{ "Event": { "analysis": "1", "date": "2026-07-27", "extends_uuid": "", "info": "[Threat Intel] Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor", "protected": false, "publish_timestamp": "1785616365", "published": true, "threat_level_id": "3", "timestamp": "1785616365", "uuid": "659c0511-df54-47d1-9e30-3a7ffbfea9cc", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#6dbaba", "local": false, "name": "misp-galaxy:producer=\"Zscaler\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#aff0ae", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Permission Groups Discovery - T1069\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Trust Discovery - T1482\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#3d1dab", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Internal Spearphishing - T1534\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#08b028", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Asymmetric Cryptography - T1573.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Sliver\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"Quick Assist\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785236406", "to_ids": false, "type": "link", "uuid": "42d2be12-ce1a-4bce-8e75-c1a6458ccf82", "value": "https://www.zscaler.com/blogs/security-research/helpdesk-hijackers-teams-vishing-quick-assist-and-gogrpc-backdoor" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1785236406", "to_ids": false, "type": "text", "uuid": "4a2b348e-4d55-4ce4-8703-5621b149e78f", "value": "Since January 2026, a threat actor likely functioning as an initial access broker for ransomware operations has been targeting organizations through Microsoft Teams vishing attacks. Attackers impersonate IT helpdesk staff to convince victims to initiate Quick Assist remote sessions. Following initial compromise, PowerShell scripts deploy a Go-based backdoor called GoGRPC, which exists in four distinct variants: Lep, Giver, Pet, and Kind. These variants communicate with command-and-control infrastructure using gRPC over HTTP/2, an uncommon approach that helps blend malicious traffic with legitimate communications. Additional tools observed include BlindDoor backdoor, RevSocket and PyGRPC SOCKS proxies, S3Siphon data exfiltration utility, and RSOX Rust-based proxy relay. Recent campaigns show increased sophistication and selectivity, with heightened focus on corporate environments through enhanced PowerShell scripts capable of antivirus detection, domain controller fingerprinting, and system reconnaissance b..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1785236406", "to_ids": false, "type": "text", "uuid": "1938b5e9-7d95-42cf-9736-36343895d8f6", "value": "Name: Helpdesk Hijackers: Teams Vishing, Quick Assist, and GoGRPC Backdoor\nAuthor: AlienVault\nAdversary: \nTags: [\"vishing\", \"initial access broker\", \"rsox\", \"microsoft teams\", \"blinddoor\", \"quick assist\", \"socks proxy\", \"powershell\", \"revsocket\", \"pygrpc\", \"ransomware\", \"gogrpc\", \"grpc\", \"data exfiltration\", \"s3siphon\"]\nTgtd countries: []\nMlwr families: [\"GoGRPC\", \"BlindDoor\", \"RevSocket\", \"PyGRPC\", \"S3Siphon\", \"RSOX\"]\nAttack_ids: [\"T1033\", \"T1069\", \"T1543.003\", \"T1082\", \"T1005\", \"T1219\", \"T1016\", \"T1090\", \"T1482\", \"T1083\", \"T1041\", \"T1059.001\", \"T1534\", \"T1547.001\", \"T1566\", \"T1573.002\", \"T1518.001\", \"T1071.001\", \"T1018\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "Giver C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1785602337", "to_ids": true, "type": "ip-dst", "uuid": "67a2afe6-0e94-40c7-bfdb-624f6b094927", "value": "94.140.114.192", "Tag": [ { "colour": "#20117d", "local": false, "name": "asn:asn=\"43513\"", "relationship_type": "" }, { "colour": "#c5d0f8", "local": false, "name": "asn:as-owner=\"NANO-AS\"", "relationship_type": "" }, { "colour": "#6286a7", "local": false, "name": "asn:as-country=\"LV\"", "relationship_type": "" }, { "colour": "#5f162c", "local": false, "name": "misp-galaxy:country=\"latvia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Kind C2 server (June)", "deleted": false, "disable_correlation": false, "timestamp": "1785602358", "to_ids": true, "type": "ip-dst", "uuid": "7ee7416d-72e7-49ac-977d-2c940f8253e4", "value": "45.86.162.228", "Tag": [ { "colour": "#8e8779", "local": false, "name": "asn:asn=\"199959\"", "relationship_type": "" }, { "colour": "#d781fd", "local": false, "name": "asn:as-owner=\"CROWNCLOUD\"", "relationship_type": "" }, { "colour": "#7f61db", "local": false, "name": "asn:as-country=\"AU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"australia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 server deploying tools", "deleted": false, "disable_correlation": false, "timestamp": "1785602379", "to_ids": true, "type": "domain", "uuid": "470e2abd-072c-4309-ae98-f601a0d336f5", "value": "scansec-upd.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Lep C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1785602400", "to_ids": true, "type": "ip-dst", "uuid": "a7f673fc-e6ee-4150-9c55-cca9c5bc0d42", "value": "5.253.59.222", "Tag": [ { "colour": "#b8cc18", "local": false, "name": "asn:asn=\"215540\"", "relationship_type": "" }, { "colour": "#c38d7e", "local": false, "name": "asn:as-owner=\"GCS-AS\"", "relationship_type": "" }, { "colour": "#e1449b", "local": false, "name": "asn:as-country=\"GB\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united kingdom\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "PyGRPC and reconnaissance No sample in VT\r\nLast check: 02/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785600947", "to_ids": true, "type": "sha256", "uuid": "7123ee73-add1-44de-9da8-0e1036a62959", "value": "65af5c3ba2d00967b25b9165d2d3171fa81f209ee0790299805bb907d492a670", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Pet C2 server", "deleted": false, "disable_correlation": false, "timestamp": "1785602421", "to_ids": true, "type": "ip-dst", "uuid": "21529823-3169-42cc-98c1-852f12cefd74", "value": "193.29.57.37", "Tag": [ { "colour": "#f86914", "local": false, "name": "asn:asn=\"48314\"", "relationship_type": "" }, { "colour": "#96046d", "local": false, "name": "asn:as-owner=\"IP-PROJECTS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "RevSocket C2 server (May)", "deleted": false, "disable_correlation": false, "timestamp": "1785602443", "to_ids": true, "type": "ip-dst", "uuid": "0378a87f-a212-46b0-9c12-859324876aca", "value": "46.30.191.126", "Tag": [ { "colour": "#8e8779", "local": false, "name": "asn:asn=\"199959\"", "relationship_type": "" }, { "colour": "#d781fd", "local": false, "name": "asn:as-owner=\"CROWNCLOUD\"", "relationship_type": "" }, { "colour": "#7f61db", "local": false, "name": "asn:as-country=\"AU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"australia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "RevSocket C2 server (June)", "deleted": false, "disable_correlation": false, "timestamp": "1785602464", "to_ids": true, "type": "ip-dst", "uuid": "c39f07e1-0e79-46cd-a41b-ddfcaf96bf68", "value": "46.30.191.60", "Tag": [ { "colour": "#8e8779", "local": false, "name": "asn:asn=\"199959\"", "relationship_type": "" }, { "colour": "#d781fd", "local": false, "name": "asn:as-owner=\"CROWNCLOUD\"", "relationship_type": "" }, { "colour": "#7f61db", "local": false, "name": "asn:as-country=\"AU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"australia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785602485", "to_ids": true, "type": "url", "uuid": "dc9dd83e-d825-4585-bc8d-19e4d397194d", "value": "http://re102.fastwinnow.com/download/link", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785602506", "to_ids": true, "type": "hostname", "uuid": "51c7c020-aa6d-435b-9b13-14f8f4565558", "value": "re102.fastwinnow.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 server deploying tools (April)", "deleted": false, "disable_correlation": false, "timestamp": "1785602527", "to_ids": true, "type": "hostname", "uuid": "411fe80b-e7c7-4153-8094-0fc768916ab3", "value": "re2.filesdwnload.