{ "Event": { "analysis": "1", "date": "2026-07-01", "extends_uuid": "", "info": "[Threat Intel] Iran-Nexus Disseminates MarkiRAT Surveillance Tool", "protected": false, "publish_timestamp": "1783858424", "published": true, "threat_level_id": "2", "timestamp": "1783858424", "uuid": "739ed8dd-2b27-49a2-b810-15d1e7c9cfcb", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#bf83fd", "local": false, "name": "misp-galaxy:producer=\"Recorded Future\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#82eae0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"", "relationship_type": "" }, { "colour": "#0affe9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"BITS Jobs - T1197\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#20a667", "local": false, "name": "misp-galaxy:target-information=\"Iran\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iran\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"MarkiRAT\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#1c006d", "local": false, "name": "rectifyq:topic=\"geopolitical\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#3500ca", "local": false, "name": "rectifyq:detection-rules=\"yara-from-src\"", "relationship_type": "" }, { "colour": "#3500cd", "local": false, "name": "rectifyq:detection-rules=\"sigma-from-src\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782990024", "to_ids": false, "type": "link", "uuid": "e3d31786-d95c-4001-9ac8-b299ca7997e9", "value": "https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782990024", "to_ids": false, "type": "link", "uuid": "fda0ddbb-b8df-4371-9768-199c939be3a3", "value": "https://www.recordedfuture.com/research/media_11d60acbcd8901a8e5c5002f7f21ae6e799acee43.gif?width=1200&format=pjpg&optimize=medium" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782990024", "to_ids": false, "type": "text", "uuid": "6c647c6c-43a9-431e-96bf-1dec6fdf898e", "value": "TAG-182, an Iran-nexus threat cluster, is conducting surveillance operations targeting Iranian citizens both domestically and abroad using MarkiRAT malware. The group distributes fake Android applications masquerading as VPN services and media players through social media platforms, particularly Instagram. Following Iran's partial internet restoration in May 2026 after an 88-day shutdown, these surveillance activities have intensified as Iranian security apparatus seeks to monitor perceived dissidents and anti-government activists. MarkiRAT samples demonstrate tradecraft overlaps with previously documented Ferocious Kitten operations, including use of Background Intelligent Transfer Service (BITS). The group operates infrastructure across multiple autonomous systems, utilizing domains with naming conventions mimicking legitimate services like Microsoft, Google, and Facebook." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782990024", "to_ids": false, "type": "text", "uuid": "3ca61c8b-a839-4180-82e1-8080672476cc", "value": "Name: Iran-Nexus Disseminates MarkiRAT Surveillance Tool\nAuthor: AlienVault\nAdversary: TAG-182\nTags: [\"ferocious kitten\", \"irgc\", \"furball\", \"surveillance\", \"iran\", \"fake vpn\", \"bouldspy\", \"markirat\", \"tag-182\", \"dchspy\", \"farsi-speaking targets\"]\nTgtd countries: [\"Iran, Islamic Republic of\"]\nMlwr families: [\"MarkiRAT - S0652\", \"FurBall\", \"DCHSpy\", \"BouldSpy\"]\nAttack_ids: [\"T1113\", \"T1204.002\", \"T1566.002\", \"T1566.001\", \"T1583.001\", \"T1036\", \"T1112\", \"T1041\", \"T1547.001\", \"T1027\", \"T1197\", \"T1059.003\", \"T1071.001\", \"T1105\", \"T1564.001\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783845726", "to_ids": false, "type": "threat-actor", "uuid": "c9f7dc40-168d-4c33-bca6-95ad75f068a1", "value": "TAG-182", "Tag": [ { "colour": "#bf83fd", "local": false, "name": "misp-galaxy:producer=\"Recorded Future\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851090", "to_ids": true, "type": "ip-dst", "uuid": "fa33bf0f-1074-42cd-a182-f76dfdaa5e9d", "value": "46.30.191.123", "Tag": [ { "colour": "#8e8779", "local": false, "name": "asn:asn=\"199959\"", "relationship_type": "" }, { "colour": "#d781fd", "local": false, "name": "asn:as-owner=\"CROWNCLOUD\"", "relationship_type": "" }, { "colour": "#7f61db", "local": false, "name": "asn:as-country=\"AU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"australia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851111", "to_ids": true, "type": "domain", "uuid": "7f06d01f-77f2-4f2e-be93-957d163f84d1", "value": "yemplayer.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851133", "to_ids": true, "type": "hostname", "uuid": "b5a49cf1-0b55-4c6c-bc7d-c4d9e4089d9c", "value": "min.comi-site.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851154", "to_ids": true, "type": "hostname", "uuid": "37b74562-2b84-4584-9ca9-a5def9cf1140", "value": "microsoft.comi-site.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851175", "to_ids": true, "type": "domain", "uuid": "c489d183-2164-4959-b3ce-f37a99cdb804", "value": "comesignt.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851196", "to_ids": true, "type": "hostname", "uuid": "dc5b3c35-2ecf-44b0-9fe8-f956b595f312", "value": "min.come-site.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851217", "to_ids": true, "type": "hostname", "uuid": "5d23f02d-b4d3-492e-8030-d50d95ea092c", "value": "google.comisignin.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851240", "to_ids": true, "type": "hostname", "uuid": "4279a2a3-5581-4a4d-aeec-0a72e238a466", "value": "accountes.google.comesignt.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851261", "to_ids": true, "type": "hostname", "uuid": "8194f654-dac6-42c6-a33c-aa59ae14e66b", "value": "accounts.google.comisignin.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851282", "to_ids": true, "type": "hostname", "uuid": "cd671654-4081-4189-94d4-13335d78fab0", "value": "microsoft.come-site.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851303", "to_ids": true, "type": "domain", "uuid": "8fba0fbf-5dd2-42d8-b400-a684f244962a", "value": "comi-site.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851324", "to_ids": true, "type": "ip-dst", "uuid": "603ac604-4dda-4e92-8036-c62bcb705a77", "value": "89.144.145.237", "Tag": [ { "colour": "#1337b5", "local": false, "name": "asn:asn=\"39308\"", "relationship_type": "" }, { "colour": "#e341b1", "local": false, "name": "asn:as-owner=\"ASK-AS\"", "relationship_type": "" }, { "colour": "#4b96f6", "local": false, "name": "asn:as-country=\"IR\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iran\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851345", "to_ids": true, "type": "domain", "uuid": "2b94c1ba-0c60-4134-b4f4-2364bcb3ade0", "value": "com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851366", "to_ids": true, "type": "domain", "uuid": "60cb0f7f-3924-4390-801d-cd42f46f555d", "value": "come-signin.quest", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851387", "to_ids": true, "type": "domain", "uuid": "8fed04b6-488f-4e9c-bdba-950d727ad0ed", "value": "comisignin.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851408", "to_ids": true, "type": "domain", "uuid": "b3da0a8c-eb5f-4f40-a38d-ba0710179762", "value": "pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851430", "to_ids": true, "type": "hostname", "uuid": "7596a3a0-f225-4e79-93c1-438c72949ffb", "value": "admin.google.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851451", "to_ids": true, "type": "hostname", "uuid": "39ad0ad7-b219-4213-a632-e0b56670c151", "value": "admin.instagram.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851472", "to_ids": true, "type": "hostname", "uuid": "c08e5d88-6a2a-4d1a-a5b3-2c0668172534", "value": "c.pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851493", "to_ids": true, "type": "hostname", "uuid": "1807650a-8cb4-410a-9404-d3d873432f57", "value": "google.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851514", "to_ids": true, "type": "hostname", "uuid": "d99899f7-5806-4e08-9a5a-a261a33d21a4", "value": "google.com-signin.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851535", "to_ids": true, "type": "hostname", "uuid": "753197e8-de53-4513-b1cf-69cc13442756", "value": "host.comview.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851556", "to_ids": true, "type": "hostname", "uuid": "50464cfe-6779-466d-8568-b860922d85dc", "value": "microsoft.comesite.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851578", "to_ids": true, "type": "hostname", "uuid": "4ee03ffc-a375-4aba-a298-fb8e95df41a3", "value": "microsoft.comview.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851599", "to_ids": true, "type": "hostname", "uuid": "d8304061-69e6-4c7a-9b6b-58da1600da39", "value": "microsoft.pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851620", "to_ids": true, "type": "hostname", "uuid": "358a01d8-ccf0-42cb-ab05-6b508951ae9c", "value": "min.comview.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851641", "to_ids": true, "type": "hostname", "uuid": "e3337401-5a00-4fd6-a1ea-0cdf45d4d6c6", "value": "min.pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851662", "to_ids": true, "type": "hostname", "uuid": "86c431ae-07f6-492b-ac82-aa29d5a594de", "value": "ns1.com-signin.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851683", "to_ids": true, "type": "hostname", "uuid": "201ad35d-0a18-436c-97af-ff0814d90c9f", "value": "ns2.com-signin.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851704", "to_ids": true, "type": "hostname", "uuid": "5e79fb2a-284b-4319-9cb2-3204c28aa12d", "value": "prx.pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851726", "to_ids": true, "type": "hostname", "uuid": "22478874-3717-444b-ac58-c4ee2575254e", "value": "svpn.pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851747", "to_ids": true, "type": "hostname", "uuid": "d04875f8-a941-4276-ba30-baded797f75f", "value": "vpn.pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851768", "to_ids": true, "type": "hostname", "uuid": "c9b745b0-a3db-4e42-ad91-000ed588282b", "value": "webmail.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851789", "to_ids": true, "type": "hostname", "uuid": "bb83b847-9d40-420d-a703-4bc5e667de04", "value": "webmail.facebook.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851810", "to_ids": true, "type": "hostname", "uuid": "3c2d33f7-6833-402d-a70d-85dddae54b64", "value": "webmail.google.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851831", "to_ids": true, "type": "hostname", "uuid": "50a01581-f04b-49d1-af1b-ce94111a0e9b", "value": "webmail.instagram.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851853", "to_ids": true, "type": "hostname", "uuid": "85001424-f157-47a4-b877-f93ca65f94f8", "value": "www.facebook.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851874", "to_ids": true, "type": "hostname", "uuid": "7c4b4829-327a-429b-95ac-1af9a2d9dee7", "value": "www.google.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851895", "to_ids": true, "type": "hostname", "uuid": "7fec2825-3849-49fd-a528-3d55480937cc", "value": "www.instagram.com-accounts.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851916", "to_ids": true, "type": "hostname", "uuid": "6a4af401-f254-4d62-af14-ce3fb4cd7692", "value": "www.pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851937", "to_ids": true, "type": "hostname", "uuid": "9009fe56-d6b0-487a-9ac4-fcf616fb88ad", "value": "www.yemplayer.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 12/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783846986", "to_ids": true, "type": "sha256", "uuid": "cedd22bc-4774-498a-88fc-01c73b8dbf2f", "value": "f7bde19f9e085650378076dabac586dcdc256e743a57890000e71a7ebb43d8ee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851958", "to_ids": true, "type": "ip-dst", "uuid": "6aecb18c-f7a6-4124-9726-0e4c07130698", "value": "45.86.162.197", "Tag": [ { "colour": "#8e8779", "local": false, "name": "asn:asn=\"199959\"", "relationship_type": "" }, { "colour": "#d781fd", "local": false, "name": "asn:as-owner=\"CROWNCLOUD\"", "relationship_type": "" }, { "colour": "#7f61db", "local": false, "name": "asn:as-country=\"AU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"australia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783851979", "to_ids": true, "type": "ip-dst", "uuid": "9e7015bb-b577-4164-b0e8-bc1f2a61cc03", "value": "46.30.191.105", "Tag": [ { "colour": "#8e8779", "local": false, "name": "asn:asn=\"199959\"", "relationship_type": "" }, { "colour": "#d781fd", "local": false, "name": "asn:as-owner=\"CROWNCLOUD\"", "relationship_type": "" }, { "colour": "#7f61db", "local": false, "name": "asn:as-country=\"AU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"australia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852000", "to_ids": true, "type": "ip-dst", "uuid": "d8a03cda-2623-442b-b9ba-b2d545e75d02", "value": "89.144.145.239", "Tag": [ { "colour": "#1337b5", "local": false, "name": "asn:asn=\"39308\"", "relationship_type": "" }, { "colour": "#e341b1", "local": false, "name": "asn:as-owner=\"ASK-AS\"", "relationship_type": "" }, { "colour": "#4b96f6", "local": false, "name": "asn:as-country=\"IR\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iran\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852022", "to_ids": true, "type": "url", "uuid": "3f1d6f11-8672-4948-ae9d-a4dad78d5651", "value": "https://vip.yeplayer.store/files/YEPlayer.rar", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 12/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783846987", "to_ids": true, "type": "sha1", "uuid": "102b2de2-9420-4015-bdde-e1d2d85d8162", "value": "4186e41a8d6ae3b316174fc601e418b8e2a664b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852043", "to_ids": true, "type": "domain", "uuid": "0cb59284-47d5-4ca3-b84e-a9fb158ef480", "value": "comestore.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852064", "to_ids": true, "type": "domain", "uuid": "a8aa8774-b899-43ae-ae98-53f4852ed876", "value": "comx-view.store", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852085", "to_ids": true, "type": "domain", "uuid": "b6004833-c6de-4886-b902-fe228fc861e9", "value": "migavpn.store", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852106", "to_ids": true, "type": "domain", "uuid": "aac02d67-e216-4e0c-92fc-3cfe1b79e48d", "value": "orbitx.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852127", "to_ids": true, "type": "domain", "uuid": "fa68997f-8e6b-4ee1-98dc-8698ad1f8015", "value": "sahar2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852148", "to_ids": true, "type": "domain", "uuid": "1d6cb6e8-7ac6-406a-b923-d5284b8eca4f", "value": "yeplayer.store", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852170", "to_ids": true, "type": "hostname", "uuid": "63dbe5ad-e6b6-4eab-b931-a01a7dd3b02a", "value": "download.yeplayer.store", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852191", "to_ids": true, "type": "hostname", "uuid": "fa6f0dcb-4dca-4e05-8eb7-1362cbb076b2", "value": "microsotf.come-site.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852212", "to_ids": true, "type": "hostname", "uuid": "86bc0625-7f90-4795-a861-0a06cd32a83f", "value": "microsotf.comi-site.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852234", "to_ids": true, "type": "hostname", "uuid": "70cc1a62-9e78-47b4-9eb5-710875923c99", "value": "miga.comesignt.website", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852255", "to_ids": true, "type": "hostname", "uuid": "3a4ef154-cfd6-46f3-b10f-74bce46ca1bd", "value": "starvpn.pis2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852276", "to_ids": true, "type": "hostname", "uuid": "a949788a-66b0-4df2-84a9-099d4a286d0e", "value": "tools.sahar2ray.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852297", "to_ids": true, "type": "hostname", "uuid": "385a3a44-5c46-4d37-96da-7ab52985fbc9", "value": "vip.yeplayer.store", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852318", "to_ids": true, "type": "hostname", "uuid": "6569d0b3-529c-4db2-8fc8-4eb055cf44ea", "value": "www.yeplayer.store", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783852339", "to_ids": true, "type": "ip-dst", "uuid": "47b7ae71-be53-4e79-a1d9-670c98c9e92c", "value": "212.83.61.198", "Tag": [ { "colour": "#cf2b35", "local": false, "name": "asn:asn=\"47447\"", "relationship_type": "" }, { "colour": "#fc245f", "local": false, "name": "asn:as-owner=\"TTM\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "An object describing a YARA rule (or a YARA rule name), its supported YARA version, and optional test-sample hashes. Test samples are true-positive by default; set false-positive=true when needed.", "meta-category": "misc", "name": "yara", "template_uuid": "b5acf82e-ecca-4868-82fe-9dbdf4d808c3", "template_version": "9", "timestamp": "1783845666", "uuid": "44ddca7c-4483-4b1b-8728-32c4d2ba386e", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara-rule-name", "timestamp": "1783845666", "to_ids": false, "type": "text", "uuid": "d5378643-2581-4871-a8ac-9732437f578a", "value": "APT_IR_TAG182_MarkiRAT_2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1783845666", "to_ids": false, "type": "comment", "uuid": "b42b18bf-1eaf-4772-b437-05275ac8d466", "value": "Track the main backdoor of TAG-182, MarkiRAT" }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "yara", "timestamp": "1783845666", "to_ids": true, "type": "yara", "uuid": "a7497b39-9952-4e4a-ac3e-f99a0d740cbf", "value": "rule APT_IR_TAG182_MarkiRAT_2\r\n{\r\n meta:\r\n author = \"Insikt Group, Recorded Future\"\r\n date = \"2026-04-07\"\r\n description = \"Track the main backdoor of TAG-182, MarkiRAT\"\r\n version = \"1.0\"\r\n reference = \"https://x.com/ClearskySec/status/2016067892589023349\"\r\n hash = \"13440348516ccee839675f6ac908dd1724ce1d28f92af92fdc7938740d2b7ec5\"\r\n hash = \"bb0c7ae4f12e5141480ee26f473636b07e836bb994ff3b2cfec93d4480da171b\"\r\n hash = \"fa246327bed8fc5864827a8147b8b7aedb6246068259b8c97e82adb957315347\"\r\n hash = \"3b172281f65ceaee280ae810edb6fd39a1ecd25649f929f246c0405df94f4c89\"\r\n hash = \"f7bde19f9e085650378076dabac586dcdc256e743a57890000e71a7ebb43d8ee\"\r\n malware = \"MarkiRAT\"\r\n malware_id = \"iRjG1u\"\r\n actor = \"TAG-182\"\r\n actor_id = \"BKMf7Fc\"\r\n category = \"MALWARE\"\r\n strings:\r\n $url1 = \"/i.php?u=\" ascii wide\r\n $url2 = \"/uploadx.php?u=\" ascii wide\r\n $scr1 = \"CaptureAndSendScreenshotAsync\" ascii wide\r\n $scr2 = \"\\\\scr.jpg\" ascii wide\r\n $dir = \"C:\\\\Users\\\\Public\" ascii wide\r\n condition:\r\n uint16(0) == 0x5a4d\r\n and any of ($url*)\r\n and any of ($scr*)\r\n and $dir\r\n}" } ] }, { "comment": "", "deleted": false, "description": "An object describing a Sigma rule (or a Sigma rule name).", "meta-category": "misc", "name": "sigma", "template_uuid": "aa21a3cd-ab2c-442a-9999-a5e6626591ec", "template_version": "2", "timestamp": "1783845696", "uuid": "9cd4fed5-2077-4cc7-b8b9-78c9ef265977", "Attribute": [ { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sigma-rule-name", "timestamp": "1783845696", "to_ids": false, "type": "text", "uuid": "c5b35c9a-99f7-4fdb-9212-ff183470eeb6", "value": "MarkiRAT Malware Bitsadmin File Download" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "comment", "timestamp": "1783845696", "to_ids": false, "type": "comment", "uuid": "c391558d-ef15-478c-8360-551140c89ff4", "value": "Detects the use of bitsadmin to download a file from a remote URL by MarkiRAT malware used by Iran-Nexus TAG-182." }, { "category": "Payload installation", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sigma", "timestamp": "1783845696", "to_ids": true, "type": "sigma", "uuid": "c1d83cbd-0dee-48ed-b38f-159bf33e90fb", "value": "title: MarkiRAT Malware Bitsadmin File Download\r\nid: c7f01654-afdf-4fce-96f8-6c0a405370c2\r\nstatus: stable\r\ndescription: Detects the use of bitsadmin to download a file from a remote URL by MarkiRAT malware used by Iran-Nexus TAG-182.\r\nreferences:\r\n- https://tria.ge/250622-fcp2eaak8t\r\nauthor: Insikt Group, Recorded Future\r\ndate: 2026-05-07\r\ntags:\r\n - attack.t1197 # BITS Jobs\r\n - attack.t1059.003 # Command and Scripting Interpreter: Windows Command Shell\r\nlogsource:\r\n product: windows\r\n category: process_creation\r\ndetection:\r\n bitsadmin_download:\r\n CommandLine|contains|all:\r\n - 'bitsadmin'\r\n - '/addfile'\r\n markirat_urls:\r\n CommandLine|contains:\r\n - '/i.php?u='\r\n - '/uploadx.php?u='\r\n condition: bitsadmin_download and markirat_urls\r\nlevel: high\r\nfalsepositives:\r\n- Unlikely" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852360", "uuid": "a2bc6e51-912a-4ceb-ba78-270108c80839", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "object_relation": "md5", "timestamp": "1783852360", "to_ids": true, "type": "md5", "uuid": "bd0d5a68-ca17-4dc7-ba60-642741be6cf9", "value": "07d1db998e4dacc6777f1c854b3ab605", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "object_relation": "sha1", "timestamp": "1783846971", "to_ids": true, "type": "sha1", "uuid": "277bec6b-656d-4441-ac34-f62555d1c5d6", "value": "42c83fbfb4299202c91b3391ace6e7732f77a602", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "object_relation": "sha256", "timestamp": "1783846971", "to_ids": true, "type": "sha256", "uuid": "ceb172a3-32b8-454d-986e-b36eeb62b8a9", "value": "400eb6a94810323a1fc5f8ab31c682fe765aaec2cc61b37c31d719c7e45c9a6c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 08/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "object_relation": "text", "timestamp": "1783846515", "to_ids": false, "type": "text", "uuid": "32014c74-3536-4e7e-a479-82c216b82bc5", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/73\nFirst Seen In The Wild: 2026-01-27T16:34:32+00:00\nFirst Submission: 2026-01-27T13:25:08+00:00\nLast Submission: 2026-01-27T13:25:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "object_relation": "ssdeep", "timestamp": "1783846515", "to_ids": true, "type": "ssdeep", "uuid": "d53ea8c5-b612-40e4-88bb-4beefb442834", "value": "786432:Fx/zIzBR2oHpAZyEHqk1ii1uPrNBOY7ejqp2qJe5PrPht3Q2wcW1k78rR:D7AxHpAdKknuPZBOY7esFcrJa2wcS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846515", "to_ids": false, "type": "size-in-bytes", "uuid": "39919ad5-ca25-4aaa-a8a3-cb8ced8f2676", "value": "31181522" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "object_relation": "vhash", "timestamp": "1783846515", "to_ids": true, "type": "vhash", "uuid": "3690db99-0d98-40f2-8636-3981ddcac051", "value": "3162fe88886a2f468d964088b505c77e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:25:08+00:00", "last_seen": "2026-01-27T13:25:08+00:00", "object_relation": "filename", "timestamp": "1783846515", "to_ids": true, "type": "filename", "uuid": "b3d6a6f7-f77f-45e8-ac8b-3715374bf1c0", "value": "Pis2rayVPN.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852381", "uuid": "6eec59f2-d6d4-40b4-85a5-b0e88fca2fdc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "md5", "timestamp": "1783852381", "to_ids": true, "type": "md5", "uuid": "9ce885cf-b25d-489c-820e-8b7123e3d6c7", "value": "3c1f7d9d157c38d17a44f62b6560d3b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "sha1", "timestamp": "1783846971", "to_ids": true, "type": "sha1", "uuid": "9b9bc655-6e79-4e52-98e9-d752b2b835e9", "value": "c14dc6f17099a9505a2c303f204a4554a5cc219f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "sha256", "timestamp": "1783846972", "to_ids": true, "type": "sha256", "uuid": "7591e319-3c78-4a03-80e2-5cd86b77c022", "value": "8a7f5c8533df9e51b2da7cc2aeb52d8787418e4915577cc9288be1e46d1945c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "text", "timestamp": "1783846538", "to_ids": false, "type": "text", "uuid": "8528afe6-dfd6-4f7e-8291-6262bd58225b", "value": "Type Description: Win32 DLL\nOriginal name: Service.exe\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 08:09 AM 12/28/2025\nSigners: Nikki Boy Semblante; SSL.com Code Signing Intermediate CA RSA R1; SSL.com Root Certification Authority RSA\nMicrosoft: Trojan:Win64/EternalSunshine.A!dha\nClamAV: None\nVT Total Detection: 37/74\nFirst Seen In The Wild: 2026-01-27T16:34:35+00:00\nFirst Submission: 2026-01-27T13:29:42+00:00\nLast Submission: 2026-02-01T05:27:34+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "creation-time", "timestamp": "1783846538", "to_ids": false, "type": "datetime", "uuid": "001056c0-93f5-48ca-bd1f-371bd937d2c8", "value": "2025-12-28T07:27:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "ssdeep", "timestamp": "1783846538", "to_ids": true, "type": "ssdeep", "uuid": "c0f1d763-515e-4200-8f76-39b80abc36ee", "value": "12288:4DRDtVoQMw5nCvRncww7lmJyCRcZCXCwz9dKLOKmB2tC79qA:4Nfok5CpcBlem8XCC9EL/w2tcqA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846538", "to_ids": false, "type": "size-in-bytes", "uuid": "84ee830b-e9fc-4db3-984b-741b3bf34597", "value": "668504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "vhash", "timestamp": "1783846538", "to_ids": true, "type": "vhash", "uuid": "1e902db9-7910-4973-a6e8-93ca6a773aee", "value": "165076655d155d051550b012z1b00977z5055z1030079ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:29:42+00:00", "last_seen": "2026-02-01T05:27:34+00:00", "object_relation": "filename", "timestamp": "1783846538", "to_ids": true, "type": "filename", "uuid": "337db5c8-332b-425f-ac55-2f7f3fa0b3fc", "value": "Service.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852402", "uuid": "af735457-4be6-477c-a8b6-9bed631a5d43", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "md5", "timestamp": "1783852402", "to_ids": true, "type": "md5", "uuid": "222e3cdc-8d44-4e82-9e3e-675086533a4b", "value": "b56a18df4daf038785891f33c3e89489", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "sha1", "timestamp": "1783846972", "to_ids": true, "type": "sha1", "uuid": "f0e08cd6-faf9-4a1e-96d4-91f8c245311d", "value": "40513398ae248c87f46b13b7f9f303e05d018472", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "sha256", "timestamp": "1783846972", "to_ids": true, "type": "sha256", "uuid": "c5d5a9a3-078b-4682-9344-7513621b86f6", "value": "51a6686b8c5ec7c610637398f3de43589f4e9fcbe8bcc0245343c5454d3b91de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "text", "timestamp": "1783846560", "to_ids": false, "type": "text", "uuid": "091abb73-4ba6-4351-85ff-b76a26d912d1", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 01:47 PM 01/06/2026\nSigners: Nikki Boy Semblante; SSL.com Code Signing Intermediate CA RSA R1; SSL.com Root Certification Authority RSA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/74\nFirst Seen In The Wild: 2026-01-16T21:06:04+00:00\nFirst Submission: 2026-01-08T13:58:09+00:00\nLast Submission: 2026-02-03T09:54:07+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "creation-time", "timestamp": "1783846560", "to_ids": false, "type": "datetime", "uuid": "902d1bcd-734e-4ce7-a8fc-c630d04e4cff", "value": "2026-01-06T13:45:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "ssdeep", "timestamp": "1783846560", "to_ids": true, "type": "ssdeep", "uuid": "ba802fd1-b787-47a2-ae6d-c4d511b33c98", "value": "3145728:u9rkISnnaK0tIqUVYzxKTAa7Vj+nr/rFAwB2owC7IDTNnL3X/yhGNYgV9L:+krnaKuUVQxKTAa+rDB2owvFjPzagHL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846560", "to_ids": false, "type": "size-in-bytes", "uuid": "21962a4f-ac97-4ad5-842c-5c2a4c9650ae", "value": "162310144" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "vhash", "timestamp": "1783846560", "to_ids": true, "type": "vhash", "uuid": "27e4186c-746a-434d-a5b4-8b330aa7c138", "value": "4cf7726b9b1ee1d53eeeacb816a660f8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T13:58:09+00:00", "last_seen": "2026-02-03T09:54:07+00:00", "object_relation": "filename", "timestamp": "1783846560", "to_ids": true, "type": "filename", "uuid": "1f40be93-da86-4126-95a7-91daeaf0b52e", "value": "YEMPlayer.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852423", "uuid": "65e837ce-d02a-444c-b6cc-4831a77ece46", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "object_relation": "md5", "timestamp": "1783852423", "to_ids": true, "type": "md5", "uuid": "b41aeff6-b453-4f76-a1f2-f7da3165e7d9", "value": "d151ad777bcf1b3205273ab732c0fad6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "object_relation": "sha1", "timestamp": "1783846973", "to_ids": true, "type": "sha1", "uuid": "bfe1a42d-50f1-4dd6-9bc3-aefd1d797642", "value": "8179539efdb90eab355667ac7683358741c8a8ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "object_relation": "sha256", "timestamp": "1783846973", "to_ids": true, "type": "sha256", "uuid": "54d9aca1-e8be-4f3c-8479-65f396b85974", "value": "66dcd98c6b310f4429890821e609d48cc6395a6be15ffe5a121ec68b7a8f7402", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "object_relation": "text", "timestamp": "1783846581", "to_ids": false, "type": "text", "uuid": "39cd5e03-c4ff-4de5-9937-33afce8554b3", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 15/74\nFirst Seen In The Wild: 2026-01-16T21:06:08+00:00\nFirst Submission: 2026-01-08T13:53:44+00:00\nLast Submission: 2026-01-27T13:35:04+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "object_relation": "ssdeep", "timestamp": "1783846581", "to_ids": true, "type": "ssdeep", "uuid": "30a31969-213c-4f2f-9c4f-45a9907d1828", "value": "3145728:OnI4VHcPj0JsJ2CzbOzwMp47pUarUieRg5G5ByMmu4f54xdOO47I5hKC/PO45OkT:U2wJs7zbOzrm7+W5Gmi4f54G/k5QC/Pv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846581", "to_ids": false, "type": "size-in-bytes", "uuid": "f1ad3a64-ec50-49ca-a846-4c6030ed5adf", "value": "159838493" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "object_relation": "vhash", "timestamp": "1783846581", "to_ids": true, "type": "vhash", "uuid": "259ea0a3-a0e2-463f-bde2-8dcb17be3b78", "value": "fe124f1393f28cbfa7c9ec235884da65" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T13:53:44+00:00", "last_seen": "2026-01-27T13:35:04+00:00", "object_relation": "filename", "timestamp": "1783846581", "to_ids": true, "type": "filename", "uuid": "8804ae66-11d2-4403-91ac-3b629afb7d17", "value": "YEMPlayer.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852444", "uuid": "ed91baa7-0ee4-4f11-8ef7-e2bd0d93c62e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "md5", "timestamp": "1783852444", "to_ids": true, "type": "md5", "uuid": "75823884-10c8-49e6-9302-b579e41b864a", "value": "d66de5d6dbcb6f460ae6240de8b7aab0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "sha1", "timestamp": "1783846975", "to_ids": true, "type": "sha1", "uuid": "cb9985ed-9494-42ba-ab11-0fa5c760ce4e", "value": "1c841649189a46806084b189f50300e36c423163", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "sha256", "timestamp": "1783846975", "to_ids": true, "type": "sha256", "uuid": "a539a998-1501-40f6-af07-c95cbe616614", "value": "a4f1b79e96a7d016de1991a64506792018de99eac5df00f7cabe26ef41b2bd81", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "text", "timestamp": "1783846603", "to_ids": false, "type": "text", "uuid": "72fc4fe4-5888-43e5-9b82-22e69f8c08f3", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 08:16 AM 12/28/2025\nSigners: Nikki Boy Semblante; SSL.com Code Signing Intermediate CA RSA R1; SSL.com Root Certification Authority RSA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 25/74\nFirst Seen In The Wild: 2026-01-27T16:34:36+00:00\nFirst Submission: 2026-01-27T13:26:23+00:00\nLast Submission: 2026-02-14T12:55:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "creation-time", "timestamp": "1783846603", "to_ids": false, "type": "datetime", "uuid": "3edfa868-179c-4010-8f11-5dd7dc9a2042", "value": "2025-12-28T08:14:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "ssdeep", "timestamp": "1783846603", "to_ids": true, "type": "ssdeep", "uuid": "0240b1fe-bf6f-4ecc-80e1-7a9e3a2b4408", "value": "786432:8XToRu23ZZfuAeRf61RcJ+JHv1hXPLG8De4WMoeuEVwSK2uwFQH:rPj2A661g+JHv1hfLFeJhexVq2uD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846603", "to_ids": false, "type": "size-in-bytes", "uuid": "c7ffa8e8-91a8-471e-bf44-3c1579dcc252", "value": "32514048" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "vhash", "timestamp": "1783846603", "to_ids": true, "type": "vhash", "uuid": "1e5f7ab3-2127-481a-aac4-d56b870137d0", "value": "cf0a07cf80269ef1afcb045329f64524" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-27T13:26:23+00:00", "last_seen": "2026-02-14T12:55:46+00:00", "object_relation": "filename", "timestamp": "1783846603", "to_ids": true, "type": "filename", "uuid": "3d2dbb79-e6a7-41ea-9df8-4924a677d12f", "value": "Pis2rayVPN.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852465", "uuid": "1ef1336c-7cbf-46de-8fb3-eb2bb2ed31c3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "md5", "timestamp": "1783852465", "to_ids": true, "type": "md5", "uuid": "efd4509a-36e1-4ac1-9fd4-66838062198d", "value": "db6bc0e947acba379e540349f74fc6ee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "sha1", "timestamp": "1783846976", "to_ids": true, "type": "sha1", "uuid": "34a05742-92be-49ac-a989-066385031947", "value": "3fe1fcc2a21e4bab144da57ea6d0f13ddb9819e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "sha256", "timestamp": "1783846976", "to_ids": true, "type": "sha256", "uuid": "db94721b-bc71-4c3b-8d38-6beaa43c956c", "value": "13440348516ccee839675f6ac908dd1724ce1d28f92af92fdc7938740d2b7ec5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "text", "timestamp": "1783846624", "to_ids": false, "type": "text", "uuid": "6ed04c87-b840-46dc-bafd-9bbfec449d54", "value": "Type Description: Win32 DLL\nOriginal name: Service.exe\nVerified: A certificate was explicitly revoked by its issuer.\nSigning date: 07:30 AM 12/28/2025\nSigners: Nikki Boy Semblante; SSL.com Code Signing Intermediate CA RSA R1; SSL.com Root Certification Authority RSA\nMicrosoft: Trojan:Win64/EternalSunshine.A!dha\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2026-01-08T16:11:07+00:00\nFirst Submission: 2026-01-08T14:02:59+00:00\nLast Submission: 2026-01-08T14:02:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "creation-time", "timestamp": "1783846625", "to_ids": false, "type": "datetime", "uuid": "877edfea-1ffa-49c9-899f-6763464bfc0b", "value": "2025-12-28T07:27:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "ssdeep", "timestamp": "1783846624", "to_ids": true, "type": "ssdeep", "uuid": "f1f2402e-32cc-4fe8-97f4-8696e213c9ac", "value": "12288:MDRDtVoQMw5nCvRncww7lmJyCRcZCXCwz9dKLOKmB2tC79q5:MNfok5CpcBlem8XCC9EL/w2tcq5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846624", "to_ids": false, "type": "size-in-bytes", "uuid": "6f390bea-0ccd-46ea-a1e0-4ae5a441189b", "value": "668504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "vhash", "timestamp": "1783846624", "to_ids": true, "type": "vhash", "uuid": "c16aa136-42df-4d70-be47-720403254fc9", "value": "165076655d155d051550b012z1b00977z5055z1030079ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-01-08T14:02:59+00:00", "last_seen": "2026-01-08T14:02:59+00:00", "object_relation": "filename", "timestamp": "1783846624", "to_ids": true, "type": "filename", "uuid": "1cd83a14-a0db-43b0-ba5b-b19ea280b84b", "value": "Service.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852486", "uuid": "23846254-6a3d-4a18-955d-c8a2707a458b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "md5", "timestamp": "1783852486", "to_ids": true, "type": "md5", "uuid": "ed4196d1-e4f6-46ea-a407-b799632048ac", "value": "76f84bd0e4e1c4517c7a07a1a4bf0678", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "sha1", "timestamp": "1783846978", "to_ids": true, "type": "sha1", "uuid": "d378880e-e80c-4fe1-bbd0-8f0609d1401d", "value": "2de3913637b5b54eda345bce42eda63626d40d70", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "sha256", "timestamp": "1783846978", "to_ids": true, "type": "sha256", "uuid": "79abea80-bc4b-41f8-8fe1-e0344f125ae9", "value": "bb0c7ae4f12e5141480ee26f473636b07e836bb994ff3b2cfec93d4480da171b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "text", "timestamp": "1783846646", "to_ids": false, "type": "text", "uuid": "c55d509e-e543-4c59-922c-f4ba9c11de14", "value": "Type Description: Win32 DLL\nOriginal name: Service.exe\nMicrosoft: Trojan:Win64/EternalSunshine.A!dha\nClamAV: None\nVT Total Detection: 26/74\nFirst Seen In The Wild: 2025-12-01T03:48:31+00:00\nFirst Submission: 2025-06-20T16:43:05+00:00\nLast Submission: 2025-06-20T16:43:05+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "creation-time", "timestamp": "1783846646", "to_ids": false, "type": "datetime", "uuid": "c954da91-5c6e-4fea-8fa5-7c73f7119e43", "value": "2025-06-19T16:30:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "ssdeep", "timestamp": "1783846646", "to_ids": true, "type": "ssdeep", "uuid": "5ca38fd8-57c4-4816-b120-8e9a4eb0f053", "value": "12288:a2wjPsm1b1uoWnHjEmCpi78MSkKpEDODfgmWofKXHQfXQhJlfuuo:pSPsm1zqDKpLMGYmWofKXHTuZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846646", "to_ids": false, "type": "size-in-bytes", "uuid": "04fc67de-e7c5-4545-8b5d-ba75236da35e", "value": "652800" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "vhash", "timestamp": "1783846646", "to_ids": true, "type": "vhash", "uuid": "8a1ecced-9198-4ec4-9395-477f461a7682", "value": "165066655d15551550b012z1b009c7z5055z1030079ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T16:43:05+00:00", "last_seen": "2025-06-20T16:43:05+00:00", "object_relation": "filename", "timestamp": "1783846646", "to_ids": true, "type": "filename", "uuid": "4235a472-2ac8-4fad-befd-2cae48ed8b3c", "value": "Service.