{ "Event": { "analysis": "1", "date": "2026-06-03", "extends_uuid": "", "info": "[Threat Intel] TA4922: The Suspected Chinese Crime Group is Going Global", "protected": false, "publish_timestamp": "1781219328", "published": true, "threat_level_id": "2", "timestamp": "1781219328", "uuid": "6a7790d3-55d8-46c0-9903-9a5dc28211d9", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#2d8ee7", "local": false, "name": "misp-galaxy:producer=\"Proofpoint\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#3909cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Collection - T1119\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#45f3d5", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Thread Execution Hijacking - T1055.003\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#ece0df", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Video Capture - T1125\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#f07d7c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": "" }, { "colour": "#4bc785", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#a0d02a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing for Information - T1598\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#5884a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"", "relationship_type": "" }, { "colour": "#cb2c9b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic-link Library Injection - T1055.001\"", "relationship_type": "" }, { "colour": "#c60dc9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing via Service - T1566.003\"", "relationship_type": "" }, { "colour": "#098efb", "local": false, "name": "misp-galaxy:target-information=\"British Indian Ocean Territory\"", "relationship_type": "" }, { "colour": "#5ed128", "local": false, "name": "misp-galaxy:target-information=\"Germany\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#f9cdc4", "local": false, "name": "misp-galaxy:target-information=\"Indonesia\"", "relationship_type": "" }, { "colour": "#4cea11", "local": false, "name": "misp-galaxy:target-information=\"Italy\"", "relationship_type": "" }, { "colour": "#5887a6", "local": false, "name": "misp-galaxy:target-information=\"Japan\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Malaysia\"", "relationship_type": "" }, { "colour": "#7dbb86", "local": false, "name": "misp-galaxy:target-information=\"Singapore\"", "relationship_type": "" }, { "colour": "#35a578", "local": false, "name": "misp-galaxy:target-information=\"South Africa\"", "relationship_type": "" }, { "colour": "#2613b0", "local": false, "name": "misp-galaxy:target-information=\"Taiwan\"", "relationship_type": "" }, { "colour": "#ce59f1", "local": false, "name": "misp-galaxy:target-information=\"United Kingdom\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ValleyRAT\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#dd2e44", "local": false, "name": "rectifyq:MY-relevancy=\"relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570849", "to_ids": false, "type": "link", "uuid": "fa843c1b-5034-430f-b37a-0167afd65fbc", "value": "https://www.proofpoint.com/us/blog/threat-insight/ta4922-suspected-chinese-crime-group-going-global" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780570849", "to_ids": false, "type": "text", "uuid": "b75fa370-a5de-4ef2-88ea-e75a98e47f2c", "value": "TA4922 is a highly sophisticated Chinese-speaking threat actor demonstrating rapid operational tempo and continually evolving malware capabilities. Initially targeting East Asia, particularly Japan, the group has expanded globally to Europe and Africa. The actor deploys multiple malware families including Atlas RAT, RomulusLoader, SilentRunLoader, and ValleyRAT (Winos4.0), alongside legitimate remote management tools like AnyDesk and SyncFuture. Campaigns use localized lures themed around HR, payroll, tax, and invoicing, targeting hundreds to thousands of recipients per campaign. TA4922 conducts credential phishing, fraud operations including credit card theft, and attempts to shift communications to out-of-band channels like LINE, WhatsApp, and Microsoft Teams. The group leverages legitimate cloud hosting services and trusted software for delivery and persistence, combining advanced tradecraft with financially motivated objectives such as data theft, fraud, access resale, and persistent remote access." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780570849", "to_ids": false, "type": "text", "uuid": "3b62473f-254c-4da8-ba28-4860cfcc52c5", "value": "Name: TA4922: The Suspected Chinese Crime Group is Going Global\nAuthor: AlienVault\nAdversary: TA4922\nTags: [\"romulusloader\", \"atlas rat\", \"ta4922\", \"valleyrat\", \"silentrunloader\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"Germany\", \"India\", \"Indonesia\", \"Italy\", \"Japan\", \"Malaysia\", \"Singapore\", \"South Africa\", \"Taiwan\", \"United Kingdom of Great Britain and Northern Ireland\"]\nMlwr families: [\"Atlas RAT\", \"RomulusLoader\", \"SilentRunLoader\", \"ValleyRAT\", \"Winos4.0\", \"HoldingHands\", \"AnyDesk\", \"SyncFuture\"]\nAttack_ids: [\"T1113\", \"T1056.001\", \"T1204.002\", \"T1573.001\", \"T1566.002\", \"T1566.001\", \"T1119\", \"T1005\", \"T1140\", \"T1055.003\", \"T1055\", \"T1125\", \"T1041\", \"T1566\", \"T1571\", \"T1055.012\", \"T1027\", \"T1598\", \"T1574.002\", \"T1105\", \"T1204.001\", \"T1055.001\", \"T1566.003\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1780620834", "to_ids": false, "type": "threat-actor", "uuid": "ea76f418-b584-4186-ba92-43f4a40bc227", "value": "TA4922", "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#2d8ee7", "local": false, "name": "misp-galaxy:producer=\"Proofpoint\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Atlas RAT C2", "deleted": false, "disable_correlation": false, "timestamp": "1781215412", "to_ids": true, "type": "ip-dst", "uuid": "d87d6767-8778-4f17-9f91-128686132280", "value": "154.211.86.110", "Tag": [ { "colour": "#a4fdc7", "local": false, "name": "asn:asn=\"399077\"", "relationship_type": "" }, { "colour": "#d5daf8", "local": false, "name": "asn:as-owner=\"TERAEXCH\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RomulusLoader component (vulkan-1.bin) No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215065", "to_ids": true, "type": "sha256", "uuid": "11b89e8a-2d98-4049-be5c-a4f902c704dc", "value": "3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RAR archive (\u4f1a\u793e\u6587\u66f8.rar) delivering RomulusLoader No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215065", "to_ids": true, "type": "sha256", "uuid": "8f555daa-5881-4fce-a7e1-4da8874665ca", "value": "40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive (HR (2).zip) delivering Atlas RAT No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215066", "to_ids": true, "type": "sha256", "uuid": "ea9b3919-0917-4c12-97b6-87d456090af7", "value": "4fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive (Paperwork.zip) delivering Atlas RAT No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215066", "to_ids": true, "type": "sha256", "uuid": "9f5ba426-74b6-4832-a4a1-e28599a292e0", "value": "66a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RomulusLoader DLL (vulkan-1.dll) No sample in VT\r\nLast check:12/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1781215068", "to_ids": true, "type": "sha256", "uuid": "b8448f65-4366-4e09-9b61-7815e0eef112", "value": "8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "RomulusLoader First-stage C2", "deleted": false, "disable_correlation": false, "timestamp": "1781215434", "to_ids": true, "type": "ip-dst", "uuid": "8dae877e-22b5-4ef3-b8f3-a46cfcadb7e9", "value": "103.214.172.33", "Tag": [ { "colour": "#89180a", "local": false, "name": "asn:asn=\"55933\"", "relationship_type": "" }, { "colour": "#8d5bf4", "local": false, "name": "asn:as-owner=\"CLOUDIE-AS-AP Cloudie Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781215455", "to_ids": true, "type": "ip-dst", "uuid": "d84459c4-75a2-4b26-8ddf-1a1b0cf75208", "value": "112.121.183.202", "Tag": [ { "colour": "#ba5afe", "local": false, "name": "asn:asn=\"45753\"", "relationship_type": "" }, { "colour": "#fcdeb8", "local": false, "name": "asn:as-owner=\"NETSEC-HK Netsec Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Atlas RAT C2", "deleted": false, "disable_correlation": false, "timestamp": "1781215476", "to_ids": true, "type": "ip-dst", "uuid": "c8a12b04-1c28-4bdb-8510-fe0a89b928dd", "value": "206.238.115.58", "Tag": [ { "colour": "#a4fdc7", "local": false, "name": "asn:asn=\"399077\"", "relationship_type": "" }, { "colour": "#d5daf8", "local": false, "name": "asn:as-owner=\"TERAEXCH\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "URL used in RomulusLoader / SyncFuture campaign which hosted a landing page with download button", "deleted": false, "disable_correlation": false, "timestamp": "1781215497", "to_ids": true, "type": "url", "uuid": "be8fd5b8-588c-408d-a286-2581626c449f", "value": "https://nwphotoblog.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilentRunLoader download URL", "deleted": false, "disable_correlation": false, "timestamp": "1781215518", "to_ids": true, "type": "url", "uuid": "767d3e74-bba7-4305-9ed9-2d5a56c54ef2", "value": "https://ws.ztts88.cyou/file/cg.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilentRunLoader data exfiltration URL", "deleted": false, "disable_correlation": false, "timestamp": "1781215539", "to_ids": true, "type": "url", "uuid": "a4178d77-93d0-43f1-aab7-0cb7ff2aae72", "value": "https://ws.ztts88.cyou/upload.php", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "URL used in RomulusLoader / SyncFuture campaign which hosted a landing page with download button", "deleted": false, "disable_correlation": false, "timestamp": "1781215561", "to_ids": true, "type": "domain", "uuid": "b05b3fad-27f0-4bd1-83e3-5c5ea4448f72", "value": "nwphotoblog.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781215582", "to_ids": true, "type": "hostname", "uuid": "eacfdb1a-c94c-492b-9251-a7782cfc0fb4", "value": "ws.ztts88.cyou", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "RomulusLoader C2", "deleted": false, "disable_correlation": false, "timestamp": "1781215603", "to_ids": true, "type": "ip-dst", "uuid": "16168bb0-4361-4fad-9c22-5db137229423", "value": "43.156.77.97", "Tag": [ { "colour": "#dd7331", "local": false, "name": "asn:asn=\"132203\"", "relationship_type": "" }, { "colour": "#723dcd", "local": false, "name": "asn:as-owner=\"TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "SilentRunLoader data exfiltration IP", "deleted": false, "disable_correlation": false, "timestamp": "1781215625", "to_ids": true, "type": "ip-dst", "uuid": "1ed968d4-4f7f-403b-8030-909a9dbbac23", "value": "18.139.83.110", "Tag": [ { "colour": "#4745f2", "local": false, "name": "asn:asn=\"16509\"", "relationship_type": "" }, { "colour": "#5424ef", "local": false, "name": "asn:as-owner=\"AMAZON-02\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215646", "uuid": "11e67c11-c173-4f45-8012-497131eb8e50", "Attribute": [ { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture executable (Alles in dem schuppen.exe)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215646", "to_ids": true, "type": "md5", "uuid": "c3ef7226-8cb2-40e8-b56c-ecc0cc9575d5", "value": "315bda377beafb746f1c2f4fba430867", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture executable (Alles in dem schuppen.exe)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215055", "to_ids": true, "type": "sha1", "uuid": "0589d34d-6ceb-4f35-b682-4bc0b68647cc", "value": "62e3ba37a23669139a222cd43ec2b202277a4030", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture executable (Alles in dem schuppen.exe)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215055", "to_ids": true, "type": "sha256", "uuid": "cefa0b1a-6d6c-45e5-80a6-a66ef1d75a79", "value": "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213398", "to_ids": true, "type": "ssdeep", "uuid": "8e62c8c0-3aac-45c9-b314-58cb6e5b6bca", "value": "6144:vMTDKZGfvKRhPTyB0fVL3A8AG1myJ0bLehmzQnZoMTroJRoKhiz3ZZs+PE7b39By:wDKZGMsqsN9MpxJsse796CvbFJTG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213398", "to_ids": false, "type": "size-in-bytes", "uuid": "60c51f15-08b5-4db0-a532-72d371af0943", "value": "599384" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781213398", "to_ids": true, "type": "vhash", "uuid": "4ecfe954-91c1-4bdf-993c-60339ebc2a68", "value": "055066651d5555555088z637zb0cbz6fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213398", "to_ids": true, "type": "filename", "uuid": "a434e5ed-e317-452b-a12b-a9ab6b2bbbcd", "value": "OverwolfTSHelper.exe" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 12/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213398", "to_ids": false, "type": "text", "uuid": "5c9ddc4b-6b7b-4e16-9c00-1ca8a155e166", "value": "RomulusLoader / SyncFuture executable (Alles in dem schuppen.exe)\r\nType Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:1/71\nFirst Submission:2021-06-23T16:17:56.000000+00:00\nLast Submission:2026-05-25T16:03:47.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215667", "uuid": "aa233ee3-cc85-4675-b97a-4529b47a81dc", "Attribute": [ { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture DLL (teamspeak_control.dll)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215667", "to_ids": true, "type": "md5", "uuid": "c913f45b-328f-4842-bf9e-68b0fc6c2c61", "value": "3e7066e44132e64360a30974b6ea3671", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture DLL (teamspeak_control.dll)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215056", "to_ids": true, "type": "sha1", "uuid": "cfda11be-d72e-466f-adf5-a7e0d85c3688", "value": "483a36fb9e4aef9704aa1e4edfb88c492dfe4140", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture DLL (teamspeak_control.dll)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215056", "to_ids": true, "type": "sha256", "uuid": "ca1908de-0c88-469d-bd5d-9280e29c3d10", "value": "0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213420", "to_ids": true, "type": "ssdeep", "uuid": "bea01fc6-a9b8-4037-b9f9-b5bc4dcfeb47", "value": "98304:s+WadOBfKP4QT41wUbqTA0AxVSYIuU+LzmTOYOM2IJ7lETr3dwBkR1731e:GaTgQ1Oqk0AxVSN4zwl2IdlUNbR7e" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213420", "to_ids": false, "type": "size-in-bytes", "uuid": "39947c54-3154-4635-a7e8-726c2b2c2c81", "value": "4593667" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781213420", "to_ids": true, "type": "vhash", "uuid": "2ba5ecd0-7cfe-4183-ac83-e756df219b21", "value": "14607e6e5e1e5e0e7e5~z12" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213420", "to_ids": true, "type": "filename", "uuid": "bc6c6b67-ba8a-4f42-8599-b23e6f0a3a4d", "value": "SoftMgr" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213420", "to_ids": false, "type": "text", "uuid": "51598874-fb70-462e-9a4e-0e7be51d4f1b", "value": "RomulusLoader / SyncFuture DLL (teamspeak_control.dll)\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:51/71\nFirst Submission:2026-04-16T08:25:47.000000+00:00\nLast Submission:2026-04-18T03:59:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215688", "uuid": "1fa545b2-0be7-47f6-a30b-8466559f558d", "Attribute": [ { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture ZIP (Alles in dem schuppen.zip)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215688", "to_ids": true, "type": "md5", "uuid": "229d05f7-1651-45fc-9e36-d7d269cdb216", "value": "0ffb16209def5500ff4380d9e8093437", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture ZIP (Alles in dem schuppen.zip)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215057", "to_ids": true, "type": "sha1", "uuid": "87f617c5-96cc-49fa-a449-0d3718b08612", "value": "7b2c661cfb69e9c75df90d5102647bb014c28ad5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "RomulusLoader / SyncFuture ZIP (Alles in dem schuppen.zip)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215057", "to_ids": true, "type": "sha256", "uuid": "f2be3d98-51cf-405f-a462-c51d9de80ee7", "value": "314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213463", "to_ids": true, "type": "ssdeep", "uuid": "c30de23c-f4bb-47cf-b89d-3e6f35d68ffc", "value": "98304:7+xdFelMCTeJWGxqbaIxR+8AeUYVVuFI4OucWh1vEnebK9kBbJKiA4cEAW:iLYKCxYqbaIxR+F+VEHcW3vbBYDTW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213463", "to_ids": false, "type": "size-in-bytes", "uuid": "bad747d2-18e2-4e08-9f24-7d89623104fe", "value": "4627743" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781213463", "to_ids": true, "type": "vhash", "uuid": "6b9e1b42-b5d6-497b-904c-51ac9a217857", "value": "7f615c6c516e44af75d7ab2cc1b39772" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213463", "to_ids": true, "type": "filename", "uuid": "475342cd-85af-4cac-876d-5f313b7533a3", "value": "Alles in dem schuppen.zip" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213463", "to_ids": false, "type": "text", "uuid": "d70df3b4-e604-40b0-a206-26f2da13fd67", "value": "RomulusLoader / SyncFuture ZIP (Alles in dem schuppen.zip)\r\nType Description: ZIP\nMicrosoft: None\nVT Total Detection:45/68\nFirst Submission:2026-04-16T11:48:51.000000+00:00\nLast Submission:2026-04-16T14:55:08.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215710", "uuid": "6149ccb5-de08-4229-b0d5-e1ab1937df63", "Attribute": [ { "category": "Payload delivery", "comment": "Atlas RAT DLL (libcef.dll)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215710", "to_ids": true, "type": "md5", "uuid": "4c46e0f2-8fab-4ea3-9e78-3bcdfd12752b", "value": "c0738cfa4f1488956ef4aef054c3144a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Atlas RAT DLL (libcef.dll)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215059", "to_ids": true, "type": "sha1", "uuid": "481102b5-78a5-49d6-b7ae-1232cd5370dd", "value": "1ae8a59b1fa5fe0fac04b5f8b3d7ff84aced2d71", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Atlas RAT DLL (libcef.dll)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215059", "to_ids": true, "type": "sha256", "uuid": "1624bd73-5751-4749-a5f4-50eb80e56a14", "value": "584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213527", "to_ids": true, "type": "ssdeep", "uuid": "012db2b3-e6a3-4d37-befb-467992bfa1f9", "value": "3072:tTXN0oP9Or8MNlAgM9x7cFOOyQy1FAnigHH:t6e910+v7cFliCH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213527", "to_ids": false, "type": "size-in-bytes", "uuid": "4c29883f-cbc1-4dae-aa0c-9ff20db6b282", "value": "125440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781213527", "to_ids": true, "type": "vhash", "uuid": "4ce0510d-7679-4e6c-9bbc-f35fdc01f32f", "value": "115076655d15551d055048z56dz17z1dzc8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213527", "to_ids": true, "type": "filename", "uuid": "109c7ccc-5bd9-4bf1-ac8d-a9d621b901fe", "value": "libcef.dll" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213527", "to_ids": false, "type": "text", "uuid": "4073a770-3089-48d0-bc84-d3c8b510df9f", "value": "Atlas RAT DLL (libcef.dll)\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:48/71\nFirst Submission:2026-03-09T10:44:42.000000+00:00\nLast Submission:2026-06-04T17:21:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215732", "uuid": "caca2311-b361-4709-bb5d-3ea3c91ff0e9", "Attribute": [ { "category": "Payload delivery", "comment": "SilentRunLoader Executable", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215732", "to_ids": true, "type": "md5", "uuid": "10ce9834-0b4c-4006-b7e5-f93970ba84ce", "value": "da3161679965c898574449b7d789451c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SilentRunLoader Executable", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215059", "to_ids": true, "type": "sha1", "uuid": "e5fb8347-8f70-4ff1-8171-b821109e655e", "value": "a8409848b0fcec6514b43971358adb33b5a09299", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SilentRunLoader Executable", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215060", "to_ids": true, "type": "sha256", "uuid": "0a454a7c-3e9c-4fcb-8484-63a3900f3cda", "value": "9d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213591", "to_ids": true, "type": "ssdeep", "uuid": "51fbdaba-5768-4542-866d-d587b108533f", "value": "98304:VnAzrDqy0b+sX1ZvbeAyJZ/dJolTlPNs2PKToa1FptF07TUFpMndHuBqVJpddoa:qzj0CsXDjDyf/dJolpPgToa10/UFOnJ4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213591", "to_ids": false, "type": "size-in-bytes", "uuid": "33e01f9d-0404-4daf-b716-a1fe84c38919", "value": "5605504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781213591", "to_ids": true, "type": "vhash", "uuid": "d5128434-7d24-4071-9d5e-b0ab3632126e", "value": "056076655d155d0575504013z3006emz1cfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213591", "to_ids": true, "type": "filename", "uuid": "8a660537-f914-4612-91a8-c0444f634121", "value": "SilentRunAndUpload.exe" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 12/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213591", "to_ids": false, "type": "text", "uuid": "7eaec1fc-ab50-4ea6-9df3-fe9f5cbabb48", "value": "SilentRunLoader Executable\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:42/71\nFirst Submission:2026-04-10T04:54:22.000000+00:00\nLast Submission:2026-04-10T04:54:22.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215753", "uuid": "f03c4587-b653-4aa5-9eae-0a8d9121f1a4", "Attribute": [ { "category": "Payload delivery", "comment": "ZIP archive (\u3010\u7d66\u4e0e\u8abf\u6574\u306e\u304a\u77e5\u3089\u305b\u3011.zip) delivering Atlas RAT", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215753", "to_ids": true, "type": "md5", "uuid": "d7e2c52a-a203-4fa5-a370-e26f52f9474b", "value": "2960b323ffcd4cf419d4b0c9ba3648e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive (\u3010\u7d66\u4e0e\u8abf\u6574\u306e\u304a\u77e5\u3089\u305b\u3011.zip) delivering Atlas RAT", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215060", "to_ids": true, "type": "sha1", "uuid": "4fadb1fd-4572-4ab4-a849-74e6d507307e", "value": "4ce347a7247fdfe26097435c134c5b6f31ee8c6d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive (\u3010\u7d66\u4e0e\u8abf\u6574\u306e\u304a\u77e5\u3089\u305b\u3011.zip) delivering Atlas RAT", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215060", "to_ids": true, "type": "sha256", "uuid": "8f10ee7d-7191-4d1f-b0e2-93c9f37c140e", "value": "a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213613", "to_ids": true, "type": "ssdeep", "uuid": "aa8934f0-e195-4b47-9ee5-08c31369a4a8", "value": "98304:o6uwMSGtldbR9QYSmKL7jqB751QekcJC/s6HIYkZOEQqeBhB27O0JcMKUUVbB+Nf:nuicyYg7jbekbFkZOEZag7OFMYHiqv6r" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213613", "to_ids": false, "type": "size-in-bytes", "uuid": "36e77a6a-f16d-423f-84d5-f458a3c827ab", "value": "7161090" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781213613", "to_ids": true, "type": "vhash", "uuid": "79c6a8d5-914c-44b5-b810-d5c452c759fd", "value": "cd7e0e65291b3e4e3247773b54437d34" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213613", "to_ids": true, "type": "filename", "uuid": "35a6a6d1-5baf-4287-9262-08ee0c11fabf", "value": "a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295.zip" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213613", "to_ids": false, "type": "text", "uuid": "a589df23-5c47-43fc-a0c2-d1dd223fdb91", "value": "ZIP archive (\u3010\u7d66\u4e0e\u8abf\u6574\u306e\u304a\u77e5\u3089\u305b\u3011.zip) delivering Atlas RAT\r\nType Description: ZIP\nMicrosoft: None\nVT Total Detection:37/68\nFirst Submission:2026-03-09T11:26:55.000000+00:00\nLast Submission:2026-03-09T11:26:55.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215774", "uuid": "0e56b76e-897c-4747-b9a6-82de5deab07e", "Attribute": [ { "category": "Payload delivery", "comment": "Atlas RAT DLL (libcef.dll)", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215774", "to_ids": true, "type": "md5", "uuid": "e376f7ff-0760-471e-82db-05fe77cbfee5", "value": "1bd939d2bcc0851348263cd06092686d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Atlas RAT DLL (libcef.dll)", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215062", "to_ids": true, "type": "sha1", "uuid": "c8e8982f-7571-4273-9510-b7a73658d7a7", "value": "e0c76ff64a577a38e0bfa38855c43370dc134c14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Atlas RAT DLL (libcef.dll)", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215062", "to_ids": true, "type": "sha256", "uuid": "100c72cf-7ac9-41e2-a040-f953dc11303c", "value": "a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213635", "to_ids": true, "type": "ssdeep", "uuid": "676028ab-fed8-4e2f-b413-3a21c3ceb130", "value": "1536:2kgK69ujismwT0m25S1XQa6hjm1hMu5sWRd09dlWGr+dhySyyyyyyyyyyyyyyyyS:9A9ujisbTB25A4hjm3MSM8Gr+lMAy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213635", "to_ids": false, "type": "size-in-bytes", "uuid": "90394088-faf8-4668-a2e1-507293bf7f1f", "value": "105472" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781213635", "to_ids": true, "type": "vhash", "uuid": "015fbe12-bb4a-4368-b074-0eec5766d79f", "value": "115076655d155515155018z5ez17z1dzc8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213635", "to_ids": true, "type": "filename", "uuid": "d845c77e-2154-41cf-9406-db6e73a1ec86", "value": "__a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dad.dll.bin" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213635", "to_ids": false, "type": "text", "uuid": "5315a5a4-de83-4a0c-8b7f-68bb9fac33e1", "value": "Atlas RAT DLL (libcef.dll)\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/Leonem!rfn\nVT Total Detection:50/71\nFirst Submission:2026-04-07T06:11:03.000000+00:00\nLast Submission:2026-06-09T07:02:08.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215795", "uuid": "ba038f16-d7ab-4c42-adeb-6e62128a3b4b", "Attribute": [ { "category": "Payload delivery", "comment": "SilentRunLoader ZIP", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215795", "to_ids": true, "type": "md5", "uuid": "b6bd6c6b-0ed7-46aa-bd77-e9de8d8fa215", "value": "3cb0a1f572056cd4eb65c19c3c85c7e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SilentRunLoader ZIP", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215062", "to_ids": true, "type": "sha1", "uuid": "7608922e-2fea-46ee-bd6d-d9ca8332cfab", "value": "bfa01c441412c89e4d847309e365354ddd2b0655", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SilentRunLoader ZIP", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215063", "to_ids": true, "type": "sha256", "uuid": "6589382e-46ff-41dd-9fd4-2e5acfa076d4", "value": "de82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213660", "to_ids": true, "type": "ssdeep", "uuid": "5be0344e-b49d-49ba-b11b-c25c943b2bbd", "value": "98304:H9ury0at/FjhE5ICadwWJjuCKtfd7tS2U2AnY5Ji9qrj585/T7Sdeg4KzDDSj8f+:HAcVE5ntO9KtfdhnU5+Jce8FTCzDDff+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213660", "to_ids": false, "type": "size-in-bytes", "uuid": "71831d15-aaa7-4761-ad51-e2a50dbda723", "value": "5415439" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213660", "to_ids": true, "type": "filename", "uuid": "29f08002-c324-4365-8acb-e728f4537d3d", "value": "Pengingat untuk mengirimkan aplikasi Hope Family Planning Assistance (PKH) terbaru..rar" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213660", "to_ids": false, "type": "text", "uuid": "38f46bcb-a1a0-4ee7-929e-8aaab181fdcb", "value": "SilentRunLoader ZIP\r\nType Description: RAR\nMicrosoft: None\nVT Total Detection:28/64\nFirst Submission:2026-04-10T04:52:34.000000+00:00\nLast Submission:2026-04-11T03:52:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1781215816", "uuid": "b1eace52-bb24-4adc-8c6e-ed1be3777a8a", "Attribute": [ { "category": "Payload delivery", "comment": "SilentRunLoader Executable", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1781215816", "to_ids": true, "type": "md5", "uuid": "a1fbb4e5-3077-4fbe-8295-1cc192afdbdc", "value": "2e738dae88d058110c55b63233cee2de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SilentRunLoader Executable", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1781215063", "to_ids": true, "type": "sha1", "uuid": "9683b32b-835a-4c45-9a66-771a79dc6962", "value": "c2a375a60bedf75a3fb014c41b8486ebdc1249d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "SilentRunLoader Executable", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1781215063", "to_ids": true, "type": "sha256", "uuid": "77a5708b-5cb1-4b7c-95b5-2a216cee1638", "value": "e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1781213682", "to_ids": true, "type": "ssdeep", "uuid": "216baf8b-1c41-485d-9a2b-a347b220f835", "value": "98304:MLzza9/b+sX1ZvbeAyJZ/dJolTlPNs2PKToa1FptF07TUFpMndHfBqe1Sddoa:Aza/CsXDjDyf/dJolpPgToa10/UFOnJ3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1781213682", "to_ids": false, "type": "size-in-bytes", "uuid": "728f8e3b-9ed3-4177-a03d-2fa16301f7f7", "value": "5601006" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1781213682", "to_ids": true, "type": "vhash", "uuid": "64af958a-0307-45b5-bae2-13b9f0887317", "value": "056076655d155d0575504013z3006emz1cfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1781213682", "to_ids": true, "type": "filename", "uuid": "da7a7099-e4b3-41b7-b879-4d30faaf0667", "value": "SilentRunAndUpload.exe" }, { "category": "Other", "comment": "Checked: 12/06/2026\nLast-scan\t: 11/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1781213682", "to_ids": false, "type": "text", "uuid": "578239d9-41b1-401a-86b5-ffe513adc828", "value": "SilentRunLoader Executable\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win32/Casdet!rfn\nVT Total Detection:39/71\nFirst Submission:2026-03-30T11:30:32.000000+00:00\nLast Submission:2026-06-04T03:51:36.000000+00:00" } ] } ] } }