{ "Event": { "analysis": "1", "date": "2026-06-17", "extends_uuid": "", "info": "[Threat Intel] More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers", "protected": false, "publish_timestamp": "1782537694", "published": true, "threat_level_id": "3", "timestamp": "1782537664", "uuid": "65db42c9-e25b-479e-95cf-d21fd34c73ae", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#9c8729", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#682cad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#36a9d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#dac154", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#e12cbc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "relationship_type": "" }, { "colour": "#bf2644", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Server Software Component - T1505\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#f055aa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#50bd28", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#52d590", "local": false, "name": "misp-galaxy:target-information=\"China\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#7dbb86", "local": false, "name": "misp-galaxy:target-information=\"Singapore\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"South Korea\"", "relationship_type": "" }, { "colour": "#63bd05", "local": false, "name": "misp-galaxy:target-information=\"Sweden\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Linux\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751612", "to_ids": false, "type": "link", "uuid": "b542b778-9461-4406-ba28-a7fd7bb886b8", "value": "https://blog.xlab.qianxin.com/arystinger-botnet-hijacks-legacy-routers-for-global-attacks-en/", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781751612", "to_ids": false, "type": "text", "uuid": "69a4410f-a8cb-4ad4-92c4-f230281fc326", "value": "Security researchers discovered AryStinger, a botnet targeting legacy routers and NAS devices to build reconnaissance and attack infrastructure. The malware exploits vulnerabilities from 2013-2025 to compromise over 4,300 devices globally, primarily D-Link routers using RTL819X chips. AryStinger communicates via HTTP/HTTPS using Protobuf encoding and XOR encryption, supporting tasks including network scanning, traffic proxying, command execution, and persistent backdoor deployment through dropbear or gs-netcat. Two versions exist: RTL819X in C for routers, and Standard in Go for NAS devices with expanded capabilities including integration of fscan, ksubdomain, and httpx tools. Infected devices serve as distributed scanning nodes and attack proxies, effectively hiding attacker identities while conducting footprinting activities. The campaign shows extremely low detection rates in mainstream security engines, with evidence suggesting operations possibly began in 2024." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781751612", "to_ids": false, "type": "text", "uuid": "9ed43108-ec55-405b-b356-5c4961a9c3f5", "value": "Name: More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers\nAuthor: AlienVault\nAdversary: \nTags: [\"dropbear backdoor\", \"rtl819x\", \"arystinger\", \"cve-2016-5681\", \"botnet\", \"d-link\", \"cve-2013-3307\", \"reconnaissance infrastructure\", \"cve-2025-11837\", \"distributed scanning\", \"legacy routers\"]\nTgtd countries: []\nMlwr families: [\"AryStinger\"]\nAttack_ids: [\"T1543\", \"T1082\", \"T1071\", \"T1190\", \"T1021\", \"T1016\", \"T1087\", \"T1090\", \"T1059\", \"T1083\", \"T1049\", \"T1057\", \"T1027\", \"T1573\", \"T1095\", \"T1505\", \"T1071.001\", \"T1136\", \"T1018\", \"T1046\"]\nIndustries: []" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751612", "to_ids": false, "type": "vulnerability", "uuid": "25c04ce1-f1b4-4a44-9c3f-1ea7b76fc078", "value": "CVE-2016-5681" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751612", "to_ids": false, "type": "vulnerability", "uuid": "96ff0d58-62bb-40a9-a166-6c485223a6a6", "value": "CVE-2013-3307" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781751612", "to_ids": false, "type": "vulnerability", "uuid": "0fea2bf4-a490-4120-a2e7-d58e5e0a2da6", "value": "CVE-2025-11837" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346035", "to_ids": true, "type": "md5", "uuid": "bb2a303e-dc63-468f-b225-e855dbac206d", "value": "05627d1bddb7292bb45139244f46051f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346036", "to_ids": true, "type": "md5", "uuid": "404a9173-a535-4b30-be27-13902bc60f91", "value": "0627f034c42549e2130