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 server deploying tools (May)", "deleted": false, "disable_correlation": false, "timestamp": "1785602548", "to_ids": true, "type": "hostname", "uuid": "05e5cfdf-268c-48af-8a0a-bdfe47f1c693", "value": "re8.dowlfles.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 server deploying tools (June)", "deleted": false, "disable_correlation": false, "timestamp": "1785602569", "to_ids": true, "type": "hostname", "uuid": "bc4e173a-f0a0-4fb0-933c-19732884c51f", "value": "update19.upldf.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "RSOX C2 server (June)", "deleted": false, "disable_correlation": false, "timestamp": "1785602591", "to_ids": true, "type": "hostname", "uuid": "e853e5ed-ec02-4c9a-9953-bb04e693e74d", "value": "xeds.geranteeg.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "S3Siphon C2 server (Jan)", "deleted": false, "disable_correlation": false, "timestamp": "1785602612", "to_ids": true, "type": "ip-dst", "uuid": "0ef6c64b-9958-49ca-bc09-5cdf0f0965d5", "value": "185.82.126.91", "Tag": [ { "colour": "#7960c8", "local": false, "name": "asn:asn=\"52173\"", "relationship_type": "" }, { "colour": "#6796cf", "local": false, "name": "asn:as-owner=\"MAKONIX\"", "relationship_type": "" }, { "colour": "#6286a7", "local": false, "name": "asn:as-country=\"LV\"", "relationship_type": "" }, { "colour": "#5f162c", "local": false, "name": "misp-galaxy:country=\"latvia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602633", "uuid": "e0de1161-f272-43f7-ac19-4919dd21b5b9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "object_relation": "md5", "timestamp": "1785602633", "to_ids": true, "type": "md5", "uuid": "66bbb2cd-8a44-44d6-aa67-bfd65b907499", "value": "3d1819de80c5a6633bc546f7b07086a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "object_relation": "sha1", "timestamp": "1785600933", "to_ids": true, "type": "sha1", "uuid": "3d7d3a14-01d7-495e-8668-d6bd6d5caab7", "value": "233dbba4110d6d52d5378eb8ca6e8edb5f271445", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "object_relation": "sha256", "timestamp": "1785600933", "to_ids": true, "type": "sha256", "uuid": "5a6d09ac-09f1-41ca-8aff-7287637c4b3a", "value": "9136ffb749c6cec13b826cd4f25ffdcf170375889feba9fee28dd74c32578f52", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 30/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "object_relation": "text", "timestamp": "1785600205", "to_ids": false, "type": "text", "uuid": "45e82e63-f6e4-4deb-8829-88b2941f8138", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-01-26T01:29:30+00:00\nLast Submission: 2026-02-02T07:15:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "object_relation": "ssdeep", "timestamp": "1785600205", "to_ids": true, "type": "ssdeep", "uuid": "3f2ee521-34f6-4873-8795-95daae77e0a0", "value": "49152:aMxEr3AhluKkW/ZNi6BPSoDQsE+P32qYs+OXeGWbyCPg4PFfRt5sYw9QWx8W/D14:acRVdMHUWxI4tL+Y884GNAjVmWtE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600205", "to_ids": false, "type": "size-in-bytes", "uuid": "0caa9fd2-e3e2-41e5-bea6-d7c08db0eca1", "value": "10847744" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "object_relation": "vhash", "timestamp": "1785600205", "to_ids": true, "type": "vhash", "uuid": "4c466d85-294b-442d-8cf5-374ce49164e8", "value": "017086655d55551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-26T01:29:30+00:00", "last_seen": "2026-02-02T07:15:18+00:00", "object_relation": "filename", "timestamp": "1785600205", "to_ids": true, "type": "filename", "uuid": "47a3c777-415c-4313-bcde-1a116d874d4b", "value": "2.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602654", "uuid": "3f36c421-8d85-4903-aa0b-a75eafe99f0b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "object_relation": "md5", "timestamp": "1785602654", "to_ids": true, "type": "md5", "uuid": "0d09dd2c-c007-46c2-8673-4c72fbe11518", "value": "7a818efa2a3af3130a3c4b69260a08aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "object_relation": "sha1", "timestamp": "1785600934", "to_ids": true, "type": "sha1", "uuid": "cdeffbb8-8c79-4181-9ae7-a81e090df456", "value": "1d93080e7e97cd265e259a5e6f4d76e5583ed211", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "object_relation": "sha256", "timestamp": "1785600934", "to_ids": true, "type": "sha256", "uuid": "b98443cb-f6d7-4fe6-bd13-227fec7b559a", "value": "51edd14233483bcf36e0b0f31451f28eac681fe3f2036f76c02b7ec1bb17ce33", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "object_relation": "text", "timestamp": "1785600226", "to_ids": false, "type": "text", "uuid": "b7c8cfab-6594-4716-b629-1ae0abfa4856", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 25/75\nFirst Submission: 2026-06-05T06:01:02+00:00\nLast Submission: 2026-06-05T06:01:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "object_relation": "ssdeep", "timestamp": "1785600226", "to_ids": true, "type": "ssdeep", "uuid": "9c4eefdb-b5ad-4aae-b4ea-b95564c2bcd6", "value": "49152:ROMIrx2ORrB11pw4cg64OqwbtTN91Hqk1eHS2Q21jfl96lUxv6cWtc3cKlZpl6xF:RUWxbtTNNQ9AUHMcRlR6xPcUYFOSr+E" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600226", "to_ids": false, "type": "size-in-bytes", "uuid": "08a0b275-263b-4611-acbe-aeac06a2dbcd", "value": "11532288" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "object_relation": "vhash", "timestamp": "1785600226", "to_ids": true, "type": "vhash", "uuid": "6acee3dc-ca32-47c8-9505-67b99c74c7b6", "value": "017086655d55551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T06:01:02+00:00", "last_seen": "2026-06-05T06:01:02+00:00", "object_relation": "filename", "timestamp": "1785600226", "to_ids": true, "type": "filename", "uuid": "05637390-37a0-4ce2-96d7-67bf6625ecf0", "value": "mus31r.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602675", "uuid": "03b902d1-ab7d-4ebc-9fa0-bc6432bd97e2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "object_relation": "md5", "timestamp": "1785602675", "to_ids": true, "type": "md5", "uuid": "3f511f61-22e5-4322-a144-d853acee712f", "value": "925dc63fc70de650127f41e00e9ffbf3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "object_relation": "sha1", "timestamp": "1785600936", "to_ids": true, "type": "sha1", "uuid": "225516d5-0e70-4831-9797-0ec6486951ef", "value": "7ddb7a07d5ecb0056f545306225e7a59a8bc2753", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "object_relation": "sha256", "timestamp": "1785600936", "to_ids": true, "type": "sha256", "uuid": "401b156f-e6cb-4d49-af42-e8fa7fa5825d", "value": "759287052b8cc4f4ce16065857cbc9dba72aab218e709d3419483a95092c6f96", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 30/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "object_relation": "text", "timestamp": "1785600248", "to_ids": false, "type": "text", "uuid": "df4dd6ac-56a9-420a-9a95-bc0c59455169", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 21/74\nFirst Submission: 2026-04-16T12:11:29+00:00\nLast Submission: 2026-04-16T12:11:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "object_relation": "ssdeep", "timestamp": "1785600248", "to_ids": true, "type": "ssdeep", "uuid": "4556dd31-d45c-40da-a8a4-51857bdc6a1e", "value": "98304:PrJqZR0s527J+ksCM3kP41ija0OSndDE:P80s5SFM3kQIeEdQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600248", "to_ids": false, "type": "size-in-bytes", "uuid": "d3123417-330c-4a49-9cbb-fd45c4333c8b", "value": "11535360" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "object_relation": "vhash", "timestamp": "1785600248", "to_ids": true, "type": "vhash", "uuid": "890d971a-4e92-448e-b91d-55e80aca26c5", "value": "017086655d55551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T12:11:29+00:00", "last_seen": "2026-04-16T12:11:29+00:00", "object_relation": "filename", "timestamp": "1785600248", "to_ids": true, "type": "filename", "uuid": "1f14aab4-cf24-4a55-bc28-13b95e2d6002", "value": "hdiuuz.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602696", "uuid": "981a539f-5c50-44af-a423-27132784282b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "object_relation": "md5", "timestamp": "1785602696", "to_ids": true, "type": "md5", "uuid": "6f88d7c8-f5e4-4eaf-b569-b5d27c856fed", "value": "b42366dcf2612adb43ed0c617bfa98d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "object_relation": "sha1", "timestamp": "1785600937", "to_ids": true, "type": "sha1", "uuid": "72636703-23f4-4c50-ab82-558483b4f745", "value": "a6491268ab79940dcbb811c32f1b19a988219814", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "object_relation": "sha256", "timestamp": "1785600937", "to_ids": true, "type": "sha256", "uuid": "b857c0d6-c2dd-44c7-846d-ee431dbe6f6c", "value": "66b2b22397cea219266afb8cbbb28fe93997c1444f642a183ac8fc9ca1fabed5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "object_relation": "text", "timestamp": "1785600269", "to_ids": false, "type": "text", "uuid": "0a2a03ed-3889-40e1-883a-c2282ac27871", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 29/75\nFirst Submission: 2026-02-26T22:30:19+00:00\nLast Submission: 2026-03-26T17:52:05+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "object_relation": "ssdeep", "timestamp": "1785600269", "to_ids": true, "type": "ssdeep", "uuid": "ea8e3a92-056c-4614-aeb3-09b36234b119", "value": "98304:TvASQ7lKMSp9Qj2vCQZssQ07QSHbYXEdJroy8Ew0:TvWlAp9Qj2vCeQub11" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600270", "to_ids": false, "type": "size-in-bytes", "uuid": "55ac6924-271d-45b8-8d58-bee85e75f11f", "value": "10855424" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "object_relation": "vhash", "timestamp": "1785600270", "to_ids": true, "type": "vhash", "uuid": "f543476f-8b47-485b-bf68-286fb13ef28e", "value": "017086655d55551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-26T22:30:19+00:00", "last_seen": "2026-03-26T17:52:05+00:00", "object_relation": "filename", "timestamp": "1785600270", "to_ids": true, "type": "filename", "uuid": "a5f96f59-f920-4317-b918-e658e1d1a571", "value": "2026-03-26_b42366dcf2612adb43ed0c617bfa98d4_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602717", "uuid": "4a66aae0-6f84-4938-8a2e-b09ba8bdca14", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "object_relation": "md5", "timestamp": "1785602717", "to_ids": true, "type": "md5", "uuid": "e6037320-7ed0-47c5-84ef-3084294e7beb", "value": "b6a74fcadf1efca4e9f01658529556bc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "object_relation": "sha1", "timestamp": "1785600938", "to_ids": true, "type": "sha1", "uuid": "6af6a434-01d3-43ea-801f-2c1f98e5b548", "value": "3f25712f02617eda348f1703bb1096e8a121ceaf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "object_relation": "sha256", "timestamp": "1785600939", "to_ids": true, "type": "sha256", "uuid": "9668fb67-4162-40fa-8fff-ec80a26dafad", "value": "35ea50f16bd5c080c91dbaa3dd4937408ed9563c1d9aa1cd0c751ae58db0eedc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 30/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "object_relation": "text", "timestamp": "1785600291", "to_ids": false, "type": "text", "uuid": "fefdef29-7b42-453f-a14b-e4724d650508", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 17/74\nFirst Submission: 2026-04-16T12:11:27+00:00\nLast Submission: 2026-04-16T12:11:27+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "object_relation": "ssdeep", "timestamp": "1785600291", "to_ids": true, "type": "ssdeep", "uuid": "5141b037-ce88-4194-bd39-5258ba0b2c17", "value": "98304:5FUgsdw/88XzTJWsWvvXWeXbKOvoSzqE:5SgR88xWsWv/peOl3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600291", "to_ids": false, "type": "size-in-bytes", "uuid": "293f457c-a0ec-4cec-92ee-8e38db494f39", "value": "11533824" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "object_relation": "vhash", "timestamp": "1785600291", "to_ids": true, "type": "vhash", "uuid": "0a653014-ebc1-4395-a8d7-e41f13575ff7", "value": "017086655d55551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T12:11:27+00:00", "last_seen": "2026-04-16T12:11:27+00:00", "object_relation": "filename", "timestamp": "1785600291", "to_ids": true, "type": "filename", "uuid": "5e813418-6b5a-4b12-a701-0a8f3127faa4", "value": "5h4cftx4.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602739", "uuid": "995e61d2-f761-4c12-8176-2e83c2447eaf", "Attribute": [ { "category": "Payload delivery", "comment": "MSI dropping RSOX", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "md5", "timestamp": "1785602739", "to_ids": true, "type": "md5", "uuid": "272d8bfb-7b0b-4c59-a08d-4384cb8beba7", "value": "dd52212f40378b88a88d4d830638d47f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MSI dropping RSOX", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "sha1", "timestamp": "1785600940", "to_ids": true, "type": "sha1", "uuid": "65f08e85-e241-4a57-a28b-2fd80b550493", "value": "9dd002cc9bacd34b5f37fe23157783a578dfcb89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MSI dropping RSOX", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "sha256", "timestamp": "1785600940", "to_ids": true, "type": "sha256", "uuid": "dd999cad-4036-45a3-8a22-b507509a6f3f", "value": "41748648b71a70431123ec48e38868ff8aad3a7a06f5d781c2d2a4f718e7fd91", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "text", "timestamp": "1785600313", "to_ids": false, "type": "text", "uuid": "7aa3c8d6-565f-4849-a35e-685197bdb111", "value": "MSI dropping RSOX\r\nType Descriptio%WINDIR%\\Installer\nMicrosoft: None\nClamAV: None\nVT Total Detection: 32/75\nFirst Submission: 2026-06-20T04:57:49+00:00\nLast Submission: 2026-06-20T04:57:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "creation-time", "timestamp": "1785600313", "to_ids": false, "type": "datetime", "uuid": "9d00f8a9-0664-41f7-b4f1-1e6ebdbc9ae0", "value": "2026-06-18T19:07:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "ssdeep", "timestamp": "1785600313", "to_ids": true, "type": "ssdeep", "uuid": "a3d6e405-3a76-49d0-a7b9-b10edff24ef0", "value": "24576:v/KKbf5XTCL3HYrUoX/ptar5WTYU84gCN3DhwqlL9UzbHC:NVTq32p8WcpCN31lL9Kb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600313", "to_ids": false, "type": "size-in-bytes", "uuid": "03e149f3-ea76-42c9-a615-49d6ad951564", "value": "999424" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "vhash", "timestamp": "1785600313", "to_ids": true, "type": "vhash", "uuid": "ac66df8b-8658-489d-b279-64714b650888", "value": "32fe66a890dbb4ef39f48ef6ec4a5e8d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T04:57:49+00:00", "last_seen": "2026-06-20T04:57:49+00:00", "object_relation": "filename", "timestamp": "1785600313", "to_ids": true, "type": "filename", "uuid": "1cd66cf4-d0c4-4629-826d-6c4f2642ec97", "value": "task.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602760", "uuid": "50b3471b-bb18-464d-8d29-e0702df80e2f", "Attribute": [ { "category": "Payload delivery", "comment": "RevSocket (alone)", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "object_relation": "md5", "timestamp": "1785602760", "to_ids": true, "type": "md5", "uuid": "63bc46a4-dda1-4ecc-b078-7d71db4ef087", "value": "6484861d32b4714533c7a57d0c867027", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RevSocket (alone)", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "object_relation": "sha1", "timestamp": "1785600941", "to_ids": true, "type": "sha1", "uuid": "7e6aa52a-a9e9-41ec-869f-9bc56069e37d", "value": "25b480e13faa57f398ba23733b6ff3956ad721ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RevSocket (alone)", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "object_relation": "sha256", "timestamp": "1785600941", "to_ids": true, "type": "sha256", "uuid": "661e859a-09ff-4f39-b2a9-eee54a0f04a1", "value": "5d53246b0e6b681bc624739a7bead39a61fb07c0f4474b8170112e829c053f85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "object_relation": "text", "timestamp": "1785600335", "to_ids": false, "type": "text", "uuid": "ccfd4f5e-94ba-4ab4-8567-7fc430d8536c", "value": "RevSocket (alone)\r\nType Description: Win32 EXE\nOriginal name: alone.exe\nMicrosoft: Trojan:Win64/GoGRPC.GVD!MTB\nClamAV: None\nVT Total Detection: 16/75\nFirst Submission: 2026-06-19T18:32:21+00:00\nLast Submission: 