{ "Event": { "analysis": "1", "date": "2026-07-14", "extends_uuid": "", "info": "[Threat Intel] Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers", "protected": false, "publish_timestamp": "1784553515", "published": true, "threat_level_id": "3", "timestamp": "1784553514", "uuid": "796b2803-4257-4bc3-8066-3f4272d92626", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#57356b", "local": false, "name": "misp-galaxy:producer=\"Seqrite\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Elevated Execution with Prompt - T1548.004\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Fileless Storage - T1027.011\"", "relationship_type": "" }, { "colour": "#44b2c2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Files and Directories - T1564.001\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Language Discovery - T1614.001\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784084422", "to_ids": false, "type": "link", "uuid": "795ed415-bd31-42ec-a7b8-07e054d174ec", "value": "https://www.seqrite.com/blog/operation-shadowrecruit-a-recruitment-themed-malware-campaign-leveraging-controlr-and-google-sheets-to-target-indian-job-seekers/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784084422", "to_ids": false, "type": "text", "uuid": "1ddb0b9d-ecce-4768-80fe-3d0b5e705bbf", "value": "A sophisticated cyber campaign targets Indian government job seekers using fake recruitment advertisements for Senior Field Officer positions in the Cabinet Secretariat. The attack chain begins with a malicious ZIP archive containing a disguised LNK file, PowerShell script, and .NET executable. Attackers abuse the legitimate ControlR remote management tool for persistent access and deploy SheetAgent RAT, a custom .NET malware that uses Google Sheets as a command-and-control channel. The malware employs multiple persistence mechanisms including scheduled tasks and startup folder entries, while incorporating extensive anti-analysis checks to detect virtualized environments. Infrastructure analysis reveals multiple web-based management panels and connections to APT36 based on targeting patterns and tradecraft similarities." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784084422", "to_ids": false, "type": "text", "uuid": "cc887d5c-94f2-44d8-b594-6bd2822081d2", "value": "Name: Operation ShadowRecruit: A Recruitment-Themed Malware Campaign Leveraging ControlR and Google Sheets to Target Indian Job Seekers\nAuthor: AlienVault\nAdversary: Operation C-Major\nTags: [\"scheduled task persistence\", \"controlr abuse\", \"recruitment lure\", \"indian government targeting\", \"sheetagent rat\", \"sheetagent\", \"google sheets c2\", \"anti-virtualization\", \"powershell downloader\", \"privaterat\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"India\"]\nMlwr families: [\"SheetAgent\", \"PrivateRat\"]\nAttack_ids: []\nIndustries: [\"Government\", \"Education\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784084422", "to_ids": false, "type": "threat-actor", "uuid": "a084fa70-09b6-4a63-bfa9-ce24aa38b299", "value": "Operation C-Major" } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784464473", "uuid": "71277339-df7d-4363-b877-dcb9da134870", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "md5", "timestamp": "1784464473", "to_ids": true, "type": "md5", "uuid": "41c3860a-9836-4f31-ae0a-7611e0bