{ "Event": { "analysis": "1", "date": "2026-07-16", "extends_uuid": "", "info": "[Threat Intel] TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains", "protected": false, "publish_timestamp": "1784560912", "published": true, "threat_level_id": "3", "timestamp": "1784560912", "uuid": "733ba688-16bf-4266-82c1-78ab4e77b846", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#5f1b93", "local": false, "name": "misp-galaxy:producer=\"Elastic\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#9dfeaa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1548\"", "relationship_type": "" }, { "colour": "#fdd85e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Access Token Manipulation - T1134\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"", "relationship_type": "" }, { "colour": "#62e1b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#9c8729", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Debugger Evasion - T1622\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#d4fd6f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"", "relationship_type": "" }, { "colour": "#b24806", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal - T1070\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#2e58ce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Shared Modules - T1129\"", "relationship_type": "" }, { "colour": "#50bcaa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Discovery - T1518\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#16ca73", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Location Discovery - T1614\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#fda248", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Services - T1569\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#9e0269", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Vidar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784199612", "to_ids": false, "type": "link", "uuid": "2638aaaa-8c0f-4701-bfc5-1ff50138ab13", "value": "https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784199612", "to_ids": false, "type": "text", "uuid": "dcb3d300-1f64-457a-aa49-9517a5f95361", "value": "TELEPUZ is a newly emerged modular malware-as-a-service first detected in April 2026, spreading through CLICKFIX-VIDAR infection chains. The lightweight, full-featured threat employs sophisticated evasion techniques including indirect syscalls, NTDLL unhooking, and anti-VM checks. It establishes persistence through service installation, communicates via WebSockets with C2 servers, and downloads additional modules for keylogging, credential theft, and web injection. The infection begins with social engineering tricks prompting victims to execute PowerShell commands, deploying VIDAR as a second stage which then delivers TELEPUZ components. Despite limited C2 infrastructure, high daily build volumes indicate active development and expanding operations by likely a small team or solo developer offering malware-as-a-service." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784199612", "to_ids": false, "type": "text", "uuid": "0e0895d0-ef72-446a-893e-f01313fe87cb", "value": "Name: TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains\nAuthor: AlienVault\nAdversary: \nTags: [\"clickfix\", \"vidar\", \"telepuz\", \"maas\"]\nTgtd countries: []\nMlwr families: [\"TELEPUZ\", \"VIDAR\"]\nAttack_ids: []\nIndustries: []" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557308", "to_ids": true, "type": "sha256", "uuid": "212645b9-cf2d-49c5-9f1e-54478af54260", "value": "444f1c0c82b3f6cc31d685bac68b20edbde5722ce219af9cceab0c2a6537efc1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557309", "to_ids": true, "type": "sha256", "uuid": "f74cb3a8-92a6-4ee7-97c1-043c4f737e56", "value": "9733a3f6409de81271f21993c7f8b9865ac9f5c68c3d4336e91afe6b312477eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557311", "to_ids": true, "type": "sha256", "uuid": "5eda3518-a9c5-43dd-94d9-2ce1c02dffed", "value": "a955d7e2819d5fa8b5f879cb970e1a1a91327098a7383f2a03a5e1e7e19435e3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 20/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784557311", "to_ids": true, "type": "sha256", "uuid": "41a62e65-7852-46d8-b4b2-defbe61669e8", "value": "cee96a38e2dfe31ccf8c3aa7d0d9323e1e3183b2478ba582285822e943d242e9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558664", "to_ids": true, "type": "url", "uuid": "6fe51f0f-0ff3-4bba-b31b-1c8f22f6cde9", "value": "https://memshowblob.forum/api/index.php?a=grab", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558685", "to_ids": true, "type": "domain", "uuid": "d36e6dac-0443-4393-bc45-4bf2073f60fb", "value": "hurgadatour.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558706", "to_ids": true, "type": "hostname", "uuid": "0a759271-caaf-45f6-afeb-92058a98d339", "value": "cal.joycedoula.com.br", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558727", "to_ids": true, "type": "hostname", "uuid": "2a81b20f-6b3f-45d4-b649-1aa2227821f8", "value": "cal.snehamumbai.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558748", "to_ids": true, "type": "domain", "uuid": "281f11ef-1c72-4cf4-8a1a-6129d5cc3dcd", "value": "chubrik.sbs", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558769", "to_ids": true, "type": "url", "uuid": "96f701a7-9606-499e-bbcc-46806cb13242", "value": "https://chubrik.sbs/files/xK7mR9pL2nQw5tY8/ygvfuyze.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558790", "to_ids": true, "type": "domain", "uuid": "35ff288c-f9fc-4fc5-aa4f-0c8f25171788", "value": "betalegenda.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558811", "to_ids": true, "type": "url", "uuid": "dfeccb2a-680b-4542-a8c3-b6cf3bc29b8b", "value": "https://betalegenda.cfd/files/xK7mR9pL2nQw5tY8/kmwvogwx.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558832", "to_ids": true, "type": "domain", "uuid": "25d55720-aab0-4cde-a895-cec578ca8529", "value": "mavpaprokla.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558853", "to_ids": true, "type": "url", "uuid": "41d7bd41-1069-4cff-b51e-55a432f8512b", "value": "https://mavpaprokla.lat/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558874", "to_ids": true, "type": "domain", "uuid": "a62f2cbf-111e-4965-9145-2568ae9208a6", "value": "comicstar.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558895", "to_ids": true, "type": "url", "uuid": "bd0bde3c-f3c3-44fd-92d0-62e03f6e8b3b", "value": "https://comicstar.lat/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558916", "to_ids": true, "type": "domain", "uuid": "60dfecc3-c6d0-468e-b914-b0326fc553a8", "value": "bigblower.click", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558938", "to_ids": true, "type": "url", "uuid": "d38f62e0-d57c-4bda-b3ec-19bc0fc63e2b", "value": "https://bigblower.click/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558959", "to_ids": true, "type": "domain", "uuid": "c0eceff8-4393-408d-b22f-6412ada14580", "value": "momasites.lol", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784558980", "to_ids": true, "type": "url", "uuid": "26a21a4d-87f7-40a4-a055-0719595a5670", "value": "https://momasites.lol/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559002", "to_ids": true, "type": "domain", "uuid": "8dab196f-32d4-43cc-84cf-876b6c6f6cbd", "value": "momasites.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559023", "to_ids": true, "type": "url", "uuid": "1f740a19-0813-4f42-9f0b-1e448b13ad64", "value": "https://momasites.com/files/telemetrywork/telepuz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559044", "to_ids": true, "type": "domain", "uuid": "bd6ca81b-d132-48c2-a27b-6d4c62a68e2f", "value": "mamsites.lol", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559065", "to_ids": true, "type": "url", "uuid": "2ac3011d-6964-4cc5-bd0a-421547b51f67", "value": "https://mamsites.lol/files/telemetrywork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559086", "to_ids": true, "type": "domain", "uuid": "75e46eca-8d1b-4889-8971-5fffbd989856", "value": "hardenedom.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559107", "to_ids": true, "type": "url", "uuid": "651a757c-31ab-4748-9bc3-4a8db2366549", "value": "https://hardenedom.shop/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559128", "to_ids": true, "type": "domain", "uuid": "4d7b2044-6346-4d3f-9f66-8994eb4ab827", "value": "hardendedom.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559149", "to_ids": true, "type": "url", "uuid": "e10c0d28-3ed2-4b86-90b1-6f83ea0d59fa", "value": "https://hardendedom.shop/files/lemetriawork/epuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559171", "to_ids": true, "type": "domain", "uuid": "6dd25197-3d45-457c-97a2-7f6515f82c14", "value": "hardendom.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559193", "to_ids": true, "type": "url", "uuid": "df8f25be-cc61-42eb-8f83-27be8a2606fb", "value": "https://hardendom.shop/files/telemetry/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559214", "to_ids": true, "type": "domain", "uuid": "9c211a15-0bed-41cf-a419-d6b1928914bb", "value": "hardeneddom.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559235", "to_ids": true, "type": "url", "uuid": "eb3b4df1-5f7b-4068-b23c-db0f67a3e9ae", "value": "https://hardeneddom.shop/files/telemetrywork/telepuz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559256", "to_ids": true, "type": "domain", "uuid": "07bc3fcf-e1f2-4167-b736-0745df8a1fb2", "value": "netblokirovka.asia", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559277", "to_ids": true, "type": "url", "uuid": "92a9f6fc-d9f4-4daf-b1d3-796c244143b8", "value": "https://netblokirovka.asia/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559298", "to_ids": true, "type": "domain", "uuid": "687497d9-f03f-4d83-bb78-2d3bb1e6bd22", "value": "netblokir.asia", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559319", "to_ids": true, "type": "url", "uuid": "958380cd-d2eb-4176-9a24-695fd29ffdcd", "value": "https://netblokir.asia/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559340", "to_ids": true, "type": "domain", "uuid": "516dcdba-b13c-413d-95ed-df86b54a09b6", "value": "netlobikrovka.asia", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559361", "to_ids": true, "type": "url", "uuid": "74b53fb2-8f6e-4fcf-93b0-bcc81ad53d51", "value": "https://netlobikrovka.asia/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559382", "to_ids": true, "type": "domain", "uuid": "88f84c6d-a6e5-45ac-ba46-a115678c5059", "value": "neblokirovka.as", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559405", "to_ids": true, "type": "url", "uuid": "7820db31-453b-40d1-9d0d-8ac955bd8d59", "value": "https://neblokirovka.as/telemetry/network/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559426", "to_ids": true, "type": "domain", "uuid": "ee8ab8f4-8d2c-4ec0-b159-8ea45b11abfd", "value": "kidsko.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559447", "to_ids": true, "type": "url", "uuid": "dfcd60d7-584d-4bb5-b519-125f5f139136", "value": "https://kidsko.shop/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559468", "to_ids": true, "type": "domain", "uuid": "e9587a60-b36a-43c5-bd13-32703d8dea5b", "value": "mazaporka.shop", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559489", "to_ids": true, "type": "url", "uuid": "3734cae2-2ea1-4be4-a80e-85b546064089", "value": "https://mazaporka.shop/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559512", "to_ids": true, "type": "ip-dst", "uuid": "220ed779-4f4b-402e-9974-7eeefee7fcce", "value": "172.67.215.214", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559533", "to_ids": true, "type": "url", "uuid": "fb1d611d-2544-4608-8d55-2b48a2a64758", "value": "https://172.67.215.214/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559554", "to_ids": true, "type": "url", "uuid": "99c0f789-0d18-4e23-b292-ca2fee386f1d", "value": "https://hurgadatour.shop/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559575", "to_ids": true, "type": "domain", "uuid": "31646d57-2943-4fad-aed1-fd071685ea17", "value": "krabsburger.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559596", "to_ids": true, "type": "url", "uuid": "cbfa5772-f3d3-48d1-8629-0b3059ad82ec", "value": "http://krabsburger.xyz/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559617", "to_ids": true, "type": "domain", "uuid": "d318c176-e686-4851-be01-c5dc6dc39703", "value": "zewaplus.club", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559639", "to_ids": true, "type": "url", "uuid": "fc01157f-0e8b-4403-927e-c6c04eee3c90", "value": "https://zewaplus.club/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559660", "to_ids": true, "type": "ip-dst", "uuid": "c718ad1c-f33f-4805-93de-0cd2c31139fc", "value": "172.67.165.144", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784559681", "to_ids": true, "type": "url", "uuid": "dd6a73be-13ff-472e-866f-e870b644950c", "value": "https://172.67.165.144/files/telemetriawork/telepuz.dll", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784559703", "uuid": "9b2e2b1b-561b-4521-8144-2352b3086d3c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "md5", "timestamp": "1784559703", "to_ids": true, "type": "md5", "uuid": "96aae4fd-8c84-4a38-8d96-42524a730ff8", "value": "2e95dbcdf10cccbad8d815a8c7969cf9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "sha1", "timestamp": "1784557303", "to_ids": true, "type": "sha1", "uuid": "93b94a64-6f3d-4cc6-974b-464129138d57", "value": "f09ab9c9253cb9987c243b6405b8fae19bd3128d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "sha256", "timestamp": "1784557303", "to_ids": true, "type": "sha256", "uuid": "bd0dc13b-8ca5-488d-86c8-e1a0f471ce8e", "value": "03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "text", "timestamp": "1784554401", "to_ids": false, "type": "text", "uuid": "91d33717-d762-44d8-9b38-6e25ddac3afd", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Mikey.SN!MTB\nClamAV: None\nVT Total Detection: 44/74\nFirst Seen In The Wild: 2026-07-03T07:04:21+00:00\nFirst Submission: 2026-07-03T05:35:36+00:00\nLast Submission: 2026-07-03T05:35:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "creation-time", "timestamp": "1784554401", "to_ids": false, "type": "datetime", "uuid": "7c6f726f-2442-4b6a-b085-a2baea2424f3", "value": "2026-07-03T05:25:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "ssdeep", "timestamp": "1784554401", "to_ids": true, "type": "ssdeep", "uuid": "c87812f5-3457-47c3-ba06-5d89befac1b0", "value": "384:OT9mUw1U9unGwrMHDGak5Jk5pHV/aY1bcjtJsrOiHtVLZWNOlOK:OMU9uGwrMHDGak5Jk5pHNDZYYOK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554401", "to_ids": false, "type": "size-in-bytes", "uuid": "edfd851c-6199-4265-a271-e6cfcdb9b6a9", "value": "17920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "vhash", "timestamp": "1784554401", "to_ids": true, "type": "vhash", "uuid": "5bf55750-1cc5-483c-81bc-a1ecf6a8c9dc", "value": "014046555d151bz81z1lz1dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-03T05:35:36+00:00", "last_seen": "2026-07-03T05:35:36+00:00", "object_relation": "filename", "timestamp": "1784554401", "to_ids": true, "type": "filename", "uuid": "b00ff602-aeed-4465-9bb1-a2a01d8eb9eb", "value": "423555135" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784559724", "uuid": "b582182a-58c1-488e-9fab-685ae42fd8b0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "object_relation": "md5", "timestamp": "1784559724", "to_ids": true, "type": "md5", "uuid": "52abd238-30c0-4a40-a0cb-7490f908b4db", "value": "0ae6dd01529c5f2430f5aa5cc5252fbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "object_relation": "sha1", "timestamp": "1784557304", "to_ids": true, "type": "sha1", "uuid": "e12a5ad0-69e8-449f-9b38-17859e61a657", "value": "a493baebd6e8d238ea1bc50a9bee3bf5dfd7950d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "object_relation": "sha256", "timestamp": "1784557304", "to_ids": true, "type": "sha256", "uuid": "4d748823-f3df-4137-816f-523f15585f2e", "value": "580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "object_relation": "text", "timestamp": "1784554444", "to_ids": false, "type": "text", "uuid": "6262084b-e5fe-4121-a743-3d6a5d6d429e", "value": "Type Description: Win32 EXE\nVerified: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.\nSigners: www.rebelsport.co\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2026-06-26T12:26:44+00:00\nLast Submission: 2026-06-26T18:27:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "object_relation": "ssdeep", "timestamp": "1784554444", "to_ids": true, "type": "ssdeep", "uuid": "780cf851-f8b7-4b6c-88e1-53f3166028e5", "value": "49152:b2zRnRckYAruj/LULswJO+dlzNId7jHnA2bqCsT+qgv2/YXzV4fXeT:bMFhO+VSjsT+N2/B6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554444", "to_ids": false, "type": "size-in-bytes", "uuid": "594355c5-bd55-43c8-92e6-357e1ee3def2", "value": "3532664" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "object_relation": "vhash", "timestamp": "1784554444", "to_ids": true, "type": "vhash", "uuid": "383213ad-3671-4c45-ab2f-329c77514716", "value": "036086657d15551d15545az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-26T12:26:44+00:00", "last_seen": "2026-06-26T18:27:52+00:00", "object_relation": "filename", "timestamp": "1784554444", "to_ids": true, "type": "filename", "uuid": "6151b007-c6c6-47e6-9599-71e5f9560d7d", "value": "c50621d5.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784559745", "uuid": "cc5aea26-88c0-4dcc-bdb3-438962574a1c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "md5", "timestamp": "1784559745", "to_ids": true, "type": "md5", "uuid": "7111974e-7ff3-4b76-be4e-c2535fafd4bc", "value": "aac17079a9e225c44a8c65ebf7a95801", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "sha1", "timestamp": "1784557305", "to_ids": true, "type": "sha1", "uuid": "628dd336-7979-46fb-96f7-5a2ccdb3d335", "value": "cec1e47faea50ae7d519a75b3458bf7ca374c00f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "sha256", "timestamp": "1784557305", "to_ids": true, "type": "sha256", "uuid": "8cb04b30-3eb6-4234-ad36-811bc8622248", "value": "58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "text", "timestamp": "1784554465", "to_ids": false, "type": "text", "uuid": "5c0bd513-607a-4b2e-bca3-0ec35becc2d5", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 45/74\nFirst Submission: 2026-06-25T10:57:11+00:00\nLast Submission: 2026-06-25T10:57:11+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "creation-time", "timestamp": "1784554465", "to_ids": false, "type": "datetime", "uuid": "3d7bb06d-08d1-4a5e-b5cb-9f0cdb2b89db", "value": "2026-05-14T14:06:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "ssdeep", "timestamp": "1784554465", "to_ids": true, "type": "ssdeep", "uuid": "bffdeff7-ffc2-41f7-9c92-fa992379355c", "value": "6144:UnXKzL4nIY8VoBtjAyRsomXxXPHmzt6TdW7Fi++WkVh5miWU:UnC4nIlVoBt1RmXlPHmJuQieoXmjU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554465", "to_ids": false, "type": "size-in-bytes", "uuid": "2024d7bd-b54b-43ea-a135-14c93aa579ad", "value": "409088" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "vhash", "timestamp": "1784554465", "to_ids": true, "type": "vhash", "uuid": "659f34d6-5133-4202-9dda-744e55a055fd", "value": "1450566d7555151093z10100221z1011z1013z801011z25z26z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T10:57:11+00:00", "last_seen": "2026-06-25T10:57:11+00:00", "object_relation": "filename", "timestamp": "1784554465", "to_ids": true, "type": "filename", "uuid": "126d6553-4627-4c2a-8c15-ed5f3389f836", "value": "rwopnj9k9.