_ids": true, "type": "sha1", "uuid": "aa04ce2f-4263-49a5-b5a7-3aeb037d65e0", "value": "5a7caaed79b1302285c371960ee3f50779f26a81", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623504", "to_ids": true, "type": "sha256", "uuid": "7bd885a8-c547-4044-8513-d7b151c45cae", "value": "9eefc66d1fca7f18a91f49affb569b41bcde043f91567e7f5cc9f2016aeddf8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622596", "to_ids": true, "type": "ssdeep", "uuid": "8090f36c-4c05-4c9b-9be0-71e93556ff1e", "value": "1536:bkJIalOYktfCM83v6pq9UVE/kGE5+Kb+LwoMSJZNx5FOEdb/:ylITtfCMT2UVE/kOXMSJZDPOEdb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622596", "to_ids": false, "type": "size-in-bytes", "uuid": "b290303e-3ad0-4039-8c3f-44319b0e5437", "value": "102400" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622596", "to_ids": true, "type": "vhash", "uuid": "7693a2e5-9219-4323-96f5-574e03bca118", "value": "0150665d15551d051\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622596", "to_ids": true, "type": "filename", "uuid": "57412bfd-de31-4235-9242-ba72b1b020f7", "value": "5fjjs.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 01/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622596", "to_ids": false, "type": "text", "uuid": "efd459d5-ac83-4419-82f4-a904821b78f7", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Havokiz.C\nVT Total Detection:53/71\nFirst Submission:2026-05-01T04:25:13.000000+00:00\nLast Submission:2026-05-01T04:25:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624977", "uuid": "5effb1ce-dacf-4b18-a328-02ec60134dfb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624977", "to_ids": true, "type": "md5", "uuid": "5ffff7a0-fccb-410a-9f22-39311729d401", "value": "fa9d1f3e719d9284af8af075b1cef9cc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623505", "to_ids": true, "type": "sha1", "uuid": "0ad3768b-628d-4f0a-9be2-0ee9797c8d7f", "value": "c6c9b69fbfb77f1d07b44991dccc58719c37faf7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623505", "to_ids": true, "type": "sha256", "uuid": "6532dc41-75a8-453e-a5e4-4b4cbff95e18", "value": "c958de72460256c9c1cceef527d880862e8bc29e3ae4e2d478af97dcafd41180", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622618", "to_ids": true, "type": "ssdeep", "uuid": "53caed71-728a-405e-a7d0-87dc4fc71bb6", "value": "1536:6kpoalOYktfCM83vqIYEVE/kGE5+Kb+LwoMSJZNR5FO0Xb:pFITtfCMT2VE/kOXMSJZjPO0Xb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622618", "to_ids": false, "type": "size-in-bytes", "uuid": "c8d3b031-5308-4d23-8a3a-20a5c8eed3ba", "value": "102400" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622618", "to_ids": true, "type": "vhash", "uuid": "ad77fb87-bf01-441d-8b57-2bd89ee3d173", "value": "0150665d15551d051\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622618", "to_ids": true, "type": "filename", "uuid": "70de3595-2865-419f-87ba-96b6e9318e2f", "value": "ProjectLigmav3.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 02/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622618", "to_ids": false, "type": "text", "uuid": "b1f2afca-a95a-47eb-8575-ce43318ebe51", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Havokiz.C\nVT Total Detection:53/71\nFirst Submission:2026-05-01T21:06:48.000000+00:00\nLast Submission:2026-05-01T21:06:48.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780624998", "uuid": "42cd1fb4-9f57-4164-bf50-7c603b024a7d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780624998", "to_ids": true, "type": "md5", "uuid": "42ed69e0-d487-4496-a6e0-9ff8b1be4b69", "value": "37e065585c573ecc082aacbfd31564eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623507", "to_ids": true, "type": "sha1", "uuid": "44e54f7d-e31d-492c-84f3-625b445fb1f6", "value": "d79246b49a00169993de60779cbcec17cae9da21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623507", "to_ids": true, "type": "sha256", "uuid": "25adc73a-be5b-469d-8315-8422cf44731c", "value": "6dc41555455860b8584d761303a7ae5487117944e2a24d74fa3e91ad8f840077", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622640", "to_ids": true, "type": "ssdeep", "uuid": "67f780c7-a6d1-40ed-9357-c096b4c3db5b", "value": "1536:IkpoalOYktfCM83vWhwYgVE/kGE5+Kb+LwoMSJZNR5FOc3b:nFITtfCM/DgVE/kOXMSJZjPOc3b" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622640", "to_ids": false, "type": "size-in-bytes", "uuid": "fcc133ad-d360-4dd9-881c-9ceeb207a5bf", "value": "102400" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622640", "to_ids": true, "type": "vhash", "uuid": "1270f08b-29e3-457e-96e3-ddaa5d1520e6", "value": "0150665d15551d051\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622640", "to_ids": true, "type": "filename", "uuid": "0a34cd7d-e4f2-4f54-878c-c9ae2d9efc10", "value": "real.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 01/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622640", "to_ids": false, "type": "text", "uuid": "31d256dd-1cd7-4ad2-b5c5-c726381d24c3", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Havokiz.C\nVT Total Detection:50/71\nFirst Submission:2026-05-01T04:48:46.000000+00:00\nLast Submission:2026-05-01T04:48:46.