{ "Event": { "analysis": "1", "date": "2026-06-24", "extends_uuid": "", "info": "[Threat Intel] AsyncRAT and Remcos delivered in an optimistic campaign", "protected": false, "publish_timestamp": "1783115654", "published": true, "threat_level_id": "3", "timestamp": "1783115654", "uuid": "768f872b-0e52-439d-841c-bfe7af218557", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#9e0269", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#4985d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#2e58ce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Input Capture - T1056\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"da7743e9-205e-47b0-8afc-b7aa7a5ae050\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AsyncRAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782730818", "to_ids": false, "type": "text", "uuid": "0a81230f-e340-4914-a7c0-64a12c489e55", "value": "A global phishing campaign targets business functions with emails carrying malicious Excel attachments that initiate a multi-stage infection chain when macros are enabled.\nThe attack uses layered obfuscation, including HTA scripts, PowerShell, encoded payloads, and steganography in PNG files, to deliver and execute Remote Access Trojans such as Remcos and AsyncRAT in a largely fileless manner.\nIt achieves scale and persistence through high variability, automation, disposable infrastructure, and consistent patterns that help evade detection despite relatively simple techniques." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782730818", "to_ids": false, "type": "text", "uuid": "e011075c-9462-4563-b5bb-0460a19670aa", "value": "Name: AsyncRAT and Remcos delivered in an optimistic campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"Steganography\", \"phishing\", \"AsyncRAT\", \"Remcos\", \"Heavy obfuscation\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1204\", \"T1218\", \"T1102\", \"T1059\", \"T1071\", \"T1027\", \"T1566\", \"T1573\", \"T1547\", \"T1497\", \"T1056\"]\nIndustries: []" }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS36352 colocrossing", "deleted": false, "disable_correlation": false, "timestamp": "1783097061", "to_ids": true, "type": "ip-dst", "uuid": "bcd8c21d-dea6-4c1e-8fca-2d9be19958ae", "value": "107.172.235.213", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS36352 colocrossing", "deleted": false, "disable_correlation": false, "timestamp": "1783097082", "to_ids": true, "type": "ip-dst", "uuid": "896627d6-312a-4934-942b-5b54397676ef", "value": "198.12.83.75", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783097103", "to_ids": true, "type": "url", "uuid": "0865de7b-e1bc-4a1f-87f4-0ecb736cf124", "value": "http://192.227.219.79:4550", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-title:Remcos\nIOC-description:CC=US ASN=AS36352 colocrossing", "deleted": false, "disable_correlation": false, "timestamp": "1783097124", "to_ids": true, "type": "ip-dst", "uuid": "97a04024-2e89-47e4-ac82-16405960da99", "value": "192.227.219.79", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS29791 internap holding llc", "deleted": false, "disable_correlation": false, "timestamp": "1783097145", "to_ids": true, "type": "ip-dst", "uuid": "4654c674-3fc6-43d4-ba82-c1497c1cf7dc", "value": "173.231.188.244", "Tag": [ { "colour": "#ca404c", "local": false, "name": "asn:asn=\"32475\"", "relationship_type": "" }, { "colour": "#1c06de", "local": false, "name": "asn:as-owner=\"SINGLEHOP-LLC\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783097166", "to_ids": true, "type": "url", "uuid": "bfacd4aa-9cdf-43da-af61-78a799311c56", "value": "http://107.172.235.213/87/img_015059.png", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783097187", "to_ids": true, "type": "url", "uuid": "bf183163-1550-4e50-bfaa-e2d1737747bc", "value": "http://173.231.188.244:14641", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS36352 colocrossing", "deleted": false, "disable_correlation": false, "timestamp": "1783097208", "to_ids": true, "type": "ip-dst", "uuid": "25af9d46-41b0-4ce5-854f-c323047cf5b1", "value": "107.172.135.60", "Tag": [ { "colour": "#6a53a7", "local": false, "name": "asn:asn=\"36352\"", "relationship_type": "" }, { "colour": "#9daeac", "local": false, "name": "asn:as-owner=\"AS-COLOCROSSING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-title:UTF-8 Unicode text, with very long lines, with CRLF line terminators\nIOC-description:e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9", "deleted": false, "disable_correlation": false, "timestamp": "1783097229", "to_ids": true, "type": "url", "uuid": "78be1183-d816-4cf1-8b28-5d9d1d70410f", "value": "http://107.172.135.60/96/ibredgoodforbestthingscomingbackform.hta", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783097250", "to_ids": true, "type": "url", "uuid": "fc4ca194-d225-4c72-9995-b895ea6e2e04", "value": "https://as.al/file/KBn1RC", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783097271", "to_ids": true, "type": "url", "uuid": "4abfc9df-d889-457a-9849-3d674621d48f", "value": "http://198.12.83.75/98/img_194618.png", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783097292", "to_ids": true, "type": "url", "uuid": "785e8e5e-44ea-4364-aea6-440331ae4b80", "value": "https://cuth.me/sse8kU", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783097314", "to_ids": true, "type": "hostname", "uuid": "1b395ed5-59e6-4b05-a5c4-02ccf52820b1", "value": "ffgfgjjddsgtrddhtjyfdsessxdssdfdfdfghfhg.duckdns.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097334", "uuid": "47b62e40-50a5-45e9-9447-ba54edd384c8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "md5", "timestamp": "1783097334", "to_ids": true, "type": "md5", "uuid": "b0271007-a9ea-444b-ac89-9644bce94887", "value": "e1898150887bf933a314dc4056344ae5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "sha1", "timestamp": "1783096861", "to_ids": true, "type": "sha1", "uuid": "d40dcf1f-0ae3-4354-95cf-a30aa7aedf4b", "value": "0fa4f9dd0ac18eea0bbe005f51009b613a49f556", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "sha256", "timestamp": "1783096862", "to_ids": true, "type": "sha256", "uuid": "68eb9b32-996a-4a31-bd36-6af6c66ab425", "value": "614115669d093c58539e8183617a62a59aefd1a9a1fddcc7a67508f2fb9e36ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "text", "timestamp": "1783090417", "to_ids": false, "type": "text", "uuid": "76fe18d7-ade2-4f85-8aff-f98836dfcb94", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 34/75\nFirst Submission: 2026-06-11T04:09:59+00:00\nLast Submission: 2026-06-13T11:04:41+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "creation-time", "timestamp": "1783090417", "to_ids": false, "type": "datetime", "uuid": "05f81388-de3f-4435-8d0b-a428cd5291bf", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "ssdeep", "timestamp": "1783090417", "to_ids": true, "type": "ssdeep", "uuid": "6258fd01-defc-4729-96dc-49b8fe973d44", "value": "6144:GAhr1jRsug+8We0WgeMv9T9H1QGoa4eKwu4KYZ8kVfOWLFg4J8pIbzVFUCuNI+9Y:BDylH4wSoYA8EVZau7yLLw6OrB79I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090417", "to_ids": false, "type": "size-in-bytes", "uuid": "55000d05-038a-44c0-9265-fc9c1892f456", "value": "605184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "vhash", "timestamp": "1783090417", "to_ids": true, "type": "vhash", "uuid": "b5ba003c-8443-4bf2-aad9-cdae03eaa267", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T04:09:59+00:00", "last_seen": "2026-06-13T11:04:41+00:00", "object_relation": "filename", "timestamp": "1783090417", "to_ids": true, "type": "filename", "uuid": "a4a09be8-99f8-4414-b1c1-390134514abc", "value": "POTHX22-1236.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097355", "uuid": "dc16135f-3e5c-446a-8ca5-2972bd880034", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "md5", "timestamp": "1783097355", "to_ids": true, "type": "md5", "uuid": "76be5a6b-e32a-4176-b650-6dd23edd7cd6", "value": "ce3480917a5285a03b9de320354f3e1b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "sha1", "timestamp": "1783096863", "to_ids": true, "type": "sha1", "uuid": "176feac4-5965-4e72-a075-dddfbe08bd85", "value": "5e1172c07877a4d44f3c2f33abb268d7e6b3114e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "sha256", "timestamp": "1783096863", "to_ids": true, "type": "sha256", "uuid": "e166f3ca-d1e9-4368-9852-ce6490dfd67b", "value": "0b47f8d79e37ebec7edd2333ab70caa1e3e710b310b8201c5447820886ce8d49", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "text", "timestamp": "1783090438", "to_ids": false, "type": "text", "uuid": "0ba76d7b-6752-4a09-8520-1d2f29a9fc25", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-06-11T05:01:05+00:00\nLast Submission: 2026-07-01T10:50:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "creation-time", "timestamp": "1783090438", "to_ids": false, "type": "datetime", "uuid": "266de137-dd5f-404e-91cb-3fdba880c159", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "ssdeep", "timestamp": "1783090438", "to_ids": true, "type": "ssdeep", "uuid": "d065556a-d4f9-4154-80bd-9c9ea8c06f59", "value": "3072:3n1LZvTTZGzN6YZ5nuTib2W25cURmuccQg:FLFZsNjvnyi6fRm3c" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090438", "to_ids": false, "type": "size-in-bytes", "uuid": "76b042c0-2f1b-43ae-81ff-41ef44cdc839", "value": "150528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "vhash", "timestamp": "1783090438", "to_ids": true, "type": "vhash", "uuid": "0687dc57-06fe-4d42-98cd-83949d6d5f8d", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:01:05+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "filename", "timestamp": "1783090438", "to_ids": true, "type": "filename", "uuid": "1970cc61-f156-4901-9f59-4af9bda70f94", "value": "Thermo Fisher_RFQ_TFS-1705.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097377", "uuid": "dcf7e52d-7f23-4c21-946b-737abf3ed8c9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "md5", "timestamp": "1783097377", "to_ids": true, "type": "md5", "uuid": "dd77d211-3871-4a1e-8423-4784bf48b195", "value": "a822b55a9a6a8b66c068d22e52d3203f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "sha1", "timestamp": "1783096864", "to_ids": true, "type": "sha1", "uuid": "7feb765f-ec5b-40f7-a976-ffc60ba13e5f", "value": "50fdee4b9ea69300c2769e613c92a69e4adcc0a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "sha256", "timestamp": "1783096864", "to_ids": true, "type": "sha256", "uuid": "cfde217e-dd9e-4255-b077-23ebceabce5e", "value": "248da1553ce35bb6c499a660fcd92bde6e3545b56b65b63308e7b7630f376bfc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "text", "timestamp": "1783090460", "to_ids": false, "type": "text", "uuid": "f54653bf-f609-485a-ab3a-eace0acb7694", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 35/74\nFirst Seen In The Wild: 2026-06-11T16:00:44+00:00\nFirst Submission: 2026-06-11T08:15:33+00:00\nLast Submission: 2026-07-01T10:50:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "creation-time", "timestamp": "1783090460", "to_ids": false, "type": "datetime", "uuid": "88c33cc5-ac75-4157-88de-f8fc5ceee77d", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "ssdeep", "timestamp": "1783090460", "to_ids": true, "type": "ssdeep", "uuid": "6c17b52a-29cc-433c-86a6-f3fa4f0acb1d", "value": "1536:BKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhhu5dpQxDj10aHKjcVt2:Bn1LZvTTZGzN6YZ5wWhu5dSBjR4cV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090460", "to_ids": false, "type": "size-in-bytes", "uuid": "617c5a87-ed5b-4735-86f0-f76fb0c82c0f", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "vhash", "timestamp": "1783090460", "to_ids": true, "type": "vhash", "uuid": "fcfa7691-9f2d-43b7-bc89-088cda8cadf7", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:15:33+00:00", "last_seen": "2026-07-01T10:50:54+00:00", "object_relation": "filename", "timestamp": "1783090460", "to_ids": true, "type": "filename", "uuid": "4719bbaf-57f5-408d-ae8b-8523ade721bb", "value": "Quotation.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097398", "uuid": "6ece92d8-27e9-4e20-80c6-dc828b370dad", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "md5", "timestamp": "1783097398", "to_ids": true, "type": "md5", "uuid": "2cf3dff5-d966-401c-a007-37533a2655fd", "value": "6dc526fae9798f338975181aa3f3e9cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "sha1", "timestamp": "1783096866", "to_ids": true, "type": "sha1", "uuid": "a7718be6-68d4-4f01-8fd0-1cee81cfb8cc", "value": "825d1e85be15fe256838011c081d62e09c4f9220", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "sha256", "timestamp": "1783096866", "to_ids": true, "type": "sha256", "uuid": "78995ba5-30b6-4781-bbf9-b6dbebb4688c", "value": "f9f6314fc9f333b1aa92afdd63a98927b85fd01607e907e69b4682d18f31d2a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 18/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "text", "timestamp": "1783090481", "to_ids": false, "type": "text", "uuid": "c73094cf-7416-4bae-83d9-6a6de31bda8a", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 35/74\nFirst Seen In The Wild: 2026-06-15T08:00:35+00:00\nFirst Submission: 2026-06-15T00:37:16+00:00\nLast Submission: 2026-06-26T23:34:00+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "creation-time", "timestamp": "1783090481", "to_ids": false, "type": "datetime", "uuid": "742f46ee-2318-4687-99ba-837f6b9b4649", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "ssdeep", "timestamp": "1783090481", "to_ids": true, "type": "ssdeep", "uuid": "ff2ff31c-ee25-45bb-9d86-2e2145a7b7a2", "value": "6144:EZ+RwPONXoRjZ7SezmfDlavx+W/WGW3i9BxfQvUNNtnJQ+rLE+gTzTpZBjdtEEnn:3i9PQvUJgzPjtbIikfWqK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090481", "to_ids": false, "type": "size-in-bytes", "uuid": "fac045d8-5e4f-4a89-becf-f21820392da1", "value": "423936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "vhash", "timestamp": "1783090481", "to_ids": true, "type": "vhash", "uuid": "4306ec30-aceb-4c23-ba9a-6d881be7cb09", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T00:37:16+00:00", "last_seen": "2026-06-26T23:34:00+00:00", "object_relation": "filename", "timestamp": "1783090481", "to_ids": true, "type": "filename", "uuid": "23ce8882-4cde-43a1-b184-777ead26a369", "value": "f9f6314fc9f333b1aa92afdd63a98927b85fd01607e907e69b4682d18f31d2a1.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097419", "uuid": "a38cc723-1535-4adc-90c6-d6f0b308bbdf", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "md5", "timestamp": "1783097419", "to_ids": true, "type": "md5", "uuid": "d7b43c65-a18b-445c-a893-c345d57db4f8", "value": "7efc7341472dc671779c0ca8d4e8ac5c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "sha1", "timestamp": "1783096867", "to_ids": true, "type": "sha1", "uuid": "621b1049-3756-4ee9-8a02-7615562a50b8", "value": "b36519598b8cd8ebcc959965db5dba1ace8d78a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "sha256", "timestamp": "1783096867", "to_ids": true, "type": "sha256", "uuid": "f94e93e2-e0f3-47ee-a5e5-18cc6e17ca26", "value": "49c7b4eb6620917ee7ca796472b7af9f01ea6f7f80391ae7eb7bd8dabe0b7249", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "text", "timestamp": "1783090503", "to_ids": false, "type": "text", "uuid": "572afd64-8a1a-4207-a543-02de6ff30e88", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 34/75\nFirst Submission: 2026-06-11T04:19:09+00:00\nLast Submission: 2026-06-11T04:19:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "creation-time", "timestamp": "1783090503", "to_ids": false, "type": "datetime", "uuid": "a2da4e57-be34-4c0c-9efc-5c9a1c50ae4f", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "ssdeep", "timestamp": "1783090503", "to_ids": true, "type": "ssdeep", "uuid": "3a228cac-c378-46c8-b8b8-e6f3ffc41fd5", "value": "1536:cKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhAaUVuA2P4hCH9VABnjr:cn1LZvTTZGzN6YZ5wWAafA2P4hsOM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090503", "to_ids": false, "type": "size-in-bytes", "uuid": "51b767c2-e0fa-4bb2-a071-3e997fed8ac7", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "vhash", "timestamp": "1783090503", "to_ids": true, "type": "vhash", "uuid": "46258389-ff8c-463b-a72d-5328cb482955", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T04:19:09+00:00", "last_seen": "2026-06-11T04:19:09+00:00", "object_relation": "filename", "timestamp": "1783090503", "to_ids": true, "type": "filename", "uuid": "8621fc8b-cfd2-4d90-a650-2fcddcfc8fe7", "value": "7efc7341472dc671779c0ca8d4e8ac5c.file" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097440", "uuid": "bdcc029a-add1-4ec4-b404-48621b667f6c", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of 5e17e44fe2ef3e44904a65bfc787ddb9a5109350ce9636f4470f765e7f6fb1ec", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "md5", "timestamp": "1783097440", "to_ids": true, "type": "md5", "uuid": "7aad97b6-f27f-4def-a57e-030dcbbebc14", "value": "3e4dadbd55753a77a0d2acd3c333afc7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of 5e17e44fe2ef3e44904a65bfc787ddb9a5109350ce9636f4470f765e7f6fb1ec", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "sha1", "timestamp": "1783096868", "to_ids": true, "type": "sha1", "uuid": "90784c44-f362-4bf5-8a60-89396ce0d0b7", "value": "8244d0a2457850ba4c2cc036d02863269272bdfd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of 5e17e44fe2ef3e44904a65bfc787ddb9a5109350ce9636f4470f765e7f6fb1ec", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "sha256", "timestamp": "1783096869", "to_ids": true, "type": "sha256", "uuid": "a488e8f7-6211-42e5-b2b4-a3b4de5e1b28", "value": "5e17e44fe2ef3e44904a65bfc787ddb9a5109350ce9636f4470f765e7f6fb1ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 01/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "text", "timestamp": "1783090524", "to_ids": false, "type": "text", "uuid": "eb76dcbd-8718-43c8-998e-5cc4b042a59f", "value": "IOC-description:MD5 of 5e17e44fe2ef3e44904a65bfc787ddb9a5109350ce9636f4470f765e7f6fb1ec\r\nType Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 24/74\nFirst Seen In The Wild: 2026-06-15T10:46:44+00:00\nFirst Submission: 2026-06-15T09:12:52+00:00\nLast Submission: 2026-06-15T10:46:00+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "creation-time", "timestamp": "1783090524", "to_ids": false, "type": "datetime", "uuid": "3b62cc77-1072-4b78-8c11-1425aab10eb6", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "ssdeep", "timestamp": "1783090524", "to_ids": true, "type": "ssdeep", "uuid": "9300b392-e1e7-4dd7-993b-4fcc605ef0d5", "value": "1536:uOAZ57UXtsR8ofl9L06+u2Kn9mwZo7Ylhdo:uOAzAXtqfXB9Ysl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090524", "to_ids": false, "type": "size-in-bytes", "uuid": "ef846508-0832-4bb7-9e97-2424a030c157", "value": "78848" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "vhash", "timestamp": "1783090524", "to_ids": true, "type": "vhash", "uuid": "ec3e19f5-14c5-4634-908a-1fe357eeefc6", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T09:12:52+00:00", "last_seen": "2026-06-15T10:46:00+00:00", "object_relation": "filename", "timestamp": "1783090524", "to_ids": true, "type": "filename", "uuid": "70b7df0d-1cc8-45b8-827d-f578da2c772c", "value": "Shipment Document.