2026-06-19T18:32:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "object_relation": "ssdeep", "timestamp": "1785600335", "to_ids": true, "type": "ssdeep", "uuid": "00645efa-50a4-4b17-8fae-73fe06dfd139", "value": "98304:w/6hVFbqtJC1SSIUGK8ZiuDmwES5/Vqh:wSh2tU1SrbZ1mJS5/Vqh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600335", "to_ids": false, "type": "size-in-bytes", "uuid": "f700cda6-cfc8-437a-808b-ec15b687611c", "value": "6322688" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "object_relation": "vhash", "timestamp": "1785600335", "to_ids": true, "type": "vhash", "uuid": "5b2d27cf-cc7c-4d00-8908-325648717517", "value": "066096655d65551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T18:32:21+00:00", "last_seen": "2026-06-19T18:32:21+00:00", "object_relation": "filename", "timestamp": "1785600335", "to_ids": true, "type": "filename", "uuid": "393ab814-12f9-403f-9856-edc56f335879", "value": "alone.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602782", "uuid": "e7978a66-a06a-4f67-92f5-c02e6f812981", "Attribute": [ { "category": "Payload delivery", "comment": "Giver backdoor", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "object_relation": "md5", "timestamp": "1785602782", "to_ids": true, "type": "md5", "uuid": "066995a8-704f-4bb6-8380-9bf24ce5d2dd", "value": "3a93d6476089de1be1d76bb9471f9587", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Giver backdoor", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "object_relation": "sha1", "timestamp": "1785600943", "to_ids": true, "type": "sha1", "uuid": "ef82981c-1b48-4b9f-b9bc-aff77149cd29", "value": "9b6911dad70540a82909cf7072a60c346c17904d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Giver backdoor", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "object_relation": "sha256", "timestamp": "1785600943", "to_ids": true, "type": "sha256", "uuid": "a4a1a36a-4e01-4b72-a419-9baec308f717", "value": "7dcabb6d07d52b92bbf8d659d1ed373fa780e7839fd3d744826a56fc1cd2372f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "object_relation": "text", "timestamp": "1785600378", "to_ids": false, "type": "text", "uuid": "974e2395-aa8f-4108-83e9-700ed8080e56", "value": "Giver backdoor\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 27/75\nFirst Submission: 2026-03-05T17:45:18+00:00\nLast Submission: 2026-03-05T17:45:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "object_relation": "ssdeep", "timestamp": "1785600378", "to_ids": true, "type": "ssdeep", "uuid": "3af9d3b7-560b-491a-a016-a86311873afa", "value": "98304:KCxMtmmd6E2WYcUvaCRkc4S0S9EdJrordEmE:KCNmdd2WYcUvaIpO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600378", "to_ids": false, "type": "size-in-bytes", "uuid": "91b58a2d-bc9b-45c1-8cfd-efc926261e31", "value": "10854400" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "object_relation": "vhash", "timestamp": "1785600378", "to_ids": true, "type": "vhash", "uuid": "dc9731bb-2f6b-4f66-8641-41db0e8eb639", "value": "017086655d55551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T17:45:18+00:00", "last_seen": "2026-03-05T17:45:18+00:00", "object_relation": "filename", "timestamp": "1785600378", "to_ids": true, "type": "filename", "uuid": "fbd36901-3f6b-48a1-a2a1-4eb65ad25a6a", "value": "9hzvjpw6.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602803", "uuid": "ee0d530b-42e6-4d4b-a5c9-11bb15c47e20", "Attribute": [ { "category": "Payload delivery", "comment": "Kind backdoor (TLS)", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "object_relation": "md5", "timestamp": "1785602803", "to_ids": true, "type": "md5", "uuid": "26b9b577-5724-4d54-9bdc-1e4f3611d6a5", "value": "26dbb95d0195ec14196424cb8e4bfe89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Kind backdoor (TLS)", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "object_relation": "sha1", "timestamp": "1785600944", "to_ids": true, "type": "sha1", "uuid": "4bb07c0d-39c4-4d38-8fcd-ae04c8437811", "value": "99dbf3c29a345e3907e96b9904d09f329a74c95e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Kind backdoor (TLS)", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "object_relation": "sha256", "timestamp": "1785600944", "to_ids": true, "type": "sha256", "uuid": "d77301c1-4a13-4387-82ab-4a30395183a1", "value": "f36bfccf944b5d1e5e306958c1a728e38786c042ee4e536cc44c9d43940b1121", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "object_relation": "text", "timestamp": "1785600399", "to_ids": false, "type": "text", "uuid": "f75037a0-1368-48ec-b1ea-cdca1fe7ae49", "value": "Kind backdoor (TLS)\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 25/75\nFirst Submission: 2026-06-02T14:19:16+00:00\nLast Submission: 2026-06-02T14:19:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "object_relation": "ssdeep", "timestamp": "1785600399", "to_ids": true, "type": "ssdeep", "uuid": "9431e063-6d6d-425b-b16a-e364faa75512", "value": "98304:EI02ZQyLzHE6WbunGLqlqXLqJW4SwmJzE:EQQyPWbunKqM7qJRUg" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600399", "to_ids": false, "type": "size-in-bytes", "uuid": "f344eeea-892a-4460-9946-d8a6ef8e679f", "value": "11532800" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "object_relation": "vhash", "timestamp": "1785600399", "to_ids": true, "type": "vhash", "uuid": "7c89f035-2647-431f-a802-cb062aecf492", "value": "017086655d55551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T14:19:16+00:00", "last_seen": "2026-06-02T14:19:16+00:00", "object_relation": "filename", "timestamp": "1785600399", "to_ids": true, "type": "filename", "uuid": "971a0c25-f54d-47cc-887c-b45f9c43c1cd", "value": "4bjy1i.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785602824", "uuid": "0bef1158-61b2-47a6-ae97-009731d48c73", "Attribute": [ { "category": "Payload delivery", "comment": "RSOX", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "md5", "timestamp": "1785602824", "to_ids": true, "type": "md5", "uuid": "fddb00b3-0be5-44a3-8c53-cea8b5e37948", "value": "6a2f68fbab17340e839373950756f7d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RSOX", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "sha1", "timestamp": "1785600945", "to_ids": true, "type": "sha1", "uuid": "b1e69536-aadf-41bd-b910-022dd5bcf990", "value": "2f2091902124f52d0e5208977c7ea98b4a5ede21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RSOX", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "sha256", "timestamp": "1785600945", "to_ids": true, "type": "sha256", "uuid": "5213806a-5ada-4902-bfa3-48e8e3b61620", "value": "f85960dee17ba587b712cd8cdf89042bcd6ba711c3d5d548bef7c7f0988413f5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 02/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "text", "timestamp": "1785600420", "to_ids": false, "type": "text", "uuid": "72c8a7ce-cf54-4e1d-8430-d23637c3cfcc", "value": "RSOX\r\nType Description: Win32 EXE\nOriginal name: Adobe Update Helper\nMicrosoft: Trojan:Win64/GoGRPC.GVC!MTB\nClamAV: None\nVT Total Detection: 42/75\nFirst Submission: 2026-06-20T04:58:17+00:00\nLast Submission: 2026-06-20T04:58:17+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "creation-time", "timestamp": "1785600421", "to_ids": false, "type": "datetime", "uuid": "58fa83be-7b4d-45ba-8099-63560ae07685", "value": "2026-06-18T19:06:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "ssdeep", "timestamp": "1785600420", "to_ids": true, "type": "ssdeep", "uuid": "a29969b5-406d-4f3a-89b3-89eb190a8fbb", "value": "49152:Bcv/P1gHNt/9T5Dw0az1T+QkYf1FKtxJ5g/TaI:wOg/dFK3QTa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1785600420", "to_ids": false, "type": "size-in-bytes", "uuid": "e6c5baa6-5c9d-4895-9517-88446414c3b6", "value": "2285056" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "vhash", "timestamp": "1785600420", "to_ids": true, "type": "vhash", "uuid": "cd18ae21-66dd-4e74-9780-7d02c9e9083b", "value": "026076655d156d05155013zb2z4e3z89z9cz18z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-20T04:58:17+00:00", "last_seen": "2026-06-20T04:58:17+00:00", "object_relation": "filename", "timestamp": "1785600420", "to_ids": true, "type": "filename", "uuid": "9f801e34-11e2-4e98-8cc1-279b03bec45c", "value": "Adobe Update Helper" } ] } ] } }