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-20T13:14:59+00:00", "last_seen": "2025-06-20T13:14:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852507", "uuid": "a43ce730-0f64-4806-9187-e8570b300668", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:14:59+00:00", "last_seen": "2025-06-20T13:14:59+00:00", "object_relation": "md5", "timestamp": "1783852507", "to_ids": true, "type": "md5", "uuid": "0e6547d2-3d45-46c6-9caf-50b84b82f394", "value": "e2c5dfcdeef50a85e01396d6d1afd69d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:14:59+00:00", "last_seen": "2025-06-20T13:14:59+00:00", "object_relation": "sha1", "timestamp": "1783846978", "to_ids": true, "type": "sha1", "uuid": "6bb8aa65-0e03-443d-b9d6-32ae6c755607", "value": "73676c99403cd19be7fcd558414246fffbd5211b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:14:59+00:00", "last_seen": "2025-06-20T13:14:59+00:00", "object_relation": "sha256", "timestamp": "1783846979", "to_ids": true, "type": "sha256", "uuid": "62493dd8-8bc1-472f-a0f3-10576d35e304", "value": "cc59bf019af195dcec4394ffd7a8e23c080f4e02b12dcb7c04fb1da6671922a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T13:14:59+00:00", "last_seen": "2025-06-20T13:14:59+00:00", "object_relation": "text", "timestamp": "1783846667", "to_ids": false, "type": "text", "uuid": "28022735-f9f9-40a9-a5e9-9cefe20efd8a", "value": "Type Description: RAR\nMicrosoft: None\nClamAV: None\nVT Total Detection: 29/74\nFirst Seen In The Wild: 2025-06-23T18:34:54+00:00\nFirst Submission: 2025-06-20T13:14:59+00:00\nLast Submission: 2025-06-20T13:14:59+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:14:59+00:00", "last_seen": "2025-06-20T13:14:59+00:00", "object_relation": "ssdeep", "timestamp": "1783846667", "to_ids": true, "type": "ssdeep", "uuid": "a1b8030f-f4f5-4964-99a8-fa9919221db5", "value": "393216:2kuWhvlTDFZ1c32GHpoAAR9Jn68iz/GG8lNVV7nDEiat:2kuuldZOmGHdY9x68iz8/nrQJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T13:14:59+00:00", "last_seen": "2025-06-20T13:14:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846667", "to_ids": false, "type": "size-in-bytes", "uuid": "b1a439d1-40b1-4402-b936-68542785161a", "value": "16086598" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T13:14:59+00:00", "last_seen": "2025-06-20T13:14:59+00:00", "object_relation": "filename", "timestamp": "1783846667", "to_ids": true, "type": "filename", "uuid": "da335375-2463-4f2b-814b-bbb9ae32d66f", "value": "IMAGE_GOOGLE_53534 34534 4534534.rar" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852528", "uuid": "044e2b72-0c1b-4734-ba2b-31f31a2e7cea", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "md5", "timestamp": "1783852528", "to_ids": true, "type": "md5", "uuid": "0772f71d-f207-48a3-a1f3-74bdd4634794", "value": "3c1d605fa5d983fe5401d574c11d4e35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "sha1", "timestamp": "1783846980", "to_ids": true, "type": "sha1", "uuid": "0fa61f6d-b2ee-4f9a-9d2e-e5c894e9cac0", "value": "356365acf50596cab523026887c523d9e63201d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "sha256", "timestamp": "1783846980", "to_ids": true, "type": "sha256", "uuid": "517ed8db-978c-48e9-81f0-184937f700a7", "value": "ea755862ee81dd0d991b4afca42d8b82bb22a8f1d370bf3d28dbf2e44ab241dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "text", "timestamp": "1783846689", "to_ids": false, "type": "text", "uuid": "0f39804f-3067-4b24-adc7-b6455fd1821b", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nClamAV: None\nVT Total Detection: 17/74\nFirst Seen In The Wild: 2026-02-04T13:56:35+00:00\nFirst Submission: 2025-06-20T07:02:32+00:00\nLast Submission: 2025-06-20T07:02:32+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "creation-time", "timestamp": "1783846689", "to_ids": false, "type": "datetime", "uuid": "221c5528-3fae-48ac-9a51-5351ed04960c", "value": "2025-06-19T17:01:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "ssdeep", "timestamp": "1783846689", "to_ids": true, "type": "ssdeep", "uuid": "61517a8c-3df4-4287-99b7-8494b5b579cf", "value": "3145728:BnESRQps/iwfU/XU2qedtNfXtVySf53L6BfFi0ogP:JESMsKQQqedtNPWSdmu0oS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846689", "to_ids": false, "type": "size-in-bytes", "uuid": "cd0a100c-07a1-4565-bc17-c583600d6afe", "value": "135313408" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "vhash", "timestamp": "1783846689", "to_ids": true, "type": "vhash", "uuid": "4cb23b46-fb59-446b-a980-3f5157f5f03e", "value": "99ab381c8daeac3e62d5833e3f6fdd40" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T07:02:32+00:00", "last_seen": "2025-06-20T07:02:32+00:00", "object_relation": "filename", "timestamp": "1783846689", "to_ids": true, "type": "filename", "uuid": "64abb336-d722-400f-bbe9-abd1a3278484", "value": "v2rayN.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852550", "uuid": "e97147fd-2eb4-4f0c-a516-06aca7e7da52", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "md5", "timestamp": "1783852550", "to_ids": true, "type": "md5", "uuid": "3e3332af-7470-49a4-abf2-e1d76486c05d", "value": "9f9f55bc2332a37e27a7ea69e14272c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "sha1", "timestamp": "1783846982", "to_ids": true, "type": "sha1", "uuid": "b0470330-4073-4782-a01c-a98dcb17462a", "value": "96c7a58d137f1393bc8f7e359a8e4bdbad0395d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "sha256", "timestamp": "1783846982", "to_ids": true, "type": "sha256", "uuid": "d8492fb2-3432-45c6-908e-046ebb55d871", "value": "fa246327bed8fc5864827a8147b8b7aedb6246068259b8c97e82adb957315347", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "text", "timestamp": "1783846710", "to_ids": false, "type": "text", "uuid": "591f2b19-0e94-4e86-9127-2fc26e36998a", "value": "Type Description: Win32 EXE\nOriginal name: Service.exe\nMicrosoft: Trojan:Win64/EternalSunshine.A!dha\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2025-06-23T18:35:32+00:00\nFirst Submission: 2025-06-20T13:24:05+00:00\nLast Submission: 2025-06-22T04:43:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "creation-time", "timestamp": "1783846710", "to_ids": false, "type": "datetime", "uuid": "7e7b5cdf-e363-441d-9fc1-848263105e59", "value": "2025-06-20T13:13:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "ssdeep", "timestamp": "1783846710", "to_ids": true, "type": "ssdeep", "uuid": "89e938cc-118d-476e-b5f5-cadea13d21d0", "value": "24576:2+RXO7GTCYZa4IbbcnaZoTe0xUtEFFPfoP/0r2F3p3pGWGif10ZgCfk403OesNmI:1WJ4Ibgr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846710", "to_ids": false, "type": "size-in-bytes", "uuid": "415dab95-949a-40dc-84e8-36ec3e4289c3", "value": "41532416" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "vhash", "timestamp": "1783846710", "to_ids": true, "type": "vhash", "uuid": "8b74f76b-8d59-432b-b7f0-87bcf16a8b68", "value": "047056651d156560b012z1b00927z5055z2040078fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-20T13:24:05+00:00", "last_seen": "2025-06-22T04:43:59+00:00", "object_relation": "filename", "timestamp": "1783846710", "to_ids": true, "type": "filename", "uuid": "dd05ea80-ef19-41b2-8b74-90e5cc573f5c", "value": "Service.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852571", "uuid": "3eb499b7-f687-47b8-9411-8abbf9f550c7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "md5", "timestamp": "1783852571", "to_ids": true, "type": "md5", "uuid": "81d5dfcb-68c6-4839-b453-807cfd9078b8", "value": "a3c42ca8fa39cb3053148335c74f8ddf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "sha1", "timestamp": "1783846983", "to_ids": true, "type": "sha1", "uuid": "95f362a7-850d-4a04-a7a1-831cca1c8312", "value": "41b6a754c56cee7d991a4c1b612e506536634730", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "sha256", "timestamp": "1783846984", "to_ids": true, "type": "sha256", "uuid": "27228c51-682c-44b0-b1da-e1648e864a42", "value": "3b172281f65ceaee280ae810edb6fd39a1ecd25649f929f246c0405df94f4c89", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "text", "timestamp": "1783846732", "to_ids": false, "type": "text", "uuid": "d48718a2-f879-4711-ab14-2acaa784e49d", "value": "Type Description: Win32 EXE\nOriginal name: YEPlayer.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 30/74\nFirst Seen In The Wild: 2026-02-19T03:27:22+00:00\nFirst Submission: 2026-02-18T02:09:12+00:00\nLast Submission: 2026-02-18T02:09:12+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "creation-time", "timestamp": "1783846733", "to_ids": false, "type": "datetime", "uuid": "ab2ed90f-9fe3-449d-ae83-3834adee1967", "value": "2025-12-06T22:33:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "ssdeep", "timestamp": "1783846732", "to_ids": true, "type": "ssdeep", "uuid": "d0e5936a-8c56-419e-b0b3-c6e205c35fe2", "value": "786432:uudl2jWiV5OtsFznbSsh9zPge5IeO3Ct33EYo57bB2bkWhQe+smp+tZaOr:hQRdSshxxtOsw57b0hplmqpr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846732", "to_ids": false, "type": "size-in-bytes", "uuid": "bd36bc9a-80d8-49e9-8d6f-552588be8c56", "value": "171912755" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "vhash", "timestamp": "1783846732", "to_ids": true, "type": "vhash", "uuid": "08191444-5882-4bc1-9fcb-fe74c7ff485e", "value": "0180a666155d156d1d055148zc46z121c5z13z2ez5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-18T02:09:12+00:00", "last_seen": "2026-02-18T02:09:12+00:00", "object_relation": "filename", "timestamp": "1783846732", "to_ids": true, "type": "filename", "uuid": "f61e5ba8-ac0d-4359-b856-b83f815eef26", "value": "YEPlayer.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-19T18:02:03+00:00", "last_seen": "2025-06-20T12:49:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783852592", "uuid": "0b81b01d-43cf-4770-aacb-81db12b62b82", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T18:02:03+00:00", "last_seen": "2025-06-20T12:49:50+00:00", "object_relation": "md5", "timestamp": "1783852592", "to_ids": true, "type": "md5", "uuid": "83c86dff-bdc1-4781-b56a-93ff58e024c9", "value": "1afc7f81e6d32bf366f592261d362c2c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T18:02:03+00:00", "last_seen": "2025-06-20T12:49:50+00:00", "object_relation": "sha1", "timestamp": "1783846984", "to_ids": true, "type": "sha1", "uuid": "060568d0-f607-4d75-8474-84daf5a907e5", "value": "60e1a9128dd7de17d197000e6ddd5518586b1843", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T18:02:03+00:00", "last_seen": "2025-06-20T12:49:50+00:00", "object_relation": "sha256", "timestamp": "1783846984", "to_ids": true, "type": "sha256", "uuid": "2415c4a6-9cee-4f41-8577-f7b03a1fb56c", "value": "6c74d29903bc2cc17ec4afdb1a120d2060209b22830cee2b7005f5436e86f90e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-19T18:02:03+00:00", "last_seen": "2025-06-20T12:49:50+00:00", "object_relation": "text", "timestamp": "1783846754", "to_ids": false, "type": "text", "uuid": "113f7812-dff7-4bb8-b88e-92dd93bd93ea", "value": "Type Description: RAR\nMicrosoft: None\nClamAV: None\nVT Total Detection: 16/74\nFirst Seen In The Wild: 2026-02-04T13:54:19+00:00\nFirst Submission: 2025-06-19T18:02:03+00:00\nLast Submission: 2025-06-20T12:49:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-19T18:02:03+00:00", "last_seen": "2025-06-20T12:49:50+00:00", "object_relation": "ssdeep", "timestamp": "1783846754", "to_ids": true, "type": "ssdeep", "uuid": "e8d267fa-09f6-486e-9d00-b7e8c7990e4d", "value": "3145728:1VMAzCmz8LD4JPQYM8SzkUH+YtdQ5HsEm0cGpjAInVPTRgn:wAzCme5YdS4C+YtC5sZGiIhmn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-19T18:02:03+00:00", "last_seen": "2025-06-20T12:49:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846754", "to_ids": false, "type": "size-in-bytes", "uuid": "6dbfb609-2c6f-42b8-9e2d-ccffa02fb83c", "value": "133157345" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-19T18:02:03+00:00", "last_seen": "2025-06-20T12:49:50+00:00", "object_relation": "filename", "timestamp": "1783846754", "to_ids": true, "type": "filename", "uuid": "c097a138-6cb3-4245-924f-910af85e6146", "value": "v2rayN.rar" } ] } ] } }