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T05:44:16+00:00", "last_seen": "2026-06-11T05:44:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097461", "uuid": "ba3d9dea-846b-4b5d-aee0-2c7b67fac50d", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:RAR_Archive\nIOC-description:MD5 of a136fce65870643b187eada0d60d8b338a9f4d20762b2a550cadf03597f68017", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:44:16+00:00", "last_seen": "2026-06-11T05:44:16+00:00", "object_relation": "md5", "timestamp": "1783097461", "to_ids": true, "type": "md5", "uuid": "8302a39a-2121-401c-916d-086f13672175", "value": "492a0bda6b22583ccdab80b2b8f8f2a0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:RAR_Archive\nIOC-description:MD5 of a136fce65870643b187eada0d60d8b338a9f4d20762b2a550cadf03597f68017", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:44:16+00:00", "last_seen": "2026-06-11T05:44:16+00:00", "object_relation": "sha1", "timestamp": "1783096870", "to_ids": true, "type": "sha1", "uuid": "71e668b9-55cd-40ce-838a-b38855fedb44", "value": "658af6cba07684a4d5a34547585430ddc37a6efa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:RAR_Archive\nIOC-description:MD5 of a136fce65870643b187eada0d60d8b338a9f4d20762b2a550cadf03597f68017", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:44:16+00:00", "last_seen": "2026-06-11T05:44:16+00:00", "object_relation": "sha256", "timestamp": "1783096870", "to_ids": true, "type": "sha256", "uuid": "1a42f65d-58ab-4e2a-8093-417e7e9f1a44", "value": "a136fce65870643b187eada0d60d8b338a9f4d20762b2a550cadf03597f68017", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 01/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:44:16+00:00", "last_seen": "2026-06-11T05:44:16+00:00", "object_relation": "text", "timestamp": "1783090546", "to_ids": false, "type": "text", "uuid": "838d72c6-842c-48ea-81e0-8ca41bbf4ff7", "value": "IOC-title:RAR_Archive\nIOC-description:MD5 of a136fce65870643b187eada0d60d8b338a9f4d20762b2a550cadf03597f68017\r\nType Description: RAR\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-06-11T05:44:16+00:00\nLast Submission: 2026-06-11T05:44:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:44:16+00:00", "last_seen": "2026-06-11T05:44:16+00:00", "object_relation": "ssdeep", "timestamp": "1783090546", "to_ids": true, "type": "ssdeep", "uuid": "f55c5f19-fe15-4203-b8c7-548fe915a8b5", "value": "3072:YVzTwRjSz4/YiDpFWARXzk2siiVS0A0CQnHEV9sLS9+d:YZ2jL5DhY2tiVSvQnH1LLd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:44:16+00:00", "last_seen": "2026-06-11T05:44:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090546", "to_ids": false, "type": "size-in-bytes", "uuid": "e4f32c8c-af83-4c50-8d36-45edb2d0f721", "value": "108545" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:44:16+00:00", "last_seen": "2026-06-11T05:44:16+00:00", "object_relation": "filename", "timestamp": "1783090546", "to_ids": true, "type": "filename", "uuid": "494d89ca-2c01-4c86-af42-0991514d55d6", "value": "492a0bda6b22583ccdab80b2b8f8f2a0.file" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T20:58:40+00:00", "last_seen": "2026-06-17T00:17:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097482", "uuid": "35a7dd9c-8c68-49b1-93a9-6ca75626e009", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:40+00:00", "last_seen": "2026-06-17T00:17:26+00:00", "object_relation": "md5", "timestamp": "1783097482", "to_ids": true, "type": "md5", "uuid": "280b5a12-3fb5-45ce-814d-a12ac9f2f62e", "value": "52b725b8144745f2885198d514a805eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:40+00:00", "last_seen": "2026-06-17T00:17:26+00:00", "object_relation": "sha1", "timestamp": "1783096871", "to_ids": true, "type": "sha1", "uuid": "1f45708d-9cfd-4ec5-ad33-0b3bda9833ac", "value": "cd3b3de6c894b9cd3bd3b9cfcf00077adb88877b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:40+00:00", "last_seen": "2026-06-17T00:17:26+00:00", "object_relation": "sha256", "timestamp": "1783096871", "to_ids": true, "type": "sha256", "uuid": "e062ab24-9307-45f6-a2ae-f9e61e532b57", "value": "e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 30/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:58:40+00:00", "last_seen": "2026-06-17T00:17:26+00:00", "object_relation": "text", "timestamp": "1783090568", "to_ids": false, "type": "text", "uuid": "5f54190b-af9d-48ed-9dc7-3c29709579b6", "value": "IOC-description:MD5 of e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9\r\nType Description: Text\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 24/74\nFirst Seen In The Wild: 2026-06-15T21:01:07+00:00\nFirst Submission: 2026-06-15T20:58:40+00:00\nLast Submission: 2026-06-17T00:17:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:40+00:00", "last_seen": "2026-06-17T00:17:26+00:00", "object_relation": "ssdeep", "timestamp": "1783090568", "to_ids": true, "type": "ssdeep", "uuid": "a330e095-390d-452d-83e2-11a0caeb4906", "value": "192:OIAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IA4:VAEDZZ86gRkx6ZkiOIOx73" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:58:40+00:00", "last_seen": "2026-06-17T00:17:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090568", "to_ids": false, "type": "size-in-bytes", "uuid": "406f47a5-2d43-47a9-8408-e00d83464b69", "value": "28080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:58:40+00:00", "last_seen": "2026-06-17T00:17:26+00:00", "object_relation": "filename", "timestamp": "1783090568", "to_ids": true, "type": "filename", "uuid": "04d36dba-55de-439c-a35b-fa4ef440e8f3", "value": "ibredgoodforbestthingscomingbackform.hta" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097503", "uuid": "5f834630-7f68-4799-b947-31bfc1541abe", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of c92c8d5ea7e0e05e0f19fabd4111731ef4b9e7d5e0b028797e23481b6afde212", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "md5", "timestamp": "1783097503", "to_ids": true, "type": "md5", "uuid": "91e2f611-26ef-4644-8304-ce1b1d245e2e", "value": "59ea75c5850eb80812d991f903a10014", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of c92c8d5ea7e0e05e0f19fabd4111731ef4b9e7d5e0b028797e23481b6afde212", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "sha1", "timestamp": "1783096873", "to_ids": true, "type": "sha1", "uuid": "cc6452bb-e2eb-4f06-a42f-f7c1fe291107", "value": "e1f3942742b5cd393673539b3298fab5bdef7b14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of c92c8d5ea7e0e05e0f19fabd4111731ef4b9e7d5e0b028797e23481b6afde212", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "sha256", "timestamp": "1783096873", "to_ids": true, "type": "sha256", "uuid": "cf25cb1d-431a-4064-8477-1b3d2f6ca06c", "value": "c92c8d5ea7e0e05e0f19fabd4111731ef4b9e7d5e0b028797e23481b6afde212", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "text", "timestamp": "1783090589", "to_ids": false, "type": "text", "uuid": "8f04fad8-664c-42f4-bcc6-8e2551054264", "value": "IOC-description:MD5 of c92c8d5ea7e0e05e0f19fabd4111731ef4b9e7d5e0b028797e23481b6afde212\r\nType Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 34/74\nFirst Seen In The Wild: 2026-06-15T12:00:39+00:00\nFirst Submission: 2026-06-15T02:32:15+00:00\nLast Submission: 2026-06-15T16:55:57+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "creation-time", "timestamp": "1783090590", "to_ids": false, "type": "datetime", "uuid": "38fd5012-def1-43c9-aed4-ca2809d89920", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "ssdeep", "timestamp": "1783090589", "to_ids": true, "type": "ssdeep", "uuid": "11e3a975-79bd-4e53-ad5a-ee66a3c16283", "value": "6144:jZ+RwPONXoRjZ7SezmfDlavx+W/WGW3i9BxfQvUNNtnJQZtrLE+gTzTpZBjdtEEp:Ai9PQvUJHu+AidMv2AVcD69OhbMTZ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090589", "to_ids": false, "type": "size-in-bytes", "uuid": "f74b0f74-278f-4f78-bd35-44aa46943830", "value": "424960" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "vhash", "timestamp": "1783090589", "to_ids": true, "type": "vhash", "uuid": "9e611396-14f6-4543-95a2-a60b74ad8aff", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:32:15+00:00", "last_seen": "2026-06-15T16:55:57+00:00", "object_relation": "filename", "timestamp": "1783090589", "to_ids": true, "type": "filename", "uuid": "606d2091-ce62-4e27-ac81-c8cbc4371a03", "value": "List of required items.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T06:32:12+00:00", "last_seen": "2026-06-21T04:03:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097524", "uuid": "e01b15c8-b12b-4819-b7f8-fce87e9790ab", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:32:12+00:00", "last_seen": "2026-06-21T04:03:49+00:00", "object_relation": "md5", "timestamp": "1783097524", "to_ids": true, "type": "md5", "uuid": "9f07603a-02ba-4d3b-9c75-841407456752", "value": "5e16dd79001f2faba4569e2abd5b19c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:32:12+00:00", "last_seen": "2026-06-21T04:03:49+00:00", "object_relation": "sha1", "timestamp": "1783096874", "to_ids": true, "type": "sha1", "uuid": "2278f1bf-600d-410a-8bec-dab68640ce23", "value": "d044d5b8ba9c7abc203a0ff5688702c7f45b54cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:32:12+00:00", "last_seen": "2026-06-21T04:03:49+00:00", "object_relation": "sha256", "timestamp": "1783096874", "to_ids": true, "type": "sha256", "uuid": "0193e156-2c59-4324-9887-1793c5f65411", "value": "eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:32:12+00:00", "last_seen": "2026-06-21T04:03:49+00:00", "object_relation": "text", "timestamp": "1783090611", "to_ids": false, "type": "text", "uuid": "c05491c5-cb3e-438c-8add-c113ee76696e", "value": "IOC-description:MD5 of eb5ec9fca46e31da933f3a52aed3e483aec25e59c7540b89740fbe6dc19b0bc8\r\nType Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 16/74\nFirst Seen In The Wild: 2026-06-11T07:00:53+00:00\nFirst Submission: 2026-06-11T06:32:12+00:00\nLast Submission: 2026-06-21T04:03:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:32:12+00:00", "last_seen": "2026-06-21T04:03:49+00:00", "object_relation": "ssdeep", "timestamp": "1783090611", "to_ids": true, "type": "ssdeep", "uuid": "c6b7d863-179d-4686-af38-0f4ac69688c7", "value": "384:MDLoivy7BQ5gNN1CD1ZVlLE5g5TlwzlOmYG8tQmQmmYG8t5BHmmKt6qA8ZCD6cZe:MUTXmK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:32:12+00:00", "last_seen": "2026-06-21T04:03:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090611", "to_ids": false, "type": "size-in-bytes", "uuid": "85a2578d-431a-4d60-b0aa-44e049a34179", "value": "27826" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:32:12+00:00", "last_seen": "2026-06-21T04:03:49+00:00", "object_relation": "filename", "timestamp": "1783090611", "to_ids": true, "type": "filename", "uuid": "174c28d2-f340-4a69-b1ff-3c8e2144ce88", "value": "goodthingsformebetterforme.hTA" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097545", "uuid": "df961c65-60b2-44f7-84de-aa3b2f4a057e", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of ef00251d4b7f56bf3a08afc6fbbbef268de470fb6d387e1c72909999a3b2c652", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "object_relation": "md5", "timestamp": "1783097545", "to_ids": true, "type": "md5", "uuid": "68972acf-d824-412e-a36e-cbaa60fba890", "value": "5f51518947c84a2b43483ff3d5404cbd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of ef00251d4b7f56bf3a08afc6fbbbef268de470fb6d387e1c72909999a3b2c652", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "object_relation": "sha1", "timestamp": "1783096876", "to_ids": true, "type": "sha1", "uuid": "fcdaed0b-9737-424a-8bb0-12b667059573", "value": "4c3f5e274c160b9943259754dbd23b3656aa8265", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of ef00251d4b7f56bf3a08afc6fbbbef268de470fb6d387e1c72909999a3b2c652", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "object_relation": "sha256", "timestamp": "1783096876", "to_ids": true, "type": "sha256", "uuid": "09070aa6-93e3-46c6-bb3f-727c1ff0be5f", "value": "ef00251d4b7f56bf3a08afc6fbbbef268de470fb6d387e1c72909999a3b2c652", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 18/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "object_relation": "text", "timestamp": "1783090632", "to_ids": false, "type": "text", "uuid": "2ddfc2a6-a223-4e72-ace0-1f09ac8660d8", "value": "IOC-description:MD5 of ef00251d4b7f56bf3a08afc6fbbbef268de470fb6d387e1c72909999a3b2c652\r\nType Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 21/74\nFirst Seen In The Wild: 2026-06-15T21:01:30+00:00\nFirst Submission: 2026-06-15T20:58:41+00:00\nLast Submission: 2026-06-17T00:17:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "object_relation": "ssdeep", "timestamp": "1783090632", "to_ids": true, "type": "ssdeep", "uuid": "be5bf7c9-fe3e-4197-adf3-39f96190fe2b", "value": "96:FTpQ/qdvd6VkZByFUhxJhi9snE6InRko5BmBq57VdiX4PsIaq5vXJj/L65i746Wg:1p7VUsE3ycu5l32DXqOyqAY7gTMRUHk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090632", "to_ids": false, "type": "size-in-bytes", "uuid": "aacf3371-71e4-4c50-a38a-4800313d3880", "value": "25600" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "object_relation": "vhash", "timestamp": "1783090632", "to_ids": true, "type": "vhash", "uuid": "d9c1cf9c-7729-4c9d-b22b-ce1eef984894", "value": "9f37ef6b2db6dd0fb2704c1801d2d37d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T20:58:41+00:00", "last_seen": "2026-06-17T00:17:50+00:00", "object_relation": "filename", "timestamp": "1783090632", "to_ids": true, "type": "filename", "uuid": "b9253d74-ed02-449d-a86d-824a7b3fd85c", "value": "goodthingsarebestforbesttihignstocome.hta" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T04:06:01+00:00", "last_seen": "2026-06-15T12:40:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097566", "uuid": "e556376f-a73f-449b-875a-92d085c43b8f", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:RAR_Archive\nIOC-description:MD5 of 7ffd8ab8cad744263a4f16c8e96da8b8c38818b480dbeaec91e4224ac70b7ec1", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T04:06:01+00:00", "last_seen": "2026-06-15T12:40:30+00:00", "object_relation": "md5", "timestamp": "1783097566", "to_ids": true, "type": "md5", "uuid": "bd1816ae-de38-48fc-8951-b1d88f075995", "value": "5fc03d7c710b3eb75a9c6534dd1319a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:RAR_Archive\nIOC-description:MD5 of 7ffd8ab8cad744263a4f16c8e96da8b8c38818b480dbeaec91e4224ac70b7ec1", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T04:06:01+00:00", "last_seen": "2026-06-15T12:40:30+00:00", "object_relation": "sha1", "timestamp": "1783096877", "to_ids": true, "type": "sha1", "uuid": "dfdf71ea-54e5-49dd-87b1-63edeb45281c", "value": "e15c7f7f4f951bb444fe77603f903d601d3ad93b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:RAR_Archive\nIOC-description:MD5 of 7ffd8ab8cad744263a4f16c8e96da8b8c38818b480dbeaec91e4224ac70b7ec1", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T04:06:01+00:00", "last_seen": "2026-06-15T12:40:30+00:00", "object_relation": "sha256", "timestamp": "1783096877", "to_ids": true, "type": "sha256", "uuid": "e647e3e7-5a58-40b7-9a67-9643a2f5f3ea", "value": "7ffd8ab8cad744263a4f16c8e96da8b8c38818b480dbeaec91e4224ac70b7ec1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T04:06:01+00:00", "last_seen": "2026-06-15T12:40:30+00:00", "object_relation": "text", "timestamp": "1783090654", "to_ids": false, "type": "text", "uuid": "60396fd0-1ebe-479f-a8f5-c711e3133bfa", "value": "IOC-title:RAR_Archive\nIOC-description:MD5 of 7ffd8ab8cad744263a4f16c8e96da8b8c38818b480dbeaec91e4224ac70b7ec1\r\nType Description: RAR\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 32/75\nFirst Seen In The Wild: 2026-06-12T12:02:40+00:00\nFirst Submission: 2026-06-12T04:06:01+00:00\nLast Submission: 2026-06-15T12:40:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T04:06:01+00:00", "last_seen": "2026-06-15T12:40:30+00:00", "object_relation": "ssdeep", "timestamp": "1783090654", "to_ids": true, "type": "ssdeep", "uuid": "45414c6a-0f55-4463-bb6b-f87214f2749c", "value": "3072:mVzTwRjSz4/YiDpFWARXzk2siiVS0A0CQnHEV9sLS9+W:mZ2jL5DhY2tiVSvQnH1LLW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T04:06:01+00:00", "last_seen": "2026-06-15T12:40:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090654", "to_ids": false, "type": "size-in-bytes", "uuid": "4dcc64c3-beab-46ce-96e8-d19c449cd0b4", "value": "108545" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T04:06:01+00:00", "last_seen": "2026-06-15T12:40:30+00:00", "object_relation": "filename", "timestamp": "1783090654", "to_ids": true, "type": "filename", "uuid": "163c3063-214f-4ec4-85eb-320db8da7fc8", "value": "Attached Order.rar" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097587", "uuid": "7e0e140b-6969-4cc4-85f2-db65981d2ecc", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of f4d6b2437e33500195e3e1607704ffb7b544c2dd8f2333ed06d42d625b7a7f8d", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "md5", "timestamp": "1783097587", "to_ids": true, "type": "md5", "uuid": "a82e1b0a-47f4-4283-9688-e91b2ba91a91", "value": "7351447d7eaf36822d9bce9ae0ed3ece", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of f4d6b2437e33500195e3e1607704ffb7b544c2dd8f2333ed06d42d625b7a7f8d", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "sha1", "timestamp": "1783096878", "to_ids": true, "type": "sha1", "uuid": "bb55ecb5-f5e3-46ca-bab9-94aaf208ee25", "value": "a67a1b5cf32bcefab1d84c5eb09f3be808cbc4e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of f4d6b2437e33500195e3e1607704ffb7b544c2dd8f2333ed06d42d625b7a7f8d", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "sha256", "timestamp": "1783096879", "to_ids": true, "type": "sha256", "uuid": "ec482829-4e52-4b10-8bdf-d8585c789ad7", "value": "f4d6b2437e33500195e3e1607704ffb7b544c2dd8f2333ed06d42d625b7a7f8d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "text", "timestamp": "1783090675", "to_ids": false, "type": "text", "uuid": "1ae56391-df58-4fe6-ad90-1858417ae172", "value": "IOC-description:MD5 of f4d6b2437e33500195e3e1607704ffb7b544c2dd8f2333ed06d42d625b7a7f8d\r\nType Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 30/75\nFirst Submission: 2026-06-11T05:45:40+00:00\nLast Submission: 2026-06-11T05:45:40+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "creation-time", "timestamp": "1783090675", "to_ids": false, "type": "datetime", "uuid": "b881af99-81fd-47df-92f0-486edac9962d", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "ssdeep", "timestamp": "1783090675", "to_ids": true, "type": "ssdeep", "uuid": "8bd3de66-caee-442d-ac9d-585203140783", "value": "1536:yKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhgY2AObMdDQo5K4KgKgH:yn1LZvTTZGzN6YZ5wWgY1NJ5K4rK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090675", "to_ids": false, "type": "size-in-bytes", "uuid": "4ea3cc1f-53f1-4af3-8511-d44e3a7582e3", "value": "128000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "vhash", "timestamp": "1783090675", "to_ids": true, "type": "vhash", "uuid": "9039769a-f82f-4728-8395-e7650f75b1fb", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:45:40+00:00", "last_seen": "2026-06-11T05:45:40+00:00", "object_relation": "filename", "timestamp": "1783090675", "to_ids": true, "type": "filename", "uuid": "e1b4b668-0672-448f-a973-01837ea1d9ae", "value": "Purchase Order.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097608", "uuid": "a99fe8fb-048b-4265-aca0-5bed39d79fc9", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of ee4f710c68bc2214febeb0127ccb5e111e1a4d01f6d4503efd22a88fb1464606", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "md5", "timestamp": "1783097608", "to_ids": true, "type": "md5", "uuid": "b07a0368-d425-434a-8f3c-880124fff87b", "value": "cd2a5eb1bf35cb53b20c75be741ac1f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of ee4f710c68bc2214febeb0127ccb5e111e1a4d01f6d4503efd22a88fb1464606", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "sha1", "timestamp": "1783096880", "to_ids": true, "type": "sha1", "uuid": "5e5ff00e-38ff-48f8-a505-86a83110ed66", "value": "b7cddd45bf477f1a2f8c4343f213454fe57f9b5f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of ee4f710c68bc2214febeb0127ccb5e111e1a4d01f6d4503efd22a88fb1464606", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "sha256", "timestamp": "1783096880", "to_ids": true, "type": "sha256", "uuid": "2fb6e1eb-97f6-43a8-a98a-1949caa23d88", "value": "ee4f710c68bc2214febeb0127ccb5e111e1a4d01f6d4503efd22a88fb1464606", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 30/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "text", "timestamp": "1783090698", "to_ids": false, "type": "text", "uuid": "c12b3fe2-e689-470f-a296-317b532d3cfb", "value": "IOC-description:MD5 of ee4f710c68bc2214febeb0127ccb5e111e1a4d01f6d4503efd22a88fb1464606\r\nType Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 36/74\nFirst Seen In The Wild: 2026-06-15T12:00:42+00:00\nFirst Submission: 2026-06-15T02:31:43+00:00\nLast Submission: 2026-06-17T01:09:41+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "creation-time", "timestamp": "1783090698", "to_ids": false, "type": "datetime", "uuid": "71e4e1f6-f6dc-41dd-9177-1f5843c429e0", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "ssdeep", "timestamp": "1783090698", "to_ids": true, "type": "ssdeep", "uuid": "5bd99963-f00f-436e-bd94-c42e49123f0f", "value": "6144:7Z+RwPONXoRjZ7SezmfDlavx+W/WGW3i9BxfQvUNNtnJQNrLE+gTzTpZBjdtEEQP:Yi9PQvUJ0E6TMgdv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090698", "to_ids": false, "type": "size-in-bytes", "uuid": "d9698a5f-8efa-4994-be8a-039fea77bd1d", "value": "424448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "vhash", "timestamp": "1783090698", "to_ids": true, "type": "vhash", "uuid": "11746269-0a3e-49ec-acf7-4380b5d54f9e", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:31:43+00:00", "last_seen": "2026-06-17T01:09:41+00:00", "object_relation": "filename", "timestamp": "1783090698", "to_ids": true, "type": "filename", "uuid": "59b5ce5e-4de6-44a4-afc7-bfd52b45f76c", "value": "Supplier Registration.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097630", "uuid": "0dcb992c-a80f-40a6-9ddb-17e91433c2dd", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of 256f595afb005303a693fe26a03f9fce6d47b225bfc2300e418f5f80a89089d2", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "md5", "timestamp": "1783097630", "to_ids": true, "type": "md5", "uuid": "48e46804-8a4b-4361-93e6-7eaef16b247b", "value": "d526c9bbc38129a8c81afeda08e9aaef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of 256f595afb005303a693fe26a03f9fce6d47b225bfc2300e418f5f80a89089d2", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "sha1", "timestamp": "1783096881", "to_ids": true, "type": "sha1", "uuid": "bff0b168-cd48-4e10-a90c-e1a8e3b999dc", "value": "f2dd12c3b7d04624433cc6811c6fbf20e3f84e2b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of 256f595afb005303a693fe26a03f9fce6d47b225bfc2300e418f5f80a89089d2", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "sha256", "timestamp": "1783096881", "to_ids": true, "type": "sha256", "uuid": "0098e7be-8f74-4fa8-8791-11d3a6f05aaf", "value": "256f595afb005303a693fe26a03f9fce6d47b225bfc2300e418f5f80a89089d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "text", "timestamp": "1783090719", "to_ids": false, "type": "text", "uuid": "76acfd8a-d952-47d6-8de8-a0e1b86e33c3", "value": "IOC-description:MD5 of 256f595afb005303a693fe26a03f9fce6d47b225bfc2300e418f5f80a89089d2\r\nType Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 34/75\nFirst Seen In The Wild: 2026-06-11T08:01:40+00:00\nFirst Submission: 2026-06-11T08:15:06+00:00\nLast Submission: 2026-06-15T00:33:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "creation-time", "timestamp": "1783090719", "to_ids": false, "type": "datetime", "uuid": "4c75e719-336c-4c27-8795-e60164535f82", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "ssdeep", "timestamp": "1783090719", "to_ids": true, "type": "ssdeep", "uuid": "92008f6c-9773-485a-83e2-07513e67f7be", "value": "1536:qKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhvq/ABILOSG85W7AwN35:qn1LZvTTZGzN6YZ5wWvq44rG8g7AwR5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090719", "to_ids": false, "type": "size-in-bytes", "uuid": "2966db97-6159-4521-89e5-a32ada4dc941", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "vhash", "timestamp": "1783090719", "to_ids": true, "type": "vhash", "uuid": "9856ef53-2b93-489e-bfa3-582080b509b1", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:15:06+00:00", "last_seen": "2026-06-15T00:33:20+00:00", "object_relation": "filename", "timestamp": "1783090719", "to_ids": true, "type": "filename", "uuid": "0cefc9b0-48d4-48d6-8e72-707f21393da5", "value": "\u7522\u54c1\u4f9b\u61c9\u5408\u7d04\u53ca\u63a1\u8cfc\u8a02\u55ae.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097651", "uuid": "31dd4931-0779-4d3d-8537-26b9b0e4bcdb", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "object_relation": "md5", "timestamp": "1783097651", "to_ids": true, "type": "md5", "uuid": "863918ff-4f9c-42ae-870b-5eb600f866c6", "value": "d924b7e4d3fc4bc02422057ebe87dcdd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "object_relation": "sha1", "timestamp": "1783096882", "to_ids": true, "type": "sha1", "uuid": "4ccf4662-a715-4f83-a91b-9a98111ca478", "value": "6c2f10ec18c34ea9ba423b19e6ccf228ecf47a31", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "object_relation": "sha256", "timestamp": "1783096882", "to_ids": true, "type": "sha256", "uuid": "87bbce1b-aaa7-4d86-92fd-66ceb28f1eb8", "value": "bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "object_relation": "text", "timestamp": "1783090740", "to_ids": false, "type": "text", "uuid": "9965373e-ee17-44e6-acfb-d2b8587fd5b8", "value": "IOC-description:MD5 of bb551faff31c0a2c073b8a8cde34b41b6aed6e3aa7ca190e4764fdbc037be2c3\r\nType Description: JavaScript\nMicrosoft: Trojan:Win32/Znyonm!rfn\nClamAV: None\nVT Total Detection: 22/75\nFirst Seen In The Wild: 2026-06-13T10:52:51+00:00\nFirst Submission: 2026-06-12T10:13:14+00:00\nLast Submission: 2026-06-12T12:21:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "object_relation": "ssdeep", "timestamp": "1783090740", "to_ids": true, "type": "ssdeep", "uuid": "77e0e6bb-c9fa-4365-a683-26bc02f1b4d9", "value": "96:vTpplO3lKphxD9lypq9aPrK48/jT1pxe3PRYIt27hkyLEQtDYexeDyArN8l8vAga:rpX6rmfE3b8gBTm2xuuWB0GuAiIKq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090740", "to_ids": false, "type": "size-in-bytes", "uuid": "bb0a81a2-4191-46b9-8c64-ce151633e454", "value": "25319" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "object_relation": "vhash", "timestamp": "1783090740", "to_ids": true, "type": "vhash", "uuid": "ebb6d1e9-973d-4698-a5d6-1081cd27b0d5", "value": "9f37ef6b2db6dd0fb2704c1801d2d37d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T10:13:14+00:00", "last_seen": "2026-06-12T12:21:07+00:00", "object_relation": "filename", "timestamp": "1783090740", "to_ids": true, "type": "filename", "uuid": "868879e0-1fa0-4ba7-9c98-e8b7d14aa3c6", "value": "givenmebreakwithbestthingsgood.hta" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T03:14:52+00:00", "last_seen": "2026-06-15T03:14:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097672", "uuid": "5309d8a0-2d88-41cf-b913-bca0d161b441", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of c63b921b71be21eb964f085fa9d39dd720b183174ad40ec195b09b62f5ad2581", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T03:14:52+00:00", "last_seen": "2026-06-15T03:14:52+00:00", "object_relation": "md5", "timestamp": "1783097672", "to_ids": true, "type": "md5", "uuid": "3a1967da-fbd8-492c-b09d-4af8de87754a", "value": "f37382f028b294ec539f16b74af6a565", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of c63b921b71be21eb964f085fa9d39dd720b183174ad40ec195b09b62f5ad2581", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T03:14:52+00:00", "last_seen": "2026-06-15T03:14:52+00:00", "object_relation": "sha1", "timestamp": "1783096883", "to_ids": true, "type": "sha1", "uuid": "c202a4db-cfd6-40e8-b8a2-caf4b5440275", "value": "eb4866afa868cfa18cb49a3bd62a7019358288d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of c63b921b71be21eb964f085fa9d39dd720b183174ad40ec195b09b62f5ad2581", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T03:14:52+00:00", "last_seen": "2026-06-15T03:14:52+00:00", "object_relation": "sha256", "timestamp": "1783096883", "to_ids": true, "type": "sha256", "uuid": "2f1cbbfa-81c4-44f2-a304-d5a075173a35", "value": "c63b921b71be21eb964f085fa9d39dd720b183174ad40ec195b09b62f5ad2581", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 17/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T03:14:52+00:00", "last_seen": "2026-06-15T03:14:52+00:00", "object_relation": "text", "timestamp": "1783090763", "to_ids": false, "type": "text", "uuid": "05f2c489-b8e9-4aa4-a1cb-10907112142d", "value": "IOC-description:MD5 of c63b921b71be21eb964f085fa9d39dd720b183174ad40ec195b09b62f5ad2581\r\nType Description: JavaScript\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 24/74\nFirst Seen In The Wild: 2026-06-15T05:15:19+00:00\nFirst Submission: 2026-06-15T03:14:52+00:00\nLast Submission: 2026-06-15T03:14:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T03:14:52+00:00", "last_seen": "2026-06-15T03:14:52+00:00", "object_relation": "ssdeep", "timestamp": "1783090763", "to_ids": true, "type": "ssdeep", "uuid": "124fddb4-ec85-4a1f-af1b-972bb0bf0487", "value": "768:592bkjNzW2+KnJW16nXgm295twFlvcFlv0/gV+d+X:5csZrnJW1eg9bqlvGlv0qs+X" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T03:14:52+00:00", "last_seen": "2026-06-15T03:14:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090763", "to_ids": false, "type": "size-in-bytes", "uuid": "5f3756c4-cb1e-4558-b5e3-faa1ab77df73", "value": "28404" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T03:14:52+00:00", "last_seen": "2026-06-15T03:14:52+00:00", "object_relation": "filename", "timestamp": "1783090763", "to_ids": true, "type": "filename", "uuid": "7547ec24-9639-420e-b9c6-9df804688709", "value": "sleestak_payload_1.hta" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-30T04:09:25+00:00", "last_seen": "2026-05-08T11:08:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097694", "uuid": "6bc2b8ee-9fc1-4e0f-9bd4-ec46e1b2bb68", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T04:09:25+00:00", "last_seen": "2026-05-08T11:08:28+00:00", "object_relation": "md5", "timestamp": "1783097694", "to_ids": true, "type": "md5", "uuid": "05a44632-73c8-4602-986a-ed6413c85ee8", "value": "b12f3f0d185e87f1fb1ac24f5d17e755", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T04:09:25+00:00", "last_seen": "2026-05-08T11:08:28+00:00", "object_relation": "sha1", "timestamp": "1783096884", "to_ids": true, "type": "sha1", "uuid": "1b7b1ed2-d8f3-4453-9ae6-b83e346df883", "value": "6338c8183507bb0251284757144e0b72840ae870", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T04:09:25+00:00", "last_seen": "2026-05-08T11:08:28+00:00", "object_relation": "sha256", "timestamp": "1783096884", "to_ids": true, "type": "sha256", "uuid": "22d160f5-5ffc-48b8-95c1-0ed1b932c658", "value": "0081bb2de5a6599ee14cba1d0df8ff7dd63fe8b070cd18dd7b11c2adfa5e7876", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T04:09:25+00:00", "last_seen": "2026-05-08T11:08:28+00:00", "object_relation": "text", "timestamp": "1783090784", "to_ids": false, "type": "text", "uuid": "48374d09-49ad-4c10-8d52-5d6fd3bbe82b", "value": "Type Description: PNG\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-04-30T04:09:25+00:00\nLast Submission: 2026-05-08T11:08:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T04:09:25+00:00", "last_seen": "2026-05-08T11:08:28+00:00", "object_relation": "ssdeep", "timestamp": "1783090784", "to_ids": true, "type": "ssdeep", "uuid": "6c8cd6d7-6a3f-4b49-9fa2-ae53bf9dc115", "value": "384:okZshvMp0dQ4NWsxX23xE61AM0rr18+PAdVEGlngRA0UypWZkODxsvBjJqq9V/t8:JINnF23xE63G2rdVxlndwWZkAxs5lqSU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T04:09:25+00:00", "last_seen": "2026-05-08T11:08:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090784", "to_ids": false, "type": "size-in-bytes", "uuid": "87f109f1-b5f7-4097-96fd-9a15138093e7", "value": "20509" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T04:09:25+00:00", "last_seen": "2026-05-08T11:08:28+00:00", "object_relation": "filename", "timestamp": "1783090784", "to_ids": true, "type": "filename", "uuid": "c6b6f2bf-a496-4711-8de9-e54553a29b56", "value": "0d9c6e50632c7db694a6a439d547a806.png" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T18:19:32+00:00", "last_seen": "2026-06-14T11:50:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097715", "uuid": "1c654ba7-9381-4dab-b40b-2e4efa424a8a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T18:19:32+00:00", "last_seen": "2026-06-14T11:50:37+00:00", "object_relation": "md5", "timestamp": "1783097715", "to_ids": true, "type": "md5", "uuid": "dcb74d4f-afec-4968-baf1-324a7669517e", "value": "026e6e27fe574cd05c83c82610046ba2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T18:19:32+00:00", "last_seen": "2026-06-14T11:50:37+00:00", "object_relation": "sha1", "timestamp": "1783096885", "to_ids": true, "type": "sha1", "uuid": "92545b3b-1579-4f30-9ffa-a03d9060bb32", "value": "4ca48fb14e6f26d617c77d219ae5529935bb4893", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T18:19:32+00:00", "last_seen": "2026-06-14T11:50:37+00:00", "object_relation": "sha256", "timestamp": "1783096885", "to_ids": true, "type": "sha256", "uuid": "e4523467-1122-410e-9a31-c726b1266f0e", "value": "0542b57b67b021f877969c900214362d62eb2ba56d0645ab4e62838c8c79733a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T18:19:32+00:00", "last_seen": "2026-06-14T11:50:37+00:00", "object_relation": "text", "timestamp": "1783090806", "to_ids": false, "type": "text", "uuid": "585382e5-4b7e-4169-a12e-edaef86ebe89", "value": "Type Description: JavaScript\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 23/75\nFirst Seen In The Wild: 2026-06-13T12:51:48+00:00\nFirst Submission: 2026-06-12T18:19:32+00:00\nLast Submission: 