734b5f8dbf854", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346037", "to_ids": true, "type": "md5", "uuid": "4d1c1101-bfe5-43dc-9042-cc9bd22807c9", "value": "0a2d2a4ec1ca2aa6a23a35abb5a75451", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346038", "to_ids": true, "type": "md5", "uuid": "34069ab1-afb8-426e-ab82-9057fd42a544", "value": "0ffb4b4e430f4b69216fb9d2e082e482", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346039", "to_ids": true, "type": "md5", "uuid": "b51d7838-7977-44d4-ab88-897300d58a36", "value": "10ba24db187836efe77ed7e75d279d33", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346040", "to_ids": true, "type": "md5", "uuid": "395a3354-ab81-49f8-8a1d-6384d9529493", "value": "16fed5909de4f50351fc33fbfcf156df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346041", "to_ids": true, "type": "md5", "uuid": "9e5e4456-1561-44af-81a5-e451471a85dc", "value": "18f894a3168ee0b809eed321a2e748b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346043", "to_ids": true, "type": "md5", "uuid": "0b25b6ed-5c4b-4474-914a-bb74116a7d15", "value": "19232d0eff3ef7aee3b5d7620c72358c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346044", "to_ids": true, "type": "md5", "uuid": "7803d073-7a8f-4fa4-bf29-bcc537bf1fba", "value": "36ff9f683e870145aaf5a715bc934762", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346045", "to_ids": true, "type": "md5", "uuid": "10f1066c-a9e1-4312-9732-43b3a30d84a6", "value": "44805c4b36bd3d97ba8ecaf6fe103572", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346046", "to_ids": true, "type": "md5", "uuid": "c2bc6b03-935c-4f27-93cb-be896c48690f", "value": "4c80d17fa5db5b1c2aaddb5351e9cb6b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346047", "to_ids": true, "type": "md5", "uuid": "fd5e7374-5800-4515-a2a0-3f6070b27ce7", "value": "5d9cdb072415b191df3f444f53b2ff4b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346047", "to_ids": true, "type": "md5", "uuid": "f6989c3f-977c-4d01-a571-b2ff5b8452ac", "value": "6869f24aecd75e2144aba8dc03dc2d0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346048", "to_ids": true, "type": "md5", "uuid": "e5ca8fd5-fad2-4586-89ed-c913001c24ed", "value": "6f761f63642cd6329a29cfad80be50c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346049", "to_ids": true, "type": "md5", "uuid": "296f0c7f-f76f-4edd-a4a6-ccbfd77559d2", "value": "6f91d1f8f0cbaab137351936b52f7a94", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346050", "to_ids": true, "type": "md5", "uuid": "4b6d5f5b-5ea4-4faf-b6bc-5a186e5c28bf", "value": "7461445fca3f9d8911148e0908d33c3b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346051", "to_ids": true, "type": "md5", "uuid": "517e0009-9ac3-4929-a5f2-43a949464ea6", "value": "7b361a6d0d42309d09ec9000b53712b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346052", "to_ids": true, "type": "md5", "uuid": "f5923358-0508-4ce2-ac3c-042c151d54ca", "value": "7f2b2e3516fa454adfd51f857ae80adf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346053", "to_ids": true, "type": "md5", "uuid": "01714876-883a-41ec-b410-b1bee3abb6e4", "value": "8cc249b16adf7e4a658af7fa31d7998e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346054", "to_ids": true, "type": "md5", "uuid": "c0121261-40de-40d6-9e1c-d8865365ce35", "value": "8deb2a60d42de0f8f8786e485d2f046f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346055", "to_ids": true, "type": "md5", "uuid": "a72dedc9-92bc-4a02-8aed-f9567317b5bf", "value": "8edb3ea62a7e643ba1a88d20799cf94f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346056", "to_ids": true, "type": "md5", "uuid": "98f48e1f-e9a9-4ad0-b770-befebaf7e6c0", "value": "9221423d7daff9e64f7e2af54f911fea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346056", "to_ids": true, "type": "md5", "uuid": "6ceeb873-7773-44b5-a361-68501c8ce5af", "value": "9660895fa3fcabbef466703636f6d51d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346058", "to_ids": true, "type": "md5", "uuid": "82ac2acc-df38-4e2a-b041-28e9b626d6b7", "value": "98e55d712a99d2cd45e8592c6dda5110", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346059", "to_ids": true, "type": "md5", "uuid": "b0c282a4-6f98-4dc8-85bf-fcd2229c910d", "value": "9973676bfa9fe89aa5c76e3cd0b21ae8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346060", "to_ids": true, "type": "md5", "uuid": "bbabcf0b-4097-40df-b3b1-189fa31f8881", "value": "a2d54fcd0c2816f607a5962523fc648c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346061", "to_ids": true, "type": "md5", "uuid": "f8219e40-1121-4210-9239-ed46fe00540d", "value": "a3181550e0e0a6153a44b7a0495535b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346062", "to_ids": true, "type": "md5", "uuid": "f8326582-8b3e-4fc4-8529-584cc6d48197", "value": "a3e3197e2344c51e95c063541ea22205", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346064", "to_ids": true, "type": "md5", "uuid": "803a908a-147c-4ed4-b55d-fe8967195fcd", "value": "a5101caf0a1789d6a4bc30e644d6b152", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346065", "to_ids": true, "type": "md5", "uuid": "851ee70c-cab2-4a0b-a88b-949131e11d89", "value": "b0f4f813a9de094c06821366e2459aee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346065", "to_ids": true, "type": "md5", "uuid": "7302a318-52c7-42a2-8eb8-970a70959408", "value": "b104a05e8a2e218adfb7654ba8bf3d49", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346066", "to_ids": true, "type": "md5", "uuid": "f39f2b41-f86b-4084-a84d-8dd296a5aa49", "value": "b9406e969cdfdaef433e93d0b9ad1f5d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346067", "to_ids": true, "type": "md5", "uuid": "20d420bc-b025-4f50-9bab-c091d1471269", "value": "c113739225ece5f6e4805466dec1401d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346068", "to_ids": true, "type": "md5", "uuid": "98b2ca0e-a180-4e08-bf88-1406e598b1d2", "value": "d2fd89ebdad493ec9ac76ce35213cec4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346070", "to_ids": true, "type": "md5", "uuid": "ead27bc6-b52c-4d1e-91ac-a39f7756fde1", "value": "d79270ba44e665ebb0383eb77a52e38b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346071", "to_ids": true, "type": "md5", "uuid": "00d52754-1dd7-41c9-ba6c-98f559ddd2df", "value": "d997efa98afab2c003654b8d5ce2bedf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346073", "to_ids": true, "type": "md5", "uuid": "d502a2f1-a3d8-42af-a42c-e7c46a2d395c", "value": "dbcc5a3e6afe41060d6357e24dc03fd3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346074", "to_ids": true, "type": "md5", "uuid": "da428273-fc8b-4901-9cd0-f5d6a615327d", "value": "dbdd4d8e4aef3ce69cf65ed470425c89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346075", "to_ids": true, "type": "md5", "uuid": "00ae68da-d36f-439a-904d-053c81a5ec92", "value": "dc35086ba0f5f83545c32a023a1f3be4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346076", "to_ids": true, "type": "md5", "uuid": "675fa171-b745-49ee-9ca5-aaa60c305020", "value": "dc71c10ca0b2c83b6b3a6a062fca314f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346077", "to_ids": true, "type": "md5", "uuid": "8c20f7f1-848b-496e-8335-06943c9dac00", "value": "dd1e5a3cd9f842bd70be45a62c3ebbf6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346078", "to_ids": true, "type": "md5", "uuid": "81b107ca-b277-4ae1-8baf-4f19c1028f56", "value": "df0c9f6289e56f31c0700f40590857d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346079", "to_ids": true, "type": "md5", "uuid": "dd868010-75ba-437c-a621-c0b0496947d9", "value": "e6b27080aa1ce1901a23dd75716d9092", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346081", "to_ids": true, "type": "md5", "uuid": "561ac956-3470-43f0-9fbb-3e0ad6d4ae6b", "value": "e9916ff56074725f5739ead5091fe6c7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346082", "to_ids": true, "type": "md5", "uuid": "da748c8f-5291-41ac-84c7-7b1e810d36b3", "value": "ea2fe3b409da439aec25cf7eabf5b7a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346083", "to_ids": true, "type": "md5", "uuid": "0dcd9501-df07-4dd5-ac55-a9847a308b5c", "value": "ed9209111b995cbe78f8e097c289f127", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346084", "to_ids": true, "type": "md5", "uuid": "2d83f778-13ad-4b3c-86ee-97f666239c34", "value": "f093891e281bcd9c8016dea7d89cc671", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346085", "to_ids": true, "type": "md5", "uuid": "84529a89-4f9a-4e13-bfba-3f53ecde7039", "value": "fc4cee066d8526f5806bb23278f647da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346086", "to_ids": true, "type": "md5", "uuid": "63828484-f7bf-44ae-b01e-d05c296b1acb", "value": "fcc9de5c040307e6ac3011e8b379f6d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346088", "to_ids": true, "type": "md5", "uuid": "36129b4e-006b-45d0-bf3f-9f98bff7ff57", "value": "ff11e000f377c54dea928b09ebad9df8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:25/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782346089", "to_ids": true, "type": "md5", "uuid": "262b9d5b-8a99-42c3-adf9-e9161c435ef2", "value": "fffcbd0ac2cb545496890f50395181ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347804", "to_ids": true, "type": "url", "uuid": "3221830b-2da8-4943-95f6-97f3667093dd", "value": "http://eixfi.ajb8.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347825", "to_ids": true, "type": "url", "uuid": "347f9a96-74b3-4b26-bfd3-6ca6eafaee5b", "value": "http://hgodpcx.ajb8.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347846", "to_ids": true, "type": "url", "uuid": "8038175c-6b50-444d-977e-2d194d98f60a", "value": "http://hgodpcx.ajb8.com/prod/RTL819X/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347867", "to_ids": true, "type": "url", "uuid": "7d26685a-2d47-4dfb-9549-b3cf6539a28b", "value": "http://opi7.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347888", "to_ids": true, "type": "url", "uuid": "c0c343e3-11eb-4f1d-ae0c-f84fd5083b3d", "value": "http://xonice.ahb8.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347908", "to_ids": true, "type": "url", "uuid": "eadd9727-7654-4b85-bf30-f8d670d5ea72", "value": "http://xook.ajb8.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347930", "to_ids": true, "type": "url", "uuid": "8b0914d5-da40-42d4-95f8-5356fa4887af", "value": "https://dybic.ajb8.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347952", "to_ids": true, "type": "url", "uuid": "3b5f9c10-7a91-4e68-bd52-6915b6d4974f", "value": "https://hgodpcx.ajb8.com/n", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347973", "to_ids": true, "type": "url", "uuid": "51721749-b9fe-41ea-aa45-8fd621836446", "value": "https://hgodpcx.ajb8.com/prod/RTL819X/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782347994", "to_ids": true, "type": "url", "uuid": "2da1f511-cf5a-4884-95a6-89710e73b3f6", "value": "https://hgodpcx.ajb8.com/prod/standard/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348015", "to_ids": true, "type": "url", "uuid": "9f70f4c1-94f8-4aff-82e9-0d871756fb6d", "value": "https://hgodpcx.auq8.com/t", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348036", "to_ids": true, "type": "url", "uuid": "90b7a87d-4950-4a24-9ebb-b33318def497", "value": "https://sdkv1.dataexplore.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348057", "to_ids": true, "type": "url", "uuid": "91c2b35c-444d-48ff-b7cb-85314159fd65", "value": "https://sdkv1.dataexplore.co", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348081", "to_ids": true, "type": "domain", "uuid": "acae242e-4fb8-4544-ba8c-7cffdf93641a", "value": "opi7.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348102", "to_ids": true, "type": "hostname", "uuid": "54c362a3-9086-4192-a242-06ee6f4c81df", "value": "dybic.ajb8.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348123", "to_ids": true, "type": "hostname", "uuid": "1a9edb93-baee-408a-85b0-d44c57b88054", "value": "eixfi.ajb8.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348146", "to_ids": true, "type": "hostname", "uuid": "75793af8-52d9-4087-9677-3f88153bb77a", "value": "hgodpcx.ajb8.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348167", "to_ids": true, "type": "hostname", "uuid": "146fe2c0-ec99-4052-a58e-c24a1c3d0d2b", "value": "hgodpcx.auq8.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348188", "to_ids": true, "type": "hostname", "uuid": "5fe769ae-b6ad-48f0-8db6-748bca0e3325", "value": "io.ary2.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348209", "to_ids": true, "type": "hostname", "uuid": "54da4540-f4c9-4344-80d1-dd4f2bf0f2c7", "value": "sdkv1.dataexplore.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348230", "to_ids": true, "type": "hostname", "uuid": "dffa47d0-32c7-46f5-a45c-b9f553ea538d", "value": "sdkv1.dataexplore.co", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348252", "to_ids": true, "type": "hostname", "uuid": "b5e1a66b-5652-44c5-9344-c3bd9cd57cad", "value": "xonice.ahb8.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348273", "to_ids": true, "type": "hostname", "uuid": "7325051c-be62-4371-9731-c247227a974a", "value": "xook.ajb8.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348294", "to_ids": true, "type": "ip-dst", "uuid": "7f363479-44e0-4fd8-accd-e836fb2016f0", "value": "107.150.106.14", "Tag": [ { "colour": "#c3a785", "local": false, "name": "asn:asn=\"135377\"", "relationship_type": "" }, { "colour": "#273bfe", "local": false, "name": "asn:as-owner=\"UCLOUD-HK-AS-AP UCLOUD INFORMATION TECHNOLOGY HK LIMITED\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348315", "to_ids": true, "type": "url", "uuid": "3a276d5b-1072-4818-a18d-18aeae384642", "value": "https://hgodpcx.ajb8.com/prod/RTL819X/{version}/manifest.json", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348336", "to_ids": true, "type": "url", "uuid": "843617aa-b588-4c5d-a7d6-97c4edbff267", "value": "https://hgodpcx.ajb8.com/prod/standard/{version}/manifest.json", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348357", "to_ids": true, "type": "url", "uuid": "95b3b672-eb75-474c-a3d5-85fb8ceedaa9", "value": "http://hgodpcx.ajb8.com/prod/RTL819X/{version}/syswapd0", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782348379", "to_ids": true, "type": "url", "uuid": "a06719ca-e652-4c07-8206-ddfec4925c71", "value": "https://hgodpcx.ajb8.com/prod/standard/{version}/syswapd0-linux-amd64", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348401", "uuid": "9b90c36c-c691-47a8-8b07-edfd2ec92e81", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348401", "to_ids": true, "type": "md5", "uuid": "9c2838bd-5c15-42d3-ad05-cf46fde33f0b", "value": "a97e552f5e655e1cfa56853f65beeb0e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346032", "to_ids": true, "type": "sha1", "uuid": "1c487338-17c4-4a0f-b2d0-6e834f2b56bc", "value": "dfd31914f3d33c6954e50029fe3d30ab2afffeff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346032", "to_ids": true, "type": "sha256", "uuid": "f23adff1-2fb5-482b-bd7c-f565a06c296e", "value": "438a312df6bbbef5424add23e91d71b6a7cac3e2d77f1b11b09db4eb59d75bbe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782344778", "to_ids": true, "type": "ssdeep", "uuid": "d5ef6e05-4217-4918-9f02-b62aa73fe735", "value": "6144:n5Gq1GY7QXXnmtpw1cg/jA3Edu5eQ/cSeYOI8rcJcRkfZhnxEqh8XcTcH8sckBFJ:5lGEQHnmtpwrA3EdWfq7jqAylP+7B5Hp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782344778", "to_ids": false, "type": "size-in-bytes", "uuid": "0aa96286-4b84-4ca2-aff6-dc4b9763d3e9", "value": "367764" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782344778", "to_ids": true, "type": "vhash", "uuid": "7817415a-c4e8-4872-b8c9-0cd491d47ad5", "value": "8c88fb4769681a0b6c65daa092a7dfcd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782344778", "to_ids": true, "type": "filename", "uuid": "b086ba21-d60e-46f8-aecc-a9319b56bcb9", "value": "2pw0oa.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782344778", "to_ids": false, "type": "text", "uuid": "99addf74-00fb-4bfd-9103-7a5456fbf46d", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nVT Total Detection:25/62\nFirst Submission:2026-06-02T02:20:39.000000+00:00\nLast Submission:2026-06-02T02:20:39.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782348422", "uuid": "55989e76-6be8-406b-9966-78e0da90a3b4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782348422", "to_ids": true, "type": "md5", "uuid": "00d0f44e-2d1a-4ce4-8b95-ea3016148b44", "value": "abae20b26b70b526bebb5e2617092ede", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782346033", "to_ids": true, "type": "sha1", "uuid": "da5c51c7-7194-455e-9d97-8ae66f61cfb7", "value": "4c7693682d25f31b286499349c39fdcd5a03fb57", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782346034", "to_ids": true, "type": "sha256", "uuid": "c5cf30b8-1730-4b4a-bcb9-c845b07eaa4a", "value": "43731d791d3eb906e60b1c4e957ebe855a1af6d0a8c1ee30c3c0c7ab7c1060b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782344800", "to_ids": true, "type": "ssdeep", "uuid": "53f98c37-edb1-4147-8cf0-632c26165c8f", "value": "24576:iqVT4/W/CwK5HZZbaTLvGHTpLlvaHKa7zKM+gxbWt5NtMnEoI97pV:iqV05HikJlvaHhygxpEoc7j" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782344800", "to_ids": false, "type": "size-in-bytes", "uuid": "b14b19a5-94d8-45d3-bf9f-5f850c1cd2bb", "value": "2740448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782344800", "to_ids": true, "type": "vhash", "uuid": "f918efe7-67bb-461c-844e-73bcdb6307e4", "value": "13aae498ea3937f06b29cee8d3613b4e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782344800", "to_ids": true, "type": "filename", "uuid": "8a58d310-b550-4c7e-ba32-879abee9ff6a", "value": "geehucf5h.exe" }, { "category": "Other", "comment": "Checked: 25/06/2026\nLast-scan\t: 24/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782344800", "to_ids": false, "type": "text", "uuid": "b3dc96bf-4cad-4158-9dc4-d73c5bee1f2d", "value": "Type Description: ELF\nMicrosoft: Trojan:Script/Wacatac.C!ml\nVT Total Detection:5/62\nFirst Submission:2026-06-10T04:10:54.000000+00:00\nLast Submission:2026-06-10T04:10:54.000000+00:00" } ] } ] } }