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780625019", "uuid": "bca87ea0-0fff-46ba-ae21-4bf1815e53e0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780625019", "to_ids": true, "type": "md5", "uuid": "cd0fa4ad-45a4-48ff-9c90-eeef6047726f", "value": "609c3fc64a67630a7b206a6880c893a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623508", "to_ids": true, "type": "sha1", "uuid": "8cbebc39-99e0-4e17-9c5b-c0d227b28bc7", "value": "af98e97cd49229845123a1063b8c386cc9b2f441", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623508", "to_ids": true, "type": "sha256", "uuid": "16461e99-702b-4b38-98b4-2b4e941107ec", "value": "6b22df0de0a40ff372973639c8a1974cfb75084b8e3b85f9ab9038e0acce43c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622661", "to_ids": true, "type": "ssdeep", "uuid": "4028cac9-2e09-45c4-a385-500f8ca44e10", "value": "1536:uCksKK6R06zEcTYN5Da9yXaO1GHSifqI01SWkdgimqrVFLgvA3Q3I:egCTEcTYfdqO1GnqI7JrVFLgvm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622661", "to_ids": false, "type": "size-in-bytes", "uuid": "d8e90b82-60b4-43da-b137-5934360d2cc7", "value": "99328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622661", "to_ids": true, "type": "vhash", "uuid": "0aa3e18c-0e87-470f-b5f3-fe2d0eb7da85", "value": "0940566d1555051\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622661", "to_ids": true, "type": "filename", "uuid": "a0c4f11a-f826-404f-92de-72ad633b5371", "value": "demon.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 03/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622661", "to_ids": false, "type": "text", "uuid": "be604319-d4cf-4f68-bfb8-906e2f7acac0", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Havoc.MZZ!MTB\nVT Total Detection:25/70\nFirst Submission:2026-05-03T00:06:20.000000+00:00\nLast Submission:2026-05-03T00:06:20.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780625040", "uuid": "04d3f458-d335-46e5-82b0-9f52aa200304", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780625040", "to_ids": true, "type": "md5", "uuid": "662e6a87-78ba-493a-84af-4c8ad8f68abb", "value": "19b2f2902825eaf62f2db1eb8aaa520a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623509", "to_ids": true, "type": "sha1", "uuid": "677ec7b0-ab38-4e85-8ff8-46bda2a64c35", "value": "dafbe5c235051bd6689f4b36a725360c38abdf25", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623509", "to_ids": true, "type": "sha256", "uuid": "26a11faf-f7fd-4036-a2f7-a8eaef5fb5ad", "value": "31f27fdc14505e0cebe360579e1ba0326762cbe0948e50b5f920da51fdef1b51", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622683", "to_ids": true, "type": "ssdeep", "uuid": "842ca265-e02d-40e5-a9da-0ae607ec5f2a", "value": "1536:bkKGmDr1+jZUv0dhjEYOcJ6Og726mCXKUeTC+c9JLNyWid:TNAy0d2YOc9g5cC79JLNyx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622683", "to_ids": false, "type": "size-in-bytes", "uuid": "f0ef632a-2b60-4703-a480-d3117f8810aa", "value": "99840" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622683", "to_ids": true, "type": "vhash", "uuid": "ade68cf3-72f1-40d0-af36-e10cff55b171", "value": "0940566d1555051\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622683", "to_ids": true, "type": "filename", "uuid": "e11808b8-e5fa-4d70-9e4f-caf7cbd56b1c", "value": "a95hpln0x.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 05/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622683", "to_ids": false, "type": "text", "uuid": "9627ad2e-769f-4665-9c63-b723fd9f82cb", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:45/70\nFirst Submission:2026-05-02T12:03:01.000000+00:00\nLast Submission:2026-05-02T12:03:01.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780625063", "uuid": "4abdca43-da83-4d18-884c-1bab52d5b420", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780625063", "to_ids": true, "type": "md5", "uuid": "f1dc2111-be1b-4921-99dd-072005aa1d72", "value": "37b996509ce2873f96781c9f9b12d8b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623511", "to_ids": true, "type": "sha1", "uuid": "fb35037d-3868-499a-a63e-cdeeba202387", "value": "afd1818d136a5cad592fbd81122e2c0a1aaae4b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623511", "to_ids": true, "type": "sha256", "uuid": "fca683dd-ab8c-43b5-b2f5-ba58b9534a3a", "value": "389a6a2007e4f06d16beac0ec2cb01391f80ad5e392343386cae3ceb82ec1502", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622705", "to_ids": true, "type": "ssdeep", "uuid": "1f90fa14-272f-47ab-9078-b73762d400d3", "value": "1536:FsIokYV4R60nkLagyLQOcI5qzCLs4mFWKTOnF6tLHhHHUSrqOe9:jrNJxEOcDzCyKF6tLHx0Y5e9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622705", "to_ids": false, "type": "size-in-bytes", "uuid": "3df1b8f7-40d8-4502-a9c7-fc8cb84db4f2", "value": "99328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622705", "to_ids": true, "type": "vhash", "uuid": "2f37971f-1fbb-4f1b-be29-c671859ba72b", "value": "0940566d1555051\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622705", "to_ids": true, "type": "filename", "uuid": "7155c1b0-fbdf-49f6-9a10-c55d6ed80da8", "value": "9q3i0yh.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 02/05/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622705", "to_ids": false, "type": "text", "uuid": "bb99485b-efa2-496b-8034-e86c29ecfa43", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Havoc.MZZ!MTB\nVT Total Detection:23/70\nFirst Submission:2026-05-02T08:28:12.000000+00:00\nLast Submission:2026-05-02T08:28:12.000000+00:00" } ] } ] } }