2026-06-14T11:50:37+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T18:19:32+00:00", "last_seen": "2026-06-14T11:50:37+00:00", "object_relation": "ssdeep", "timestamp": "1783090806", "to_ids": true, "type": "ssdeep", "uuid": "6315ed7a-4975-44b2-93b4-eeac9c2aac2c", "value": "768:tWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW+:ulGeNXpeVugCCostPqaWriNU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T18:19:32+00:00", "last_seen": "2026-06-14T11:50:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090806", "to_ids": false, "type": "size-in-bytes", "uuid": "686820d8-7cdf-4839-a8c0-d3351f182d43", "value": "25599" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T18:19:32+00:00", "last_seen": "2026-06-14T11:50:37+00:00", "object_relation": "filename", "timestamp": "1783090806", "to_ids": true, "type": "filename", "uuid": "9d5fb8c1-30e8-4c11-9ba0-96ef13080bc0", "value": "goodthingswithbetterworldcoming.htA" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T05:07:42+00:00", "last_seen": "2026-06-12T05:07:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097736", "uuid": "4028d10a-c4cf-4ca6-9406-15d3612e4a69", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T05:07:42+00:00", "last_seen": "2026-06-12T05:07:42+00:00", "object_relation": "md5", "timestamp": "1783097736", "to_ids": true, "type": "md5", "uuid": "625a7190-bcf9-4922-9fe7-cf5a77d9dd94", "value": "b822295eacf49a14fbcc08387b77307c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T05:07:42+00:00", "last_seen": "2026-06-12T05:07:42+00:00", "object_relation": "sha1", "timestamp": "1783096887", "to_ids": true, "type": "sha1", "uuid": "a706a0bc-6b67-478a-8076-ec8295649722", "value": "a56a5d0099f762241a151f5793e5b3a8c35d01e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T05:07:42+00:00", "last_seen": "2026-06-12T05:07:42+00:00", "object_relation": "sha256", "timestamp": "1783096887", "to_ids": true, "type": "sha256", "uuid": "9e6cd9a8-9671-4fc2-bebf-6d11a18e847b", "value": "0e1a306ac4b6770dbc8cb194021a9f32e9a726478db2e39084d4baa892c69521", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T05:07:42+00:00", "last_seen": "2026-06-12T05:07:42+00:00", "object_relation": "text", "timestamp": "1783090828", "to_ids": false, "type": "text", "uuid": "b982475c-fee2-4f99-bee4-77ae75d20895", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-06-12T05:07:42+00:00\nLast Submission: 2026-06-12T05:07:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T05:07:42+00:00", "last_seen": "2026-06-12T05:07:42+00:00", "object_relation": "ssdeep", "timestamp": "1783090828", "to_ids": true, "type": "ssdeep", "uuid": "2905f00d-ad3a-4421-b938-5e9918defbf8", "value": "3072:3LO83KYHXo6PpU6RCy/pvtMVpqgu4UIvqEouC+h0EPZOwSoMJ3ifknTSOG:38Y3jRU6//pvtMVruwsVEIwSoa3iUSD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T05:07:42+00:00", "last_seen": "2026-06-12T05:07:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090828", "to_ids": false, "type": "size-in-bytes", "uuid": "e940717c-224c-45b6-b0e9-e715f816ad3c", "value": "186720" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T05:07:42+00:00", "last_seen": "2026-06-12T05:07:42+00:00", "object_relation": "filename", "timestamp": "1783090828", "to_ids": true, "type": "filename", "uuid": "94bcc69a-b0d3-423d-b19b-e7cd10cce479", "value": "169335.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-14T14:38:44+00:00", "last_seen": "2026-06-14T14:38:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097757", "uuid": "abe8dddf-f459-4777-b34e-a6e953abcbec", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T14:38:44+00:00", "last_seen": "2026-06-14T14:38:44+00:00", "object_relation": "md5", "timestamp": "1783097757", "to_ids": true, "type": "md5", "uuid": "4ac3dbc6-e1f1-4da5-886d-302600479862", "value": "3b75b95f58755fbbf217138c894c13eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T14:38:44+00:00", "last_seen": "2026-06-14T14:38:44+00:00", "object_relation": "sha1", "timestamp": "1783096888", "to_ids": true, "type": "sha1", "uuid": "0ef6580e-776c-44ca-a80b-cec220f49fac", "value": "ceb494dbc821c32c790efa28c6246d8d9de27a0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T14:38:44+00:00", "last_seen": "2026-06-14T14:38:44+00:00", "object_relation": "sha256", "timestamp": "1783096888", "to_ids": true, "type": "sha256", "uuid": "407c7f53-c42e-4bec-a6d8-3e41053450a8", "value": "0f2aa62136bee5996123b88a8a5216ad3822252ddb110c5e66728bd49ec270de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-14T14:38:44+00:00", "last_seen": "2026-06-14T14:38:44+00:00", "object_relation": "text", "timestamp": "1783090850", "to_ids": false, "type": "text", "uuid": "de6bf91a-1b53-4d86-950b-ccc5c83c3a2f", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-06-14T14:38:44+00:00\nLast Submission: 2026-06-14T14:38:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T14:38:44+00:00", "last_seen": "2026-06-14T14:38:44+00:00", "object_relation": "ssdeep", "timestamp": "1783090850", "to_ids": true, "type": "ssdeep", "uuid": "f05bcd4a-3e4e-433e-aa30-c0f2c926ba16", "value": "6144:/ImcI7C/iDe++P2bPpnJAh5uEADom/troCn8k4PHYh6e2PxsfHMhO59vvue6D4y:wmcI7C/iDe++P2bPpnJAh5u8m/JoDk4N" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-14T14:38:44+00:00", "last_seen": "2026-06-14T14:38:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090850", "to_ids": false, "type": "size-in-bytes", "uuid": "09ba11e4-770d-4ab9-9315-77de6b72bc92", "value": "220353" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-14T14:38:44+00:00", "last_seen": "2026-06-14T14:38:44+00:00", "object_relation": "filename", "timestamp": "1783090850", "to_ids": true, "type": "filename", "uuid": "8daead3b-7927-4184-8e94-03229ef31fdb", "value": "Request for Product Information.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097778", "uuid": "0387a245-e587-4797-8d43-811acdf0735e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "md5", "timestamp": "1783097778", "to_ids": true, "type": "md5", "uuid": "4bafec17-289e-4ffb-b728-87a394da56d5", "value": "95ef1b37905f4347cfbdbe6f7b6240d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "sha1", "timestamp": "1783096890", "to_ids": true, "type": "sha1", "uuid": "4740a8e9-bdd1-4a50-b912-980f112eb5d0", "value": "dd961b536a2a91a92c7ee16e1cf1c1b46bad3047", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "sha256", "timestamp": "1783096890", "to_ids": true, "type": "sha256", "uuid": "f9ad948b-6ea9-44ba-87b1-947587ccc81a", "value": "1982710eb67791c9c5ac55e13abad0c24d0210c1383eedbda20855944bfe75bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "text", "timestamp": "1783090871", "to_ids": false, "type": "text", "uuid": "b416598b-451c-412f-b6a5-f3af8c82ca24", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 33/75\nFirst Submission: 2026-06-11T08:07:34+00:00\nLast Submission: 2026-06-12T01:20:29+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "creation-time", "timestamp": "1783090871", "to_ids": false, "type": "datetime", "uuid": "3ac3a6dc-8720-4028-a95b-00abc35931df", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "ssdeep", "timestamp": "1783090871", "to_ids": true, "type": "ssdeep", "uuid": "68450c6b-18ff-4f42-85a9-af5463456968", "value": "3072:Xn1LZvTTZGzN6YZ5wWTB5J5eRV+Ca+Hz:lLFZsNjvwW1rE/+wH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090871", "to_ids": false, "type": "size-in-bytes", "uuid": "f2609e89-0f4e-4791-a26c-d389e57431c6", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "vhash", "timestamp": "1783090871", "to_ids": true, "type": "vhash", "uuid": "101e0f52-45a4-4f5f-9da7-deb78cc3ce3e", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:07:34+00:00", "last_seen": "2026-06-12T01:20:29+00:00", "object_relation": "filename", "timestamp": "1783090871", "to_ids": true, "type": "filename", "uuid": "b926e64c-70d8-4435-bd10-368fa962b87b", "value": "RFQ_Documents_Specifications_Quotation.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T08:56:38+00:00", "last_seen": "2026-06-12T08:56:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097800", "uuid": "25b3fc92-2687-493d-b510-34d8dfd0d7b1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T08:56:38+00:00", "last_seen": "2026-06-12T08:56:38+00:00", "object_relation": "md5", "timestamp": "1783097800", "to_ids": true, "type": "md5", "uuid": "7dc23c5e-0f7d-499c-a727-43ed35a41a96", "value": "e635b8cd245afcaf8069173508b49fae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T08:56:38+00:00", "last_seen": "2026-06-12T08:56:38+00:00", "object_relation": "sha1", "timestamp": "1783096891", "to_ids": true, "type": "sha1", "uuid": "a891a29f-0b2c-47e6-93c4-d6b33237c66c", "value": "8c6138efca30018a04c8be2bf9868b62dd6f806e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T08:56:38+00:00", "last_seen": "2026-06-12T08:56:38+00:00", "object_relation": "sha256", "timestamp": "1783096891", "to_ids": true, "type": "sha256", "uuid": "40206d6f-8528-4340-81d7-85715b819450", "value": "1fcaa6fc864faa3b0964accf30c562fc4e9192e530c5c5bbcb5ee03fdfc46163", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T08:56:38+00:00", "last_seen": "2026-06-12T08:56:38+00:00", "object_relation": "text", "timestamp": "1783090893", "to_ids": false, "type": "text", "uuid": "fe01f725-af65-47d9-a38f-9b59798117d5", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-06-12T08:56:38+00:00\nLast Submission: 2026-06-12T08:56:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T08:56:38+00:00", "last_seen": "2026-06-12T08:56:38+00:00", "object_relation": "ssdeep", "timestamp": "1783090893", "to_ids": true, "type": "ssdeep", "uuid": "b0f66bb9-ee4a-4039-a902-a6a31b3a6b79", "value": "6144:/Omcb7C/iDe++P2bPpnJAh5udADom/troCn8k4PHYh6e2PxsfHMhO59vvue6D4b:2mcb7C/iDe++P2bPpnJAh5uLm/JoDk4I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T08:56:38+00:00", "last_seen": "2026-06-12T08:56:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090893", "to_ids": false, "type": "size-in-bytes", "uuid": "e68466eb-bc67-4039-8395-39933c62e6db", "value": "220933" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T08:56:38+00:00", "last_seen": "2026-06-12T08:56:38+00:00", "object_relation": "filename", "timestamp": "1783090893", "to_ids": true, "type": "filename", "uuid": "6d2690a3-0aed-4368-9ac2-7a1a9345911e", "value": "Detected_File_8C6138EFCA30018A04C8BE2BF9868B62DD6F806E_20260611093419+0200" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097822", "uuid": "25c20863-c05c-43bc-8445-007af2749577", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "md5", "timestamp": "1783097822", "to_ids": true, "type": "md5", "uuid": "ecbd5449-e3b7-49a1-80dc-435563e14575", "value": "e97004dfe70296fbdbcbf8fae26ed0d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "sha1", "timestamp": "1783096892", "to_ids": true, "type": "sha1", "uuid": "8a040c3e-9569-49c9-8be6-06254682077f", "value": "171d2c6d5e55558aa70cf651b1620a6406463be6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "sha256", "timestamp": "1783096892", "to_ids": true, "type": "sha256", "uuid": "884a1c2c-dcca-4f89-9cd0-fd708548ad3e", "value": "2d17adbea1ddca7e827c8e4b46d2ea7cb9e693aff07271e5fcb24765e8385afa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "text", "timestamp": "1783090914", "to_ids": false, "type": "text", "uuid": "6476a069-30f4-4fee-aa44-9d2cbce668db", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 35/75\nFirst Seen In The Wild: 2026-06-11T12:00:41+00:00\nFirst Submission: 2026-06-11T05:49:26+00:00\nLast Submission: 2026-06-13T10:46:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "creation-time", "timestamp": "1783090914", "to_ids": false, "type": "datetime", "uuid": "18a64b67-b8ce-4f2e-a7de-d68aa17d8817", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "ssdeep", "timestamp": "1783090914", "to_ids": true, "type": "ssdeep", "uuid": "26fd7c6d-7695-41a2-a4de-3005612ee3a0", "value": "3072:in1LZvTTZGzN6YZ5wW4UYjArK237Py0dh:yLFZsNjvwWs2L3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090914", "to_ids": false, "type": "size-in-bytes", "uuid": "4bc42d62-c1c4-4793-ad5e-6a64c20123d8", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "vhash", "timestamp": "1783090914", "to_ids": true, "type": "vhash", "uuid": "e1981ce0-cef1-4ece-bb6e-a0867a5e3df3", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:49:26+00:00", "last_seen": "2026-06-13T10:46:36+00:00", "object_relation": "filename", "timestamp": "1783090914", "to_ids": true, "type": "filename", "uuid": "7be242f5-c87d-44a4-8a9a-f69acdf29be0", "value": "3574296.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T06:04:15+00:00", "last_seen": "2026-06-15T06:04:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097843", "uuid": "1ad76baf-478d-4366-860e-de4235451eb4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:04:15+00:00", "last_seen": "2026-06-15T06:04:15+00:00", "object_relation": "md5", "timestamp": "1783097843", "to_ids": true, "type": "md5", "uuid": "11169728-3304-4796-bc70-362374aed10f", "value": "69a4218c851df4df381c2ababf84db09", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:04:15+00:00", "last_seen": "2026-06-15T06:04:15+00:00", "object_relation": "sha1", "timestamp": "1783096893", "to_ids": true, "type": "sha1", "uuid": "beb1bb23-dabd-4f5b-bcef-b7cf8016cf14", "value": "c24f1b83895edac5c3fdf70c30054f4e62203dcf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:04:15+00:00", "last_seen": "2026-06-15T06:04:15+00:00", "object_relation": "sha256", "timestamp": "1783096893", "to_ids": true, "type": "sha256", "uuid": "b665a9b4-6536-4293-996e-8375003156cf", "value": "33ad6106da73526090d6a798951015b199fc4634b1a0ee611ca16ff32330eb06", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:04:15+00:00", "last_seen": "2026-06-15T06:04:15+00:00", "object_relation": "text", "timestamp": "1783090936", "to_ids": false, "type": "text", "uuid": "3f684d03-0560-4284-9e00-03e9e184bbfd", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Znyonm!rfn\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-06-15T06:04:15+00:00\nLast Submission: 2026-06-15T06:04:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:04:15+00:00", "last_seen": "2026-06-15T06:04:15+00:00", "object_relation": "ssdeep", "timestamp": "1783090936", "to_ids": true, "type": "ssdeep", "uuid": "6f4897db-695f-47b2-98ba-be0d1a02cd02", "value": "3072:qolBH9zwFx+0VRbJrYsAK619Dl/7emHxYcoMp6aRFC:qoD9C/9S1z7emHJoMbQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:04:15+00:00", "last_seen": "2026-06-15T06:04:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090936", "to_ids": false, "type": "size-in-bytes", "uuid": "9972edcc-8df5-4127-9486-d8c05a6b0db6", "value": "149439" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:04:15+00:00", "last_seen": "2026-06-15T06:04:15+00:00", "object_relation": "filename", "timestamp": "1783090936", "to_ids": true, "type": "filename", "uuid": "3788a78a-7bba-4583-a8fc-3edfbdb3031c", "value": "2026_06_15-08_04_14_vt_msmx_submission.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097864", "uuid": "f2bc25c2-163e-495f-b095-380df59492ee", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "object_relation": "md5", "timestamp": "1783097864", "to_ids": true, "type": "md5", "uuid": "2f6acd6f-4741-4ca6-8546-f264964dde4c", "value": "104b9893f29595e4b081a3f8a27dd21a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "object_relation": "sha1", "timestamp": "1783096895", "to_ids": true, "type": "sha1", "uuid": "90b85f9f-cab5-4bdb-b055-2cde4e873ac0", "value": "0e014fc4ea49ac29fff44be11e8a0f1b5345dccd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "object_relation": "sha256", "timestamp": "1783096895", "to_ids": true, "type": "sha256", "uuid": "7ad58397-6ac4-45e5-bdc7-372829875053", "value": "38511e5189d3303d7258d3c889a61f56c5000fe4c91fbaedffc4271f6123038b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 17/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "object_relation": "text", "timestamp": "1783090957", "to_ids": false, "type": "text", "uuid": "754eb1e2-1762-40f9-a568-c0a63805dd7d", "value": "Type Description: Outlook\nMicrosoft: Trojan:Win32/Znyonm!rfn\nClamAV: None\nVT Total Detection: 29/75\nFirst Submission: 2026-06-15T07:20:49+00:00\nLast Submission: 2026-06-15T07:20:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "object_relation": "ssdeep", "timestamp": "1783090957", "to_ids": true, "type": "ssdeep", "uuid": "b145956a-0b7f-4730-941e-9a9a764a4832", "value": "1536:8bTradXwye3OAZ57UxWrXZhAojrJ3rpLxupS1Xb4VCE1x:S/aCOAzAxWrQ89p0pSG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090957", "to_ids": false, "type": "size-in-bytes", "uuid": "b2767eb8-ed82-4d93-869e-f65d1d33409d", "value": "119296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "object_relation": "vhash", "timestamp": "1783090957", "to_ids": true, "type": "vhash", "uuid": "80a985d5-cc65-47e3-87be-3900ac8a6570", "value": "fe43cc098163d8fb4f1b2b088de0949b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T07:20:49+00:00", "last_seen": "2026-06-15T07:20:49+00:00", "object_relation": "filename", "timestamp": "1783090957", "to_ids": true, "type": "filename", "uuid": "d198b2d1-daa9-435a-9aff-2db5670437b4", "value": "MPCC Purchase Order MPO-51820 to Worldwidecables Corporation.msg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097886", "uuid": "267dda1e-5745-4e1d-afb3-b36dabac232a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "object_relation": "md5", "timestamp": "1783097886", "to_ids": true, "type": "md5", "uuid": "ddf7cb08-02c8-492e-a195-faf257a8536b", "value": "20f6e8adc7d99f19320038714135ec57", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "object_relation": "sha1", "timestamp": "1783096896", "to_ids": true, "type": "sha1", "uuid": "950a6391-f923-41f6-8294-387dcb2d7251", "value": "54ef0bfea0f0a6fdbbef886d69192b61cc5ec8c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "object_relation": "sha256", "timestamp": "1783096896", "to_ids": true, "type": "sha256", "uuid": "924e3820-b84c-4610-b920-7610ad3b09c6", "value": "3892bcd10df0a5fdf2045f78609d073b89e0ef0ee88b88be6a9e308441a8c52c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "object_relation": "text", "timestamp": "1783090978", "to_ids": false, "type": "text", "uuid": "6fa7385b-1691-45bd-bd84-f5a834ddca0a", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 32/75\nFirst Submission: 2026-06-12T13:15:21+00:00\nLast Submission: 2026-06-12T13:15:21+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "object_relation": "creation-time", "timestamp": "1783090979", "to_ids": false, "type": "datetime", "uuid": "1fe025d2-588a-4d3b-9206-78f19a397b81", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "object_relation": "ssdeep", "timestamp": "1783090978", "to_ids": true, "type": "ssdeep", "uuid": "d6da7c1a-0c13-40f3-ac01-8555667e2a39", "value": "12288:Q4FRRUHEnAetc36cacUFN2dOBG0ix8aVHFxoaEO8PMqbSLH4KKDOsF+VKRDhd4xE:iExtcqtCdT0i6IlxQO80q2LH76DhsE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1783090978", "to_ids": false, "type": "size-in-bytes", "uuid": "b553541f-f4b3-4e25-bed8-8e832491cbc0", "value": "867840" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T13:15:21+00:00", "last_seen": "2026-06-12T13:15:21+00:00", "object_relation": "vhash", "timestamp": "1783090978", "to_ids": true, "type": "vhash", "uuid": "72b630cb-c053-4e8d-b101-80de2b9f4f9b", "value": "13c58281c7aa6f14ba8de31ef84a79f7" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097907", "uuid": "0bcc544f-c735-47b2-93af-4d2ed6a6ff87", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "md5", "timestamp": "1783097907", "to_ids": true, "type": "md5", "uuid": "0628bfad-61e7-4ee7-b4dc-a7371740b8ba", "value": "493fcadf94f62530b657c270c5704275", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "sha1", "timestamp": "1783096897", "to_ids": true, "type": "sha1", "uuid": "77d9f098-3d30-4151-8422-dcda9998c42d", "value": "07317be5c071a8f7a11fabd7b95475e219f8ed87", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "sha256", "timestamp": "1783096897", "to_ids": true, "type": "sha256", "uuid": "c342f021-70bf-41d2-b95c-04c40d641e8c", "value": "3d8e5092a9852b61d8d45bd3c7e2d99907fcaa9a8fd3fe3b9efcbc9255947606", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "text", "timestamp": "1783091000", "to_ids": false, "type": "text", "uuid": "d43258ff-683f-49ab-a7ee-cd1896678918", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 33/75\nFirst Seen In The Wild: 2026-06-12T04:00:38+00:00\nFirst Submission: 2026-06-12T00:46:47+00:00\nLast Submission: 2026-06-12T18:22:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "creation-time", "timestamp": "1783091000", "to_ids": false, "type": "datetime", "uuid": "097d7fea-7f2f-47e5-a35b-77da9ddf916b", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "ssdeep", "timestamp": "1783091000", "to_ids": true, "type": "ssdeep", "uuid": "ea923231-3ea2-443b-8277-dc2327e3544d", "value": "1536:qKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhMT5pd8UOZI6aOT6LLCZ:qn1LZvTTZGzN6YZ5wWMT5gU0IM6L2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091000", "to_ids": false, "type": "size-in-bytes", "uuid": "85324926-6df0-43de-b957-0df504b78eb4", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "vhash", "timestamp": "1783091000", "to_ids": true, "type": "vhash", "uuid": "497fcf38-5c9e-471f-a0e0-0697dd801608", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T00:46:47+00:00", "last_seen": "2026-06-12T18:22:43+00:00", "object_relation": "filename", "timestamp": "1783091000", "to_ids": true, "type": "filename", "uuid": "f9693a0c-bc66-434f-be26-10db444d0080", "value": "Especificaciones de la solicitud de cotizaci\u00f3n.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T06:43:29+00:00", "last_seen": "2026-06-15T06:43:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097928", "uuid": "12b18e4f-182e-4df4-88d4-767f81ad8832", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:43:29+00:00", "last_seen": "2026-06-15T06:43:29+00:00", "object_relation": "md5", "timestamp": "1783097928", "to_ids": true, "type": "md5", "uuid": "bb77e509-0f38-4321-8896-39f3153c1c13", "value": "2bfc2a7b1cb9e079cebbb1700f713d34", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:43:29+00:00", "last_seen": "2026-06-15T06:43:29+00:00", "object_relation": "sha1", "timestamp": "1783096899", "to_ids": true, "type": "sha1", "uuid": "0b1a5a7b-e22a-4850-ac9f-ee46d8c48481", "value": "366497f09488bc6c4df8010cc12f519b2165cdcc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:43:29+00:00", "last_seen": "2026-06-15T06:43:29+00:00", "object_relation": "sha256", "timestamp": "1783096899", "to_ids": true, "type": "sha256", "uuid": "6aaa90a7-3bee-4610-85be-95c31afb4fdc", "value": "424d69145e60635da0d069aef4f2233db3468c557f01286af8e59e6aa8e5cd60", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:43:29+00:00", "last_seen": "2026-06-15T06:43:29+00:00", "object_relation": "text", "timestamp": "1783091021", "to_ids": false, "type": "text", "uuid": "d7ddb1f3-6109-465a-9836-75d8fe2f4a35", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-06-15T06:43:29+00:00\nLast Submission: 2026-06-15T06:43:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:43:29+00:00", "last_seen": "2026-06-15T06:43:29+00:00", "object_relation": "ssdeep", "timestamp": "1783091021", "to_ids": true, "type": "ssdeep", "uuid": "6a407c24-9e51-40ee-86c8-0acc318f4a4a", "value": "12288:QmwJHY4boXuvAsZLHMhXxm5zQAmwJHY4b3vDStzBcVpSo3lm:XwJ3bU10QXxm58HwJ3b7AzBcVrm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:43:29+00:00", "last_seen": "2026-06-15T06:43:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091021", "to_ids": false, "type": "size-in-bytes", "uuid": "d19dfc14-ccd4-4b72-9785-4c2cae47a88e", "value": "1186655" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:43:29+00:00", "last_seen": "2026-06-15T06:43:29+00:00", "object_relation": "filename", "timestamp": "1783091021", "to_ids": true, "type": "filename", "uuid": "775d6b3d-e403-4d03-9921-7e341eab6c66", "value": "RFQ - 1310074960 _ CYL.PN. 100X25X1010MM _ Maliha site - AjibaP (2026-06-15 13-22).eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097949", "uuid": "db597b8f-9cff-4442-a78a-0e5c26fee5ab", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "object_relation": "md5", "timestamp": "1783097949", "to_ids": true, "type": "md5", "uuid": "1de00e56-9635-4e97-b3be-8e50d148586c", "value": "7289a3617d351d244c91c67bba0137c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "object_relation": "sha1", "timestamp": "1783096900", "to_ids": true, "type": "sha1", "uuid": "d11093fd-384a-41fe-b2a6-09c42e9f577b", "value": "0b2e2360d4c0816d20da2b3441daf426548dee1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "object_relation": "sha256", "timestamp": "1783096900", "to_ids": true, "type": "sha256", "uuid": "632d6086-e940-4105-9731-05d626f4c088", "value": "4f12ec57cca013dce1a5bcaf11ddf5d85fc2ecbc52afb9e61e4154d1be2d9ef3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 13/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "object_relation": "text", "timestamp": "1783091043", "to_ids": false, "type": "text", "uuid": "5967ce9a-e295-4dff-b7e6-6332cc3bbd7c", "value": "Type Description: Outlook\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 29/75\nFirst Submission: 2026-06-11T08:21:33+00:00\nLast Submission: 2026-06-11T08:21:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "object_relation": "ssdeep", "timestamp": "1783091043", "to_ids": true, "type": "ssdeep", "uuid": "9b4cd5e7-d6a6-4e22-bfe5-102f882a6f6c", "value": "6144:bOmAPcd6TytGiSbMu4Ibk6czLFZsNjvnyi6fRm3c:bOmAPcd6TytGiSbMu4Ibk6czLH4yiYm3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091043", "to_ids": false, "type": "size-in-bytes", "uuid": "46ea3f9e-2aac-4e8f-8d22-ce775f062c15", "value": "210432" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "object_relation": "vhash", "timestamp": "1783091043", "to_ids": true, "type": "vhash", "uuid": "76e8fca9-1a77-4886-a73d-ed48f158a61f", "value": "fe43cc098163d8fb4f1b2b088de0949b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:21:33+00:00", "last_seen": "2026-06-11T08:21:33+00:00", "object_relation": "filename", "timestamp": "1783091043", "to_ids": true, "type": "filename", "uuid": "5c7bb967-20da-4ba9-8c84-67c4988d1c66", "value": "Request for Product Information.msg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097970", "uuid": "7c06eefb-e44c-4b08-8a13-f02dfde9253e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "md5", "timestamp": "1783097970", "to_ids": true, "type": "md5", "uuid": "c006487b-e710-455e-b0a6-400864b6d6b1", "value": "5499d8a5eeea5e53042003a2454c5ac5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "sha1", "timestamp": "1783096902", "to_ids": true, "type": "sha1", "uuid": "0696bb96-e857-4663-b19b-982f25cd54ec", "value": "c9ef787d9bc238b68af4bf97c17fa44cf1858625", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "sha256", "timestamp": "1783096902", "to_ids": true, "type": "sha256", "uuid": "6277c4bf-1036-449a-b469-4135bbd7de32", "value": "5e2c7496aed4efc11ae17641a6421ed47fea92342811026595dcee4f487180fb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "text", "timestamp": "1783091065", "to_ids": false, "type": "text", "uuid": "2cb6d4f4-d3a6-4dc2-9807-1172691a1686", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 32/75\nFirst Submission: 2026-06-11T10:08:58+00:00\nLast Submission: 2026-06-12T18:50:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "creation-time", "timestamp": "1783091065", "to_ids": false, "type": "datetime", "uuid": "d14927a9-8f74-49ee-bd97-4cb3082be56f", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "ssdeep", "timestamp": "1783091065", "to_ids": true, "type": "ssdeep", "uuid": "b5c13a41-56a2-40de-a321-0cd4c59be83f", "value": "3072:sn1LZvTTZGzN6YZ5wW6R55SfzWyD/CZf:ULFZsNjvwWWjSf3DaZf" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091065", "to_ids": false, "type": "size-in-bytes", "uuid": "5c41923e-646a-4ff4-a732-602349151f80", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "vhash", "timestamp": "1783091065", "to_ids": true, "type": "vhash", "uuid": "4bf1507b-9f63-42f1-8a39-7c4962421131", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T10:08:58+00:00", "last_seen": "2026-06-12T18:50:42+00:00", "object_relation": "filename", "timestamp": "1783091065", "to_ids": true, "type": "filename", "uuid": "c4c8cc08-e399-4325-b030-75970020e1ec", "value": "Estado de Cuenta.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783097991", "uuid": "5aa94986-21f0-4517-9ded-775d171cbeca", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "md5", "timestamp": "1783097991", "to_ids": true, "type": "md5", "uuid": "1aa75ba1-b255-4ac0-b5a0-f047c18e6177", "value": "a60fffa65dfd98b94d6b9d6799e2bde9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "sha1", "timestamp": "1783096903", "to_ids": true, "type": "sha1", "uuid": "655b4475-0599-4768-b670-073dd33e5318", "value": "305f7b64e8c004dcff176887cd60f48a3bc052ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "sha256", "timestamp": "1783096903", "to_ids": true, "type": "sha256", "uuid": "c9ad61f3-3ecd-4f16-a51f-9face65f89fc", "value": "6e79ef38577cca732976732c38ee22f5f3102a7a4458da6edb708b4be5afb9b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 17/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "text", "timestamp": "1783091086", "to_ids": false, "type": "text", "uuid": "42b50b5e-61ac-4405-a9a0-0176fbcdca5f", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Znyonm!rfn\nClamAV: None\nVT Total Detection: 35/73\nFirst Seen In The Wild: 2026-06-15T08:00:36+00:00\nFirst Submission: 2026-06-15T02:04:28+00:00\nLast Submission: 2026-06-17T06:35:56+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "creation-time", "timestamp": "1783091086", "to_ids": false, "type": "datetime", "uuid": "ffc20176-8d6e-4d0d-af23-2a6fdc1c3ff2", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "ssdeep", "timestamp": "1783091086", "to_ids": true, "type": "ssdeep", "uuid": "4c10ef9e-85ed-4a1f-b02e-ccaec76cb273", "value": "1536:GOAZ57UxWrXZhAojrJ3rpLxupS1Xb4VCE1x:GOAzAxWrQ89p0pSG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091086", "to_ids": false, "type": "size-in-bytes", "uuid": "7cac37ae-8599-41f5-87bf-451dccb671cb", "value": "77824" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "vhash", "timestamp": "1783091086", "to_ids": true, "type": "vhash", "uuid": "4f9a94b0-64da-447e-8009-901b59ffafda", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T02:04:28+00:00", "last_seen": "2026-06-17T06:35:56+00:00", "object_relation": "filename", "timestamp": "1783091086", "to_ids": true, "type": "filename", "uuid": "e6a5914b-fb51-4941-89f9-7a330ac2a0ba", "value": "SINO5700192.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T08:24:14+00:00", "last_seen": "2026-06-11T08:24:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098012", "uuid": "6ac7bd8b-2681-4144-9540-39532c07f664", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:24:14+00:00", "last_seen": "2026-06-11T08:24:14+00:00", "object_relation": "md5", "timestamp": "1783098012", "to_ids": true, "type": "md5", "uuid": "93ee0898-f3a5-4338-9857-851dfd140d35", "value": "30985c3690112bfab62049216f9e5b6b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:24:14+00:00", "last_seen": "2026-06-11T08:24:14+00:00", "object_relation": "sha1", "timestamp": "1783096904", "to_ids": true, "type": "sha1", "uuid": "01ae16d8-fa9b-4fc6-87b3-a963557b36bb", "value": "9f19ac737e98779fedd6a004e631567570ab274d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:24:14+00:00", "last_seen": "2026-06-11T08:24:14+00:00", "object_relation": "sha256", "timestamp": "1783096904", "to_ids": true, "type": "sha256", "uuid": "89397cb4-18a0-400f-9246-9e016d3c1bec", "value": "7672fb55d63f3206cd694de6009288cc3d3aff7727233ca5a677072896308357", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:24:14+00:00", "last_seen": "2026-06-11T08:24:14+00:00", "object_relation": "text", "timestamp": "1783091108", "to_ids": false, "type": "text", "uuid": "7df09a14-e977-4446-af5e-ca2284974f18", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 30/74\nFirst Seen In The Wild: 2026-06-11T09:24:21+00:00\nFirst Submission: 2026-06-11T08:24:14+00:00\nLast Submission: 2026-06-11T08:24:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:24:14+00:00", "last_seen": "2026-06-11T08:24:14+00:00", "object_relation": "ssdeep", "timestamp": "1783091108", "to_ids": true, "type": "ssdeep", "uuid": "d677eac0-c8ca-4133-9843-9633dd87d80b", "value": "12288:bjROPm5oVOR61OBEK6BdbhDpHwHFR3bw0zxmmJcKCqejcYsmI:KOR6TFBpof0pKCqejcYsmI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:24:14+00:00", "last_seen": "2026-06-11T08:24:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091108", "to_ids": false, "type": "size-in-bytes", "uuid": "ab02bbc2-0095-47ca-a6a3-dfea001d6855", "value": "844422" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:24:14+00:00", "last_seen": "2026-06-11T08:24:14+00:00", "object_relation": "filename", "timestamp": "1783091108", "to_ids": true, "type": "filename", "uuid": "e3aa5b2c-46c9-40ae-8762-3bd3c0f2a270", "value": "Fwd THAI HIBEX POTHX22-1236.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098033", "uuid": "7842a1d1-a554-4907-aa59-16795cd4844c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "md5", "timestamp": "1783098033", "to_ids": true, "type": "md5", "uuid": "e324ce95-01ef-45aa-a825-cd0585db70ce", "value": "2637c0e967320a5351e9d28cad4841a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "sha1", "timestamp": "1783096905", "to_ids": true, "type": "sha1", "uuid": "18fd1dcd-ac7b-4eda-8995-1daff428d3a7", "value": "8290acfc509c55dca41c62aecca138a9a7d1e277", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "sha256", "timestamp": "1783096905", "to_ids": true, "type": "sha256", "uuid": "d1ac973d-5cb4-4a24-a3c9-6a8fecbd23a3", "value": "8bc10f6462ac27eee0c685b74ffdf0554bd08d20b457543688ee82a86fdae275", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "text", "timestamp": "1783091130", "to_ids": false, "type": "text", "uuid": "497947f0-4cdc-455d-9b88-6ceebbe3d617", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 31/75\nFirst Seen In The Wild: 2026-06-11T12:00:36+00:00\nFirst Submission: 2026-06-11T05:27:57+00:00\nLast Submission: 2026-06-16T10:46:40+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "creation-time", "timestamp": "1783091130", "to_ids": false, "type": "datetime", "uuid": "d3ed2f47-0ece-4104-a013-d9cd4efd9d08", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "ssdeep", "timestamp": "1783091130", "to_ids": true, "type": "ssdeep", "uuid": "ad8f0b59-67ee-4d58-bdab-03b0bb80b545", "value": "1536:OKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df54PPuoiiEDN5fuRVrYP/fZm/:On1LZvTTZGzN6YZ54PPyN5cYnfZi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091130", "to_ids": false, "type": "size-in-bytes", "uuid": "bf151b72-9a54-499a-a895-979d83b9bb9c", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "vhash", "timestamp": "1783091130", "to_ids": true, "type": "vhash", "uuid": "9ac25a7b-0a60-4377-b7c6-55e6192b6e9f", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:27:57+00:00", "last_seen": "2026-06-16T10:46:40+00:00", "object_relation": "filename", "timestamp": "1783091130", "to_ids": true, "type": "filename", "uuid": "7d092e2a-ebfe-4754-9d9d-196fb51b5b1c", "value": "Request for quotation no. 490526.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098054", "uuid": "a62516aa-b10d-47a3-881b-f783032cd9d5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "md5", "timestamp": "1783098054", "to_ids": true, "type": "md5", "uuid": "2f446c27-3dae-4312-a418-c19284844e53", "value": "19e573caca6d83e9d598b7e45f604fe7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "sha1", "timestamp": "1783096907", "to_ids": true, "type": "sha1", "uuid": "618ba623-b7db-477c-95e3-0ce6087fa85f", "value": "f49a886f12c0eb839c6461145ac431f0f0e0cfac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "sha256", "timestamp": "1783096907", "to_ids": true, "type": "sha256", "uuid": "59f20f19-611f-4995-b034-350910681dbf", "value": "975cf719a576788055ca2a6b7b44aaed36c27a8676ea8d50b25a9f935eaf9d79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 16/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "text", "timestamp": "1783091151", "to_ids": false, "type": "text", "uuid": "7f47933d-a415-46e2-b5f3-a1594f03a6d9", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 26/75\nFirst Submission: 2026-06-14T23:38:23+00:00\nLast Submission: 2026-06-14T23:38:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "creation-time", "timestamp": "1783091151", "to_ids": false, "type": "datetime", "uuid": "9079d08f-7242-482d-87e3-8e4753a06db1", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "ssdeep", "timestamp": "1783091151", "to_ids": true, "type": "ssdeep", "uuid": "43ab71e5-9870-4342-bd88-88b09748a2c4", "value": "1536:uKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAh7I5An9vr2XEjyRC5tHk:un1LZvTTZGzN6YZ5wW7I5A9K0YCL91w" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091151", "to_ids": false, "type": "size-in-bytes", "uuid": "0f841661-1ca4-4123-a8b7-3369d8f49edf", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "vhash", "timestamp": "1783091151", "to_ids": true, "type": "vhash", "uuid": "d60ae8b5-4316-4058-86ce-f73bcd962074", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-14T23:38:23+00:00", "last_seen": "2026-06-14T23:38:23+00:00", "object_relation": "filename", "timestamp": "1783091151", "to_ids": true, "type": "filename", "uuid": "2ed0fe41-c045-4747-b815-8c2ee89fea4c", "value": "19e573caca6d83e9d598b7e45f604fe7.file" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T08:58:16+00:00", "last_seen": "2026-07-03T06:48:35+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098076", "uuid": "2a432284-12c7-4f62-aff8-8bc2e338d31d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:58:16+00:00", "last_seen": "2026-07-03T06:48:35+00:00", "object_relation": "md5", "timestamp": "1783098076", "to_ids": true, "type": "md5", "uuid": "310b2567-b5ee-457d-bc7f-b262db0214bb", "value": "61c29fcf3fdbb3416c6b20341d4da2f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:58:16+00:00", "last_seen": "2026-07-03T06:48:35+00:00", "object_relation": "sha1", "timestamp": "1783096908", "to_ids": true, "type": "sha1", "uuid": "d96aa819-8432-4b14-9417-09495490c0a1", "value": "0e7b133a6d21b330e82dab8ac930807663c8b763", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:58:16+00:00", "last_seen": "2026-07-03T06:48:35+00:00", "object_relation": "sha256", "timestamp": "1783096908", "to_ids": true, "type": "sha256", "uuid": "e7f2e7e6-ca61-4589-810f-d2519fefa5a1", "value": "97e74ad16c88b4b07722b5ad42dba95d837b6bdb9fa1193615f42fb34af5684f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:58:16+00:00", "last_seen": "2026-07-03T06:48:35+00:00", "object_relation": "text", "timestamp": "1783091172", "to_ids": false, "type": "text", "uuid": "26fd6600-1891-4888-80ed-4b60564f8fe1", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-06-11T08:58:16+00:00\nLast Submission: 2026-07-03T06:48:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:58:16+00:00", "last_seen": "2026-07-03T06:48:35+00:00", "object_relation": "ssdeep", "timestamp": "1783091172", "to_ids": true, "type": "ssdeep", "uuid": "eaef6d16-fa69-4c31-aabb-dbc24236c237", "value": "6144:iBgADom/troCn8k4PHYh6e2PxsfHMhO59vvue6D4j:9m/JoDk4fYh6e2PxcsgR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:58:16+00:00", "last_seen": "2026-07-03T06:48:35+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091172", "to_ids": false, "type": "size-in-bytes", "uuid": "04845e7f-2645-4eda-ad9d-570891aad7fa", "value": "221869" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:58:16+00:00", "last_seen": "2026-07-03T06:48:35+00:00", "object_relation": "filename", "timestamp": "1783091172", "to_ids": true, "type": "filename", "uuid": "9beabcb1-4b2b-49d3-8521-5010584bd783", "value": "Temp[145].eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T08:58:33+00:00", "last_seen": "2026-06-12T08:58:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098097", "uuid": "4c3fc813-3f82-4c72-884e-52f13624fdec", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T08:58:33+00:00", "last_seen": "2026-06-12T08:58:33+00:00", "object_relation": "md5", "timestamp": "1783098097", "to_ids": true, "type": "md5", "uuid": "f820e11c-948a-4a92-812d-d3d3ac759742", "value": "614f1c1cca1c93718f92eaa42538c18b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T08:58:33+00:00", "last_seen": "2026-06-12T08:58:33+00:00", "object_relation": "sha1", "timestamp": "1783096909", "to_ids": true, "type": "sha1", "uuid": "cd7b42de-ca77-4733-941e-30ccfc55349e", "value": "0114917407dbab5aa12e0b3cb665a645b156a741", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T08:58:33+00:00", "last_seen": "2026-06-12T08:58:33+00:00", "object_relation": "sha256", "timestamp": "1783096909", "to_ids": true, "type": "sha256", "uuid": "8ddf643f-02e6-4b86-b678-2331687620d0", "value": "9a4475ff6a370c3d958e40739b729ebbfae179f369ba26f2d12816066e951a7f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T08:58:33+00:00", "last_seen": "2026-06-12T08:58:33+00:00", "object_relation": "text", "timestamp": "1783091194", "to_ids": false, "type": "text", "uuid": "a8481143-280e-45e9-88a7-77b407dfac80", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-06-12T08:58:33+00:00\nLast Submission: 2026-06-12T08:58:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T08:58:33+00:00", "last_seen": "2026-06-12T08:58:33+00:00", "object_relation": "ssdeep", "timestamp": "1783091194", "to_ids": true, "type": "ssdeep", "uuid": "9e765376-1fd3-42cf-b8b8-a853accd213f", "value": "6144:uOmcb7C/iDe++P2bPpnJAh5udADom/troCn8k4PHYh6e2PxsfHMhO59vvue6D4b:Zmcb7C/iDe++P2bPpnJAh5uLm/JoDk4I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T08:58:33+00:00", "last_seen": "2026-06-12T08:58:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091194", "to_ids": false, "type": "size-in-bytes", "uuid": "2bb853e0-629e-48ff-be2f-0311cd2e0c39", "value": "221131" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T08:58:33+00:00", "last_seen": "2026-06-12T08:58:33+00:00", "object_relation": "filename", "timestamp": "1783091194", "to_ids": true, "type": "filename", "uuid": "f7e6aa35-1f91-4357-a03a-486df580e56d", "value": "Detected_File_0114917407DBAB5AA12E0B3CB665A645B156A741_20260611093419+0200" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098118", "uuid": "1c7e3add-049f-4d6b-888b-315b400c6083", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "md5", "timestamp": "1783098118", "to_ids": true, "type": "md5", "uuid": "273da36b-81c7-44ca-a776-857ea4a57630", "value": "1adb9f49409fa62c7fa7b8c05652bdd2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "sha1", "timestamp": "1783096910", "to_ids": true, "type": "sha1", "uuid": "dd26e13c-7e19-4791-b301-60bb7dc24f38", "value": "ff0ef9a08c0df79abb94732c3238c4c26c52ece3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "sha256", "timestamp": "1783096910", "to_ids": true, "type": "sha256", "uuid": "4c89654c-fe4d-423a-9d5e-2da4ad15a4db", "value": "9c1121b62cc69945cde94f3f29022eb687216f61933904e5f32b902299a0399d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "text", "timestamp": "1783091215", "to_ids": false, "type": "text", "uuid": "d4efd7f0-8bf9-46e5-a25b-8ce6d21d9c6d", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 33/75\nFirst Seen In The Wild: 2026-06-11T12:00:35+00:00\nFirst Submission: 2026-06-11T05:23:43+00:00\nLast Submission: 2026-06-11T05:23:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "creation-time", "timestamp": "1783091215", "to_ids": false, "type": "datetime", "uuid": "9bff4f6d-4f96-44d2-bd3d-fe8be7ab626f", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "ssdeep", "timestamp": "1783091215", "to_ids": true, "type": "ssdeep", "uuid": "4eca5f61-1e88-4093-af38-2291d45a5461", "value": "1536:pKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhzw5nYynFpdI07ENP4PV:pn1LZvTTZGzN6YZ5wWzw5P2NAzp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091215", "to_ids": false, "type": "size-in-bytes", "uuid": "e158c4f4-6a60-452d-ba2f-7fe19c97ba69", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "vhash", "timestamp": "1783091215", "to_ids": true, "type": "vhash", "uuid": "71d333e3-eb97-4aef-a83e-157f4b681a0a", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:23:43+00:00", "last_seen": "2026-06-11T05:23:43+00:00", "object_relation": "filename", "timestamp": "1783091215", "to_ids": true, "type": "filename", "uuid": "36b89ff3-d597-48d8-ac5d-bab8e4298e29", "value": "1adb9f49409fa62c7fa7b8c05652bdd2.file" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T13:54:29+00:00", "last_seen": "2026-06-11T13:54:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098139", "uuid": "4204daaf-05e0-4b19-8e08-5c2bfdfcab1e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T13:54:29+00:00", "last_seen": "2026-06-11T13:54:29+00:00", "object_relation": "md5", "timestamp": "1783098139", "to_ids": true, "type": "md5", "uuid": "500e1061-86a7-4d21-b5ec-3b101b2c4895", "value": "c442701a80d247c87272f7683be08c3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T13:54:29+00:00", "last_seen": "2026-06-11T13:54:29+00:00", "object_relation": "sha1", "timestamp": "1783096912", "to_ids": true, "type": "sha1", "uuid": "d933a078-b549-49ab-962f-4f81705cbb30", "value": "5adf05929c50cdba9cf798ffd5748aa7859fff4d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T13:54:29+00:00", "last_seen": "2026-06-11T13:54:29+00:00", "object_relation": "sha256", "timestamp": "1783096912", "to_ids": true, "type": "sha256", "uuid": "2dfe9398-16ce-41d3-b5d5-2dc4446135a5", "value": "9f242f61a1f0cb29cbbce0f5c8412cb93ce48d1aa61968f7cc2539518425036f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 13/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T13:54:29+00:00", "last_seen": "2026-06-11T13:54:29+00:00", "object_relation": "text", "timestamp": "1783091237", "to_ids": false, "type": "text", "uuid": "fe5cd512-e7d8-4bb5-b504-15b9b59e666c", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 27/75\nFirst Submission: 2026-06-11T13:54:29+00:00\nLast Submission: 2026-06-11T13:54:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T13:54:29+00:00", "last_seen": "2026-06-11T13:54:29+00:00", "object_relation": "ssdeep", "timestamp": "1783091237", "to_ids": true, "type": "ssdeep", "uuid": "a3562288-2eb9-4f96-b6e0-ace08f8b153e", "value": "6144:pzQKXTY3jRU6//pvtMVruwsVEiLeRwTHvwx8:2pRUg/LMVxsVEWt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T13:54:29+00:00", "last_seen": "2026-06-11T13:54:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091237", "to_ids": false, "type": "size-in-bytes", "uuid": "aa7720f9-cbc5-4980-a5dd-dd57584fc726", "value": "199576" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T13:54:29+00:00", "last_seen": "2026-06-11T13:54:29+00:00", "object_relation": "filename", "timestamp": "1783091237", "to_ids": true, "type": "filename", "uuid": "c5879d30-f432-4db0-9473-22240fdc8223", "value": "apytanie ofertowe. Nasz numer zapytania 3521 - Krzysztof Marczyszyn (sales-4@wudagroup.com) - 2026-06-11 1331.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T06:04:17+00:00", "last_seen": "2026-06-15T06:04:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098160", "uuid": "88629442-cf9d-41eb-99cc-99585ed5403b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:04:17+00:00", "last_seen": "2026-06-15T06:04:17+00:00", "object_relation": "md5", "timestamp": "1783098160", "to_ids": true, "type": "md5", "uuid": "210c437d-696f-4f59-bea6-f9ae4fc3448c", "value": "bcfdb3db1dff9a08092d0c67a4a7fe97", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:04:17+00:00", "last_seen": "2026-06-15T06:04:17+00:00", "object_relation": "sha1", "timestamp": "1783096913", "to_ids": true, "type": "sha1", "uuid": "d4622af0-8c97-4a40-8010-197c3c339193", "value": "b5f331d78cec24beb726d7870fb3d06ed15e8844", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:04:17+00:00", "last_seen": "2026-06-15T06:04:17+00:00", "object_relation": "sha256", "timestamp": "1783096913", "to_ids": true, "type": "sha256", "uuid": "a66486e3-0d92-4508-b518-2f478400d559", "value": "a4ae487ec3b2db461067824c4c6753e26cf0a7b2b113d0c34a81b01c2c7b3c07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:04:17+00:00", "last_seen": "2026-06-15T06:04:17+00:00", "object_relation": "text", "timestamp": "1783091258", "to_ids": false, "type": "text", "uuid": "1026cd27-b38d-450b-8e56-e95a09002c50", "value": "Type Description: Email\nMicrosoft: Trojan:Script/Wacatac.C!ml\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-06-15T06:04:17+00:00\nLast Submission: 2026-06-15T06:04:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:04:17+00:00", "last_seen": "2026-06-15T06:04:17+00:00", "object_relation": "ssdeep", "timestamp": "1783091258", "to_ids": true, "type": "ssdeep", "uuid": "595c8e7d-ae63-4212-bd07-fd7205fac9cc", "value": "3072:d+lBH9zcFx+0VRbJrYsAK619Dl/7emHxYcoMp6aRFo:d+D9e/9S1z7emHJoMbq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:04:17+00:00", "last_seen": "2026-06-15T06:04:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091258", "to_ids": false, "type": "size-in-bytes", "uuid": "8f2afeeb-b68e-4102-8168-8e047fef028e", "value": "149436" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:04:17+00:00", "last_seen": "2026-06-15T06:04:17+00:00", "object_relation": "filename", "timestamp": "1783091258", "to_ids": true, "type": "filename", "uuid": "0e27a08e-2461-48a9-8a39-d9ef1c74b883", "value": "2026_06_15-08_04_16_vt_msmx_submission.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098181", "uuid": "c7f9249b-3686-4ce5-b68b-576c685574fa", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "object_relation": "md5", "timestamp": "1783098181", "to_ids": true, "type": "md5", "uuid": "f01634f8-7566-4836-98a5-039d1ca8ba3d", "value": "e46e81ab15076ee06241dc4dbde4e600", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "object_relation": "sha1", "timestamp": "1783096915", "to_ids": true, "type": "sha1", "uuid": "b0b83cd9-1fc7-4491-82e3-93282ad93a6e", "value": "ad42695c77e99a1cb169496616c9007c3e70f82a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "object_relation": "sha256", "timestamp": "1783096915", "to_ids": true, "type": "sha256", "uuid": "e617c3ac-3e7f-4455-b5aa-ff97d6e57aad", "value": "ac7e72b5bf2dec4edf02545daf58342f60510f6d128509f47e52138c1f53cd38", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 14/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "object_relation": "text", "timestamp": "1783091280", "to_ids": false, "type": "text", "uuid": "cf699718-302b-40e1-aea2-256e721315a9", "value": "Type Description: Outlook\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 26/75\nFirst Submission: 2026-06-11T06:29:53+00:00\nLast Submission: 2026-06-11T06:29:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "object_relation": "ssdeep", "timestamp": "1783091280", "to_ids": true, "type": "ssdeep", "uuid": "9d828cd3-047e-40be-a67b-a984210e5c0a", "value": "3072:7udpy1EE1yvn1LZvTTZGzN6YZ5nuTib2W25cURmuccQg:W85oNLFZsNjvnyi6fRm3c" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091280", "to_ids": false, "type": "size-in-bytes", "uuid": "d2edbbe3-ea54-407e-8879-caa369fb48ce", "value": "244224" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "object_relation": "vhash", "timestamp": "1783091280", "to_ids": true, "type": "vhash", "uuid": "fcee8b41-0f3f-4d91-9ba9-263992a3bf55", "value": "fe43cc098163d8fb4f1b2b088de0949b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:29:53+00:00", "last_seen": "2026-06-11T06:29:53+00:00", "object_relation": "filename", "timestamp": "1783091280", "to_ids": true, "type": "filename", "uuid": "b4888005-25dd-4d1c-9bfe-2fb72752407d", "value": "Password Protected Document Returned mail see transcript for details (196 KB).msg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098202", "uuid": "81c8723a-9a61-440f-9036-5bb5fa87f73c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "object_relation": "md5", "timestamp": "1783098202", "to_ids": true, "type": "md5", "uuid": "742c8a94-a903-445f-9227-3ff4a6813816", "value": "1e12d8cd036442d2100da58c47a76285", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "object_relation": "sha1", "timestamp": "1783096916", "to_ids": true, "type": "sha1", "uuid": "ef32d843-97ab-4f0e-99b4-3ce3b3de5abf", "value": "0be24cc6cff1b4e10e50c0d874285796f1c2069c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "object_relation": "sha256", "timestamp": "1783096916", "to_ids": true, "type": "sha256", "uuid": "0cdcc687-d81b-441d-aba3-9bf05e51c04c", "value": "acb18684468dc7c0b900e807758f4813115472011df161d7e05ff7beebbb5414", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 29/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "object_relation": "text", "timestamp": "1783091301", "to_ids": false, "type": "text", "uuid": "fa67bd89-8bc6-4f97-a70a-44930e4f7dd9", "value": "Type Description: Outlook\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 22/75\nFirst Seen In The Wild: 2026-06-11T07:27:11+00:00\nFirst Submission: 2026-06-11T06:26:54+00:00\nLast Submission: 