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784559768", "uuid": "899d7b4e-8fe0-4273-ac69-43f1ccff586e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "md5", "timestamp": "1784559768", "to_ids": true, "type": "md5", "uuid": "a3218c79-6a46-4266-932c-ac97af20ffcf", "value": "1e8e64031ff1355ee5dd30cba19dcc95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "sha1", "timestamp": "1784557306", "to_ids": true, "type": "sha1", "uuid": "65d962f1-62ff-45b5-baa5-5ef67418da14", "value": "f037faa48668686a83366ee7e4ac7d0b3a92a25c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "sha256", "timestamp": "1784557306", "to_ids": true, "type": "sha256", "uuid": "effc5c00-351d-4440-846a-9eb8ab43112f", "value": "bf3b4e645a3c0c23f87c55971069014f7424ad14497371ee7567eff68ffaf343", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "text", "timestamp": "1784554528", "to_ids": false, "type": "text", "uuid": "12c778ae-ac17-4429-8aea-060de41902cf", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 45/74\nFirst Submission: 2026-06-29T16:48:09+00:00\nLast Submission: 2026-06-29T16:48:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "creation-time", "timestamp": "1784554529", "to_ids": false, "type": "datetime", "uuid": "08e3a862-903d-463a-802a-8d4d415a10fb", "value": "2026-05-22T05:23:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "ssdeep", "timestamp": "1784554528", "to_ids": true, "type": "ssdeep", "uuid": "06f1c0ac-d713-4148-9462-5259d208d773", "value": "6144:sxpjkUEu7nwhPFOrW2kDoWYx24NsAy3rb5N4uMyfH4pZQJZL2NAr9oyUM:s3Kkwh92GYxc3Pv4rZQJp2NAh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554528", "to_ids": false, "type": "size-in-bytes", "uuid": "9d39c194-bbaa-4212-aade-a0c5c9fa95d5", "value": "424448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "vhash", "timestamp": "1784554528", "to_ids": true, "type": "vhash", "uuid": "a3fbf158-3121-4d42-9c07-ea24acd74b99", "value": "1450566d7555151073z10100263z11z1013z801011z21z11z26z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T16:48:09+00:00", "last_seen": "2026-06-29T16:48:09+00:00", "object_relation": "filename", "timestamp": "1784554528", "to_ids": true, "type": "filename", "uuid": "155d81a6-db47-43b5-9c35-320664592f2f", "value": "z5s63j.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784559789", "uuid": "dfb8a8d0-3f7c-446d-a742-579db79e9fcc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "md5", "timestamp": "1784559789", "to_ids": true, "type": "md5", "uuid": "80a657ab-ed4a-4aa1-9af1-d21ce5856aab", "value": "b0b862cc78b96ea053138c3cf0b558ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "sha1", "timestamp": "1784557307", "to_ids": true, "type": "sha1", "uuid": "3ba1154a-528d-4bea-8361-7d2521061360", "value": "1d90b6e517beefb4a33a8495b47c158433f4682e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "sha256", "timestamp": "1784557308", "to_ids": true, "type": "sha256", "uuid": "7963ac83-eda1-4357-9e11-3b8c32408682", "value": "ff791fe1532a2dc3b3c188a71bfd0177f973ef228e4d1dda1db6d3c4b0d62b3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 20/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "text", "timestamp": "1784554571", "to_ids": false, "type": "text", "uuid": "682e727c-ba86-46e7-9084-786b92b02cb1", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 46/74\nFirst Submission: 2026-07-03T12:57:39+00:00\nLast Submission: 2026-07-03T12:57:39+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "creation-time", "timestamp": "1784554571", "to_ids": false, "type": "datetime", "uuid": "72136004-98eb-499a-9174-60c041c04c6c", "value": "2026-06-28T19:00:41+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "ssdeep", "timestamp": "1784554571", "to_ids": true, "type": "ssdeep", "uuid": "dd31d9a2-999c-4343-a193-935d8cc10fba", "value": "6144:NvKYqadvDNqkqaLD/ciKqlTaBx16VDBjurecpu2HDEqwbx4KEZML:NSucoYADUbhDNK9EZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1784554571", "to_ids": false, "type": "size-in-bytes", "uuid": "93ecd660-14b0-4d20-aa7d-93b7e1f6d3fe", "value": "455168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "vhash", "timestamp": "1784554571", "to_ids": true, "type": "vhash", "uuid": "9a187b12-5159-4aab-b631-4ac28cddd188", "value": "1450566d7555151093z101002a3z11z101011z801011z25z26z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-03T12:57:39+00:00", "last_seen": "2026-07-03T12:57:39+00:00", "object_relation": "filename", "timestamp": "1784554571", "to_ids": true, "type": "filename", "uuid": "338a41e7-68e4-4ce6-b00c-3cb44c3f9930", "value": "tkvarc.dll" } ] } ] } }