2026-06-11T06:26:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "object_relation": "ssdeep", "timestamp": "1783091301", "to_ids": true, "type": "ssdeep", "uuid": "7788ce06-86c5-4b73-aae6-3fea00caec64", "value": "3072:a8h5EE1y4n1LZvTTZGzN6YZ5nuTib2W25cURmuccQg:ToILFZsNjvnyi6fRm3c" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091301", "to_ids": false, "type": "size-in-bytes", "uuid": "2227e71a-defa-4c7a-91c5-4e81e23b9205", "value": "218624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "object_relation": "vhash", "timestamp": "1783091301", "to_ids": true, "type": "vhash", "uuid": "9a8ca88b-3fcd-46ad-a725-862308b58e58", "value": "fe43cc098163d8fb4f1b2b088de0949b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:26:54+00:00", "last_seen": "2026-06-11T06:26:54+00:00", "object_relation": "filename", "timestamp": "1783091301", "to_ids": true, "type": "filename", "uuid": "4c86b176-f137-4117-ba27-c845a6fd6e49", "value": "original.eml.msg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098223", "uuid": "3573cb21-d1f3-40ce-a960-0d6fe782631b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "md5", "timestamp": "1783098223", "to_ids": true, "type": "md5", "uuid": "f0a55116-e4ca-4213-a5af-888f3dc116c2", "value": "4646ff7c9824aface7e85a7c33b22f13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "sha1", "timestamp": "1783096917", "to_ids": true, "type": "sha1", "uuid": "543f0fee-fade-48ca-858b-f75103148497", "value": "f0171173b75b1453a4870cf9aaa43894b6aef9f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "sha256", "timestamp": "1783096917", "to_ids": true, "type": "sha256", "uuid": "252c4725-abf0-401e-9107-c045146e6867", "value": "acdb202ced24988048597abfbcb288424882674d72abb77d693642a279bfc86d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "text", "timestamp": "1783091322", "to_ids": false, "type": "text", "uuid": "a79d8447-58cd-4e2e-8c8f-61af115a9745", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 32/75\nFirst Seen In The Wild: 2026-06-12T20:00:35+00:00\nFirst Submission: 2026-06-12T15:32:01+00:00\nLast Submission: 2026-06-13T11:30:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "creation-time", "timestamp": "1783091323", "to_ids": false, "type": "datetime", "uuid": "d139662e-82fb-4a14-b318-55b1e96e34f6", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "ssdeep", "timestamp": "1783091322", "to_ids": true, "type": "ssdeep", "uuid": "ee8e5c36-6495-4b7c-b76f-ddd4ff950f3c", "value": "3072:mhTCl/K/Om1LZvTTZGzN6YZ5nuTib2CGn4DUYsjmAr03Ny:1JKzLFZsNjvnyi9DU1qAJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091322", "to_ids": false, "type": "size-in-bytes", "uuid": "9c22843c-43ab-4c1b-912a-c3f514b01d22", "value": "203264" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "vhash", "timestamp": "1783091322", "to_ids": true, "type": "vhash", "uuid": "d66dd60b-90f9-49e2-84ac-149af431dbc1", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T15:32:01+00:00", "last_seen": "2026-06-13T11:30:54+00:00", "object_relation": "filename", "timestamp": "1783091322", "to_ids": true, "type": "filename", "uuid": "ead6339a-2884-4f44-ad72-2553c7d44890", "value": "Remittance12.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098244", "uuid": "6ec1bf16-6abe-4b43-95f1-21fd73bc914d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "object_relation": "md5", "timestamp": "1783098244", "to_ids": true, "type": "md5", "uuid": "ad7e7751-ce8b-4f3e-8dd1-5743f83e96fc", "value": "3f217261d6d08ddb0f384512756e26be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "object_relation": "sha1", "timestamp": "1783096919", "to_ids": true, "type": "sha1", "uuid": "879330b4-f231-415c-a0ad-18150c46ee1b", "value": "890c5e7e96d8570fb07156b8d963ecf00ea7e6ca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "object_relation": "sha256", "timestamp": "1783096919", "to_ids": true, "type": "sha256", "uuid": "893aa882-79d5-4235-9b32-17470c32cb3e", "value": "b3d8e9daf02cc00d56bb2c1e1c380a68006d691f868cb6433d63f732085fbfde", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 17/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "object_relation": "text", "timestamp": "1783091344", "to_ids": false, "type": "text", "uuid": "af18998e-f705-4c06-895d-6f25ca1c851d", "value": "Type Description: Outlook\nMicrosoft: Trojan:Win32/Znyonm!rfn\nClamAV: None\nVT Total Detection: 29/73\nFirst Submission: 2026-06-15T06:29:21+00:00\nLast Submission: 2026-06-15T06:29:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "object_relation": "ssdeep", "timestamp": "1783091344", "to_ids": true, "type": "ssdeep", "uuid": "40e7f516-d334-44fb-8c96-f09ec360a325", "value": "1536:9/vM+ChABsbTYpeeRnJal04LdXj2OAZ57UxWrXZhAojrJ3rpLxupS1Xb4VCE1x:9/6X04LMOAzAxWrQ89p0pSG" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091344", "to_ids": false, "type": "size-in-bytes", "uuid": "20c23146-c963-4259-9ed6-058e1a7c2b83", "value": "173056" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "object_relation": "vhash", "timestamp": "1783091344", "to_ids": true, "type": "vhash", "uuid": "e0cd8fc1-b3b0-4c9b-b19d-402a23e91ccf", "value": "fe43cc098163d8fb4f1b2b088de0949b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T06:29:21+00:00", "last_seen": "2026-06-15T06:29:21+00:00", "object_relation": "filename", "timestamp": "1783091344", "to_ids": true, "type": "filename", "uuid": "d955694f-f35d-4ad6-8484-8b342c657820", "value": "MPCC Purchase Order MPO-51820 to Fhw Corporation.msg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098265", "uuid": "fd81c00e-18c8-470e-90d1-5acc322418e2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "object_relation": "md5", "timestamp": "1783098265", "to_ids": true, "type": "md5", "uuid": "24bdbb5d-6eac-4db3-8c51-a73c174a38bf", "value": "f88dec2c3c2c866f4836b1baf93776a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "object_relation": "sha1", "timestamp": "1783096920", "to_ids": true, "type": "sha1", "uuid": "c8ac9b90-74bd-4741-b3fe-45011c0ebe73", "value": "675d309cf724f3d4b4cc4f57caf5aef3ebd4b553", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "object_relation": "sha256", "timestamp": "1783096920", "to_ids": true, "type": "sha256", "uuid": "6b6bc214-19f5-4d36-98aa-bbd65716b20e", "value": "b64b5e1c54fd1da11321cdcb320c0ddecda5be7060e98f0c032f90f0bed69eeb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 11/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "object_relation": "text", "timestamp": "1783091366", "to_ids": false, "type": "text", "uuid": "257d2b95-e6f9-4833-b331-219494113c36", "value": "Type Description: Outlook\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 17/75\nFirst Submission: 2026-06-11T07:24:24+00:00\nLast Submission: 2026-06-11T07:24:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "object_relation": "ssdeep", "timestamp": "1783091366", "to_ids": true, "type": "ssdeep", "uuid": "32b578e7-7955-4ae5-bd51-b9e605e15075", "value": "3072:xB52EE1yXn1LZvTTZGzN6YZ5nuTib2W25cURmuccQg:vKolLFZsNjvnyi6fRm3c" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091366", "to_ids": false, "type": "size-in-bytes", "uuid": "9393924e-0503-4a4c-a05f-e2f968c64160", "value": "233472" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "object_relation": "vhash", "timestamp": "1783091366", "to_ids": true, "type": "vhash", "uuid": "0881e509-aa06-4b01-84b4-a56fbfe71caf", "value": "fe43cc098163d8fb4f1b2b088de0949b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T07:24:24+00:00", "last_seen": "2026-06-11T07:24:24+00:00", "object_relation": "filename", "timestamp": "1783091366", "to_ids": true, "type": "filename", "uuid": "0a2fbea5-8771-4801-8c26-d70b1d145263", "value": "WG_ Purchase Order SINO_5700192.msg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T23:47:28+00:00", "last_seen": "2026-06-11T23:47:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098286", "uuid": "0c9db6ac-c242-47a4-8c83-40c03d466d3b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:47:28+00:00", "last_seen": "2026-06-11T23:47:28+00:00", "object_relation": "md5", "timestamp": "1783098286", "to_ids": true, "type": "md5", "uuid": "0fe1f105-0786-415a-8bc2-679bb6056491", "value": "14f3df0a427f32668905be5f00f54caf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:47:28+00:00", "last_seen": "2026-06-11T23:47:28+00:00", "object_relation": "sha1", "timestamp": "1783096922", "to_ids": true, "type": "sha1", "uuid": "c6300b94-9076-4642-8f75-c92b56265d32", "value": "448106e313f6308e5bd1faa786befcb649dfd300", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:47:28+00:00", "last_seen": "2026-06-11T23:47:28+00:00", "object_relation": "sha256", "timestamp": "1783096922", "to_ids": true, "type": "sha256", "uuid": "361d02e1-1fcc-481d-9580-c7d06800cc3e", "value": "b828d345b854f07e333f29bd5224ecb8d5daf0451a645b4be32e634395724c43", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T23:47:28+00:00", "last_seen": "2026-06-11T23:47:28+00:00", "object_relation": "text", "timestamp": "1783091387", "to_ids": false, "type": "text", "uuid": "091061e1-3aa7-420c-8ba7-b3b97cfc6a65", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-06-11T23:47:28+00:00\nLast Submission: 2026-06-11T23:47:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T23:47:28+00:00", "last_seen": "2026-06-11T23:47:28+00:00", "object_relation": "ssdeep", "timestamp": "1783091387", "to_ids": true, "type": "ssdeep", "uuid": "98bb6762-b49e-4c36-a030-2797390cb7fb", "value": "6144:XmnD9SADom/troCn8k4PHYh6e2PxsfHMhO59vvue6D4N:+D0m/JoDk4fYh6e2PxcsgD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T23:47:28+00:00", "last_seen": "2026-06-11T23:47:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091387", "to_ids": false, "type": "size-in-bytes", "uuid": "e125b797-cb33-4e12-85d4-033d6f194f2a", "value": "250468" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T23:47:28+00:00", "last_seen": "2026-06-11T23:47:28+00:00", "object_relation": "filename", "timestamp": "1783091387", "to_ids": true, "type": "filename", "uuid": "54e3fc89-817b-4e5c-b1ed-835922421198", "value": "1780830143-110947-7688-64105-1.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098308", "uuid": "24e2cb4a-5860-496f-b325-95abc909e382", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "md5", "timestamp": "1783098308", "to_ids": true, "type": "md5", "uuid": "6c765668-f527-4b3f-9c22-830cf69a70f2", "value": "bbc994c7ecd2336b07039280170949f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "sha1", "timestamp": "1783096924", "to_ids": true, "type": "sha1", "uuid": "ec19e3cc-3c26-4bcb-9d8d-bab503cac94a", "value": "cf161755ffe384626be6f46f5c785657eab65622", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "sha256", "timestamp": "1783096924", "to_ids": true, "type": "sha256", "uuid": "447c505a-013e-4aee-bbeb-655d4d4b35c4", "value": "bbbd65d1989023690b51f2a706e9a610e1ef598c10a0d33acf1774ff384a0f79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "text", "timestamp": "1783091409", "to_ids": false, "type": "text", "uuid": "0cc6036e-d50e-4889-82c4-cbfc2cbf5bd9", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Znyonm!rfn\nClamAV: None\nVT Total Detection: 32/75\nFirst Seen In The Wild: 2026-06-11T12:00:40+00:00\nFirst Submission: 2026-06-11T06:07:13+00:00\nLast Submission: 2026-06-11T07:45:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "creation-time", "timestamp": "1783091409", "to_ids": false, "type": "datetime", "uuid": "c4a9afe9-5475-49f9-b548-fbd9c515f400", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "ssdeep", "timestamp": "1783091409", "to_ids": true, "type": "ssdeep", "uuid": "5261d667-b0e4-44a0-8e54-e36da0254a70", "value": "1536:WKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhCly5sk3JtJPr+Neznzs:Wn1LZvTTZGzN6YZ5wWCly5s41PaqbbQ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091409", "to_ids": false, "type": "size-in-bytes", "uuid": "ba174903-0396-48b1-9217-71cdd70b568e", "value": "128000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "vhash", "timestamp": "1783091409", "to_ids": true, "type": "vhash", "uuid": "dd61cba5-924c-42bd-896e-a8a48f113124", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T06:07:13+00:00", "last_seen": "2026-06-11T07:45:30+00:00", "object_relation": "filename", "timestamp": "1783091409", "to_ids": true, "type": "filename", "uuid": "cb2f6335-a63d-4fab-8e4d-f451eedd3d2b", "value": "Quotation.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-15T03:51:21+00:00", "last_seen": "2026-06-15T03:51:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098329", "uuid": "eff9975e-9195-4720-a490-cc15543c5ffa", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T03:51:21+00:00", "last_seen": "2026-06-15T03:51:21+00:00", "object_relation": "md5", "timestamp": "1783098329", "to_ids": true, "type": "md5", "uuid": "f252a2e5-390e-485b-8ffd-832ed50810c2", "value": "12f3d11bc93058cc6d41d9cabf98b787", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T03:51:21+00:00", "last_seen": "2026-06-15T03:51:21+00:00", "object_relation": "sha1", "timestamp": "1783096925", "to_ids": true, "type": "sha1", "uuid": "dda60388-b1d9-4b4a-a8ef-7a665dcbd08f", "value": "ab70b5cd81162dda0b5e98201408bde20c9c7f3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T03:51:21+00:00", "last_seen": "2026-06-15T03:51:21+00:00", "object_relation": "sha256", "timestamp": "1783096925", "to_ids": true, "type": "sha256", "uuid": "6a035c28-71db-4b85-bcc9-907e927d0a8a", "value": "c884b1e59bad0101ecf86bd1b5b9e0e2819d5c4d1bd6eac7d76da61db06baa73", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 17/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T03:51:21+00:00", "last_seen": "2026-06-15T03:51:21+00:00", "object_relation": "text", "timestamp": "1783091430", "to_ids": false, "type": "text", "uuid": "f1135740-aa99-4bca-a91f-e3160e0d8d46", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Malgent\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-06-15T03:51:21+00:00\nLast Submission: 2026-06-15T03:51:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-15T03:51:21+00:00", "last_seen": "2026-06-15T03:51:21+00:00", "object_relation": "ssdeep", "timestamp": "1783091430", "to_ids": true, "type": "ssdeep", "uuid": "9b72629d-8759-4c6a-9c57-7b72280a9928", "value": "12288:LmwJHY4boXuvAsZLHMhXxm5zQfmwJHY4b3vDStzBcVpSo3lf:CwJ3bU10QXxm58OwJ3b7AzBcVrf" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T03:51:21+00:00", "last_seen": "2026-06-15T03:51:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091430", "to_ids": false, "type": "size-in-bytes", "uuid": "5e6ce3fb-3248-49e6-b763-5914bc9d9a01", "value": "1183669" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-15T03:51:21+00:00", "last_seen": "2026-06-15T03:51:21+00:00", "object_relation": "filename", "timestamp": "1783091430", "to_ids": true, "type": "filename", "uuid": "d0571808-6046-467f-b03a-6eefab550a05", "value": "1.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098350", "uuid": "812b150b-3c4e-45ba-82b4-77659ad1990d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "object_relation": "md5", "timestamp": "1783098350", "to_ids": true, "type": "md5", "uuid": "5249b4f9-50e0-40c0-8a3e-dae4635fa36a", "value": "3e79bbe2f5324d498c681402947797cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "object_relation": "sha1", "timestamp": "1783096926", "to_ids": true, "type": "sha1", "uuid": "19c258e3-41af-446d-a034-212cc95500ce", "value": "055bc68e0c396a008d0bbb7398f69d0305c35414", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "object_relation": "sha256", "timestamp": "1783096926", "to_ids": true, "type": "sha256", "uuid": "4b72c679-7a13-4a7d-a415-4277b0804af9", "value": "d57cbb9f4a8176704f45b1c139990463907d293b74cfc2fdbe1656e304a94d22", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 13/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "object_relation": "text", "timestamp": "1783091452", "to_ids": false, "type": "text", "uuid": "bfea4d88-1f6e-4fdf-b0f9-1d43d0dd9f4d", "value": "Type Description: JavaScript\nMicrosoft: None\nClamAV: None\nVT Total Detection: 21/75\nFirst Submission: 2026-06-11T08:16:14+00:00\nLast Submission: 2026-06-11T08:16:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "object_relation": "ssdeep", "timestamp": "1783091452", "to_ids": true, "type": "ssdeep", "uuid": "e462d8b0-c6eb-40bb-8e99-0f30ad320f43", "value": "1536:+FIIyx5zI9+5tl4utOtJwtHEB6WyTqfUWCKLxwpIawtTMB6HPPl:+FIIyDI9e+jyqUK+pIHtq6HPPl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091452", "to_ids": false, "type": "size-in-bytes", "uuid": "6d046330-59a0-4f84-8751-8820eecf8f9b", "value": "486457" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "object_relation": "vhash", "timestamp": "1783091452", "to_ids": true, "type": "vhash", "uuid": "6d9d88ec-12ee-4105-8152-f1c99d38f9c1", "value": "52f709563c2f8d8217335ac470c7049f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T08:16:14+00:00", "last_seen": "2026-06-11T08:16:14+00:00", "object_relation": "filename", "timestamp": "1783091452", "to_ids": true, "type": "filename", "uuid": "f0944695-5306-45b0-8680-ce0b2cd3c067", "value": "wegivenmebestthingsforbetterplacetocme.hta" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T09:04:34+00:00", "last_seen": "2026-06-11T09:04:34+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098371", "uuid": "6ad9baf1-ee10-4e81-a2fc-1c71b40a614a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T09:04:34+00:00", "last_seen": "2026-06-11T09:04:34+00:00", "object_relation": "md5", "timestamp": "1783098371", "to_ids": true, "type": "md5", "uuid": "29976c10-4baa-416b-a94f-fd421a4f24fe", "value": "b967028e9947ea8335121463aea24591", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T09:04:34+00:00", "last_seen": "2026-06-11T09:04:34+00:00", "object_relation": "sha1", "timestamp": "1783096928", "to_ids": true, "type": "sha1", "uuid": "f1ebceee-a0bc-4d6c-88b2-f91353237c12", "value": "38c457783b39387c1a3afb41f98bd0a564769545", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T09:04:34+00:00", "last_seen": "2026-06-11T09:04:34+00:00", "object_relation": "sha256", "timestamp": "1783096928", "to_ids": true, "type": "sha256", "uuid": "7bc717a7-c761-497e-94c6-fad1e0dddafc", "value": "daa335553542dea9666a83b3f49e85b51193a39e809fd899bfcbc2d35fcc0c3e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T09:04:34+00:00", "last_seen": "2026-06-11T09:04:34+00:00", "object_relation": "text", "timestamp": "1783091474", "to_ids": false, "type": "text", "uuid": "fb5e5c80-3fba-48ed-baf1-37c6c8dab1b6", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-06-11T09:04:34+00:00\nLast Submission: 2026-06-11T09:04:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T09:04:34+00:00", "last_seen": "2026-06-11T09:04:34+00:00", "object_relation": "ssdeep", "timestamp": "1783091474", "to_ids": true, "type": "ssdeep", "uuid": "2764b6f3-cca7-48f1-8ac6-0ff4ca7f9825", "value": "3072:dAr3kZEmi/tOd2uyoCnxKk4qCxrTJ6hkptllhDCGMqdnHYe8ZbIgStej:dADom/troCn8k4PHYh6e24Eftq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T09:04:34+00:00", "last_seen": "2026-06-11T09:04:34+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091474", "to_ids": false, "type": "size-in-bytes", "uuid": "9d1eef07-9e97-4659-82ce-39917ef72a8f", "value": "185336" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T09:04:34+00:00", "last_seen": "2026-06-11T09:04:34+00:00", "object_relation": "filename", "timestamp": "1783091474", "to_ids": true, "type": "filename", "uuid": "9fa4b54f-6a78-44d4-a3db-f4a0c2de30df", "value": "2026_06_11-11_04_34_vt_msmx_submission.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T09:04:36+00:00", "last_seen": "2026-06-11T09:04:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098392", "uuid": "df472089-9dd2-4d2c-90dd-1de076a34363", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T09:04:36+00:00", "last_seen": "2026-06-11T09:04:36+00:00", "object_relation": "md5", "timestamp": "1783098392", "to_ids": true, "type": "md5", "uuid": "914bafd1-4a76-45ff-9f4f-4aa5c933b1fc", "value": "b43a573b30fdef574795256aee613cf8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T09:04:36+00:00", "last_seen": "2026-06-11T09:04:36+00:00", "object_relation": "sha1", "timestamp": "1783096929", "to_ids": true, "type": "sha1", "uuid": "faf3e6ef-2138-43b8-9ea6-bd5cde4d1eae", "value": "02ff90923d2254f1749ee09faf8573412a4fc8bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T09:04:36+00:00", "last_seen": "2026-06-11T09:04:36+00:00", "object_relation": "sha256", "timestamp": "1783096929", "to_ids": true, "type": "sha256", "uuid": "cf848368-7171-4f3d-84eb-570ab7c1e71e", "value": "e03a16696d74144a6ecb626662246332aa509d2d0ae7e2a192a3c8b1ed9390ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T09:04:36+00:00", "last_seen": "2026-06-11T09:04:36+00:00", "object_relation": "text", "timestamp": "1783091495", "to_ids": false, "type": "text", "uuid": "84666437-861f-4706-a7d6-ac1725aa5bbb", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-06-11T09:04:36+00:00\nLast Submission: 2026-06-11T09:04:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T09:04:36+00:00", "last_seen": "2026-06-11T09:04:36+00:00", "object_relation": "ssdeep", "timestamp": "1783091495", "to_ids": true, "type": "ssdeep", "uuid": "5b407775-bbee-44d1-b0e1-37af95d53dba", "value": "3072:bAr3kZEmi/tOd2uyoCnxKk4qCxrTJ6hkptllhDCGMqdnHYe8ZbIgSteY:bADom/troCn8k4PHYh6e24Eft5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T09:04:36+00:00", "last_seen": "2026-06-11T09:04:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091495", "to_ids": false, "type": "size-in-bytes", "uuid": "88e96659-0858-4fdd-b67b-51127c107561", "value": "185332" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T09:04:36+00:00", "last_seen": "2026-06-11T09:04:36+00:00", "object_relation": "filename", "timestamp": "1783091495", "to_ids": true, "type": "filename", "uuid": "f6022d1f-95da-4bbd-8624-b55a07bf6351", "value": "2026_06_11-11_04_35_vt_msmx_submission.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T05:20:26+00:00", "last_seen": "2026-06-11T05:20:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098413", "uuid": "23659479-68e0-43b1-8799-793ac8872b11", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:20:26+00:00", "last_seen": "2026-06-11T05:20:26+00:00", "object_relation": "md5", "timestamp": "1783098413", "to_ids": true, "type": "md5", "uuid": "8cfd3cce-8eb4-44a2-913c-196a5a634de9", "value": "e7a9ace376f9b068f1d0f265b1a35dfe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:20:26+00:00", "last_seen": "2026-06-11T05:20:26+00:00", "object_relation": "sha1", "timestamp": "1783096930", "to_ids": true, "type": "sha1", "uuid": "57420408-e4b9-4eea-8a75-a63499b92ecd", "value": "4dbde137aab3451ee263057b82f41d1602737999", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:20:26+00:00", "last_seen": "2026-06-11T05:20:26+00:00", "object_relation": "sha256", "timestamp": "1783096930", "to_ids": true, "type": "sha256", "uuid": "452e8e86-f8a2-4d6f-85b9-8cd48ea7ae67", "value": "e14539685087d21a47968ec6f07d7e6c385b8487fd7d0fbd635918f01d2f01ac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:20:26+00:00", "last_seen": "2026-06-11T05:20:26+00:00", "object_relation": "text", "timestamp": "1783091517", "to_ids": false, "type": "text", "uuid": "abece2e4-e4c6-4893-bf88-95f86b2f781f", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-06-11T05:20:26+00:00\nLast Submission: 2026-06-11T05:20:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:20:26+00:00", "last_seen": "2026-06-11T05:20:26+00:00", "object_relation": "ssdeep", "timestamp": "1783091517", "to_ids": true, "type": "ssdeep", "uuid": "387c897b-9c0b-41a9-96df-cd3507238622", "value": "6144:HOtzWJF4I1KHBcp+8P8ivB2mEZGnMESjisMNnzNnZ:vF4gKip+G8ivBnEEM7o" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:20:26+00:00", "last_seen": "2026-06-11T05:20:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091517", "to_ids": false, "type": "size-in-bytes", "uuid": "60b4f23f-10a6-41ae-86d0-a8ef50619fe1", "value": "218538" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:20:26+00:00", "last_seen": "2026-06-11T05:20:26+00:00", "object_relation": "filename", "timestamp": "1783091517", "to_ids": true, "type": "filename", "uuid": "799eeb2d-6a68-4718-957e-d7820bd25e25", "value": "Eb7O5P-W37eaD0Z19c-gaGS.eml" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098434", "uuid": "b38a202f-39cc-45ca-bbe1-f0454e7e4291", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "md5", "timestamp": "1783098434", "to_ids": true, "type": "md5", "uuid": "b29533e0-afa8-4383-9b03-4df38323fcef", "value": "39870c98dacc595ba3a5ce1a73928c9d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "sha1", "timestamp": "1783096932", "to_ids": true, "type": "sha1", "uuid": "4ccd05ca-5848-4bd1-a0d8-da35a9654547", "value": "e4398888cf55a74cddaa75ee42dc38f984e16e9e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "sha256", "timestamp": "1783096932", "to_ids": true, "type": "sha256", "uuid": "c3885011-a7d1-4535-9eb4-1a6a32a6bb67", "value": "e1b29c075dcc880693a7fbe810e10d65b70a789e27c0d0254683c3eb172b9531", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "text", "timestamp": "1783091538", "to_ids": false, "type": "text", "uuid": "4af24bc9-4641-4ec0-b389-85e21b29ccde", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 31/75\nFirst Seen In The Wild: 2026-06-11T12:00:36+00:00\nFirst Submission: 2026-06-11T02:59:15+00:00\nLast Submission: 2026-06-11T03:04:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "creation-time", "timestamp": "1783091538", "to_ids": false, "type": "datetime", "uuid": "9d58dfc4-3aa7-41d8-8d5a-c947afd9d1fe", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "ssdeep", "timestamp": "1783091538", "to_ids": true, "type": "ssdeep", "uuid": "bd320bfd-70f4-4d02-b5a2-3a9188696aa9", "value": "1536:iKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df52hwZLQ1ZBIcuIEGFYlcF7t:in1LZvTTZGzN6YZ5HVQ1ZpU+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091538", "to_ids": false, "type": "size-in-bytes", "uuid": "27a99b75-ed76-4767-af04-4bef853418ac", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "vhash", "timestamp": "1783091538", "to_ids": true, "type": "vhash", "uuid": "0c42e361-27ba-451d-b7f1-c949f97118a4", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T02:59:15+00:00", "last_seen": "2026-06-11T03:04:28+00:00", "object_relation": "filename", "timestamp": "1783091538", "to_ids": true, "type": "filename", "uuid": "1fbb032a-bc05-4705-9113-a4c1f9028899", "value": "39870c98dacc595ba3a5ce1a73928c9d.file" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098456", "uuid": "73141ab9-1047-4df3-beea-3449a44cf5e9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "md5", "timestamp": "1783098456", "to_ids": true, "type": "md5", "uuid": "c7412fe3-2241-41c4-86b6-247fe3685cd4", "value": "df28de2a91797e1f12154da51af3cf19", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "sha1", "timestamp": "1783096933", "to_ids": true, "type": "sha1", "uuid": "cbe39d91-718a-448e-a646-336a68c094ba", "value": "3c48ef61939bca82d7907e013581fea44e50d6e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "sha256", "timestamp": "1783096933", "to_ids": true, "type": "sha256", "uuid": "154024b0-b318-4d24-8575-a063dd90ca06", "value": "e38d9933364c69ceda6d80dda7ff12cfa3e3cf13b019af7264dbd263c3693874", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "text", "timestamp": "1783091559", "to_ids": false, "type": "text", "uuid": "f733b38e-6cc5-4340-b0aa-3f050f8ca914", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 30/75\nFirst Submission: 2026-06-11T05:16:43+00:00\nLast Submission: 2026-06-11T19:41:19+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "creation-time", "timestamp": "1783091560", "to_ids": false, "type": "datetime", "uuid": "b72818db-a843-46f5-8f9f-5541b399b261", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "ssdeep", "timestamp": "1783091559", "to_ids": true, "type": "ssdeep", "uuid": "af8c4f65-c1b3-429c-80b1-9f07100bdcdb", "value": "3072:Vn1LZvTTZGzN6YZ5wWJ8NsHydffEFJWxx47F:TLFZsNjvwWasSKFsxxm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091559", "to_ids": false, "type": "size-in-bytes", "uuid": "7cb02125-164b-4f85-a1b3-ff2daa4d1ae4", "value": "128000" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "vhash", "timestamp": "1783091559", "to_ids": true, "type": "vhash", "uuid": "a5869667-84f7-435c-888c-5b59bb8861ab", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T05:16:43+00:00", "last_seen": "2026-06-11T19:41:19+00:00", "object_relation": "filename", "timestamp": "1783091560", "to_ids": true, "type": "filename", "uuid": "5b7b3797-429d-4eb8-a30c-01388239bb17", "value": "PO.xls" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T05:07:45+00:00", "last_seen": "2026-06-12T05:07:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098477", "uuid": "9c98cede-bfb4-49ee-b2b0-9c6c4557ff95", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T05:07:45+00:00", "last_seen": "2026-06-12T05:07:45+00:00", "object_relation": "md5", "timestamp": "1783098477", "to_ids": true, "type": "md5", "uuid": "f56f2f08-dd0a-4515-bb87-8693576f3532", "value": "363e725ef714627246e1cbe3f142a10e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T05:07:45+00:00", "last_seen": "2026-06-12T05:07:45+00:00", "object_relation": "sha1", "timestamp": "1783096934", "to_ids": true, "type": "sha1", "uuid": "baa4ff0e-341b-403d-a61f-b93bbe3bfe0b", "value": "eb0db3d31a83406d2acf43dc2cfe3b1a4cc111d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T05:07:45+00:00", "last_seen": "2026-06-12T05:07:45+00:00", "object_relation": "sha256", "timestamp": "1783096934", "to_ids": true, "type": "sha256", "uuid": "55b3adf1-b698-49b3-91c0-4db82f13ce13", "value": "e6318081f044c469c78245ecfc858c94542787564336f12a0f7cdef7aecc7a78", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T05:07:45+00:00", "last_seen": "2026-06-12T05:07:45+00:00", "object_relation": "text", "timestamp": "1783091581", "to_ids": false, "type": "text", "uuid": "ff04dd0a-26a1-4faf-a7a6-c06811a4b856", "value": "Type Description: PNG\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/75\nFirst Submission: 2026-06-12T05:07:45+00:00\nLast Submission: 2026-06-12T05:07:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T05:07:45+00:00", "last_seen": "2026-06-12T05:07:45+00:00", "object_relation": "ssdeep", "timestamp": "1783091581", "to_ids": true, "type": "ssdeep", "uuid": "f8404eac-1c4d-4b44-ba44-40447108c776", "value": "48:HgwuO0icC+ww4DCwUfDYTuC6jFi/pxPaKx/gVx1AJt3w6pxlVRSq:AbOsgwYgN1jgniKiVa3DlVR1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T05:07:45+00:00", "last_seen": "2026-06-12T05:07:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091581", "to_ids": false, "type": "size-in-bytes", "uuid": "fd878ef3-4492-4d7b-b730-9b855d877d62", "value": "2302" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T05:07:45+00:00", "last_seen": "2026-06-12T05:07:45+00:00", "object_relation": "filename", "timestamp": "1783091581", "to_ids": true, "type": "filename", "uuid": "f0d450d3-8779-42c1-8332-349c5b7ed873", "value": "DMax.png" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T12:25:52+00:00", "last_seen": "2026-06-11T12:25:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098498", "uuid": "291c3783-df54-439a-a2b2-97f3ae6e78a4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:25:52+00:00", "last_seen": "2026-06-11T12:25:52+00:00", "object_relation": "md5", "timestamp": "1783098498", "to_ids": true, "type": "md5", "uuid": "b9041967-bccc-45e6-ad0f-fad17ea3892f", "value": "afea2accb31ab42e0a023213a41c58a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:25:52+00:00", "last_seen": "2026-06-11T12:25:52+00:00", "object_relation": "sha1", "timestamp": "1783096935", "to_ids": true, "type": "sha1", "uuid": "62cb999a-1a43-434a-806e-4a9b59dfbfe5", "value": "ed0a6bbe0e2228e24f9bd08c6cceefd0da9cd189", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:25:52+00:00", "last_seen": "2026-06-11T12:25:52+00:00", "object_relation": "sha256", "timestamp": "1783096936", "to_ids": true, "type": "sha256", "uuid": "59e9d7fa-dcea-4088-b0b6-5932022fbc12", "value": "ebfd6c01a834b160eb5b4456c04ba1d1b82fd28c99d9d1aa6b1a64c08929aa07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:25:52+00:00", "last_seen": "2026-06-11T12:25:52+00:00", "object_relation": "text", "timestamp": "1783091604", "to_ids": false, "type": "text", "uuid": "2744ea6c-a810-43b8-961c-07853a4a3909", "value": "Type Description: Email\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 30/74\nFirst Submission: 2026-06-11T12:25:52+00:00\nLast Submission: 2026-06-11T12:25:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T12:25:52+00:00", "last_seen": "2026-06-11T12:25:52+00:00", "object_relation": "ssdeep", "timestamp": "1783091604", "to_ids": true, "type": "ssdeep", "uuid": "73ae14b9-08e0-4b3c-b799-4493bf5e17f9", "value": "3072:6+vYHXo6PpU6RCy/pvtMVpqgu4UIvqEouC+h0EPZrKRbm3ZZ2fbcqAfhhlx4:lY3jRU6//pvtMVruwsVEgRbsXgbcqAf4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:25:52+00:00", "last_seen": "2026-06-11T12:25:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091604", "to_ids": false, "type": "size-in-bytes", "uuid": "7d88135f-643d-4001-bd1d-da3fc5e0acd3", "value": "195718" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T12:25:52+00:00", "last_seen": "2026-06-11T12:25:52+00:00", "object_relation": "filename", "timestamp": "1783091604", "to_ids": true, "type": "filename", "uuid": "56cbf008-4aba-4767-81a4-fd3fa1ffcc19", "value": "Received from srv142.mihosting.com.txt" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098519", "uuid": "19d40a7f-4f32-4b3b-b1d3-253815cf6729", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "md5", "timestamp": "1783098519", "to_ids": true, "type": "md5", "uuid": "d658c2ac-a387-475a-b7a7-0f35baf55683", "value": "0088508bc7428e2f356c12bd54e6f6e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "sha1", "timestamp": "1783096937", "to_ids": true, "type": "sha1", "uuid": "079400ae-63a8-41d4-8ab1-de4a25f0f3e1", "value": "027aae553055e2e1e94cfb2fef6d4d9442d7714e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "sha256", "timestamp": "1783096937", "to_ids": true, "type": "sha256", "uuid": "d3537a82-44b7-4d49-95ed-5f37fe1ab34b", "value": "f028d7411d2507e887134cf74f3060460bbcfbc6afa4bb7bba16fb3d1507da74", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 03/07/2026\nLast-scan: 28/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "text", "timestamp": "1783091626", "to_ids": false, "type": "text", "uuid": "fb9945a1-5fc7-4153-a349-d59ed0976088", "value": "Type Description: MS Excel Spreadsheet\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 31/75\nFirst Submission: 2026-06-11T03:11:48+00:00\nLast Submission: 2026-06-12T07:35:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "creation-time", "timestamp": "1783091626", "to_ids": false, "type": "datetime", "uuid": "6e257807-75bd-46ba-9f16-bf55bc6434d3", "value": "2006-09-16T00:00:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "ssdeep", "timestamp": "1783091626", "to_ids": true, "type": "ssdeep", "uuid": "8519d1e3-0bc7-4463-876b-dc717ae66e41", "value": "1536:tKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhFQ6T9NVkXUqx7DpF/Gs:tn1LZvTTZGzN6YZ5wWFPqvf/G" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1783091626", "to_ids": false, "type": "size-in-bytes", "uuid": "508376b5-2db2-420d-90a9-1749581072a5", "value": "127488" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "vhash", "timestamp": "1783091626", "to_ids": true, "type": "vhash", "uuid": "55ed986e-3ccb-4063-89aa-7d2c87acb466", "value": "13c58281c7aa6f14ba8de31ef84a79f7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-11T03:11:48+00:00", "last_seen": "2026-06-12T07:35:28+00:00", "object_relation": "filename", "timestamp": "1783091626", "to_ids": true, "type": "filename", "uuid": "2e3e5820-fe67-49fe-99dc-54260fb2d37d", "value": "0001543029 - Payment Advice Note from 11.6.2026.xls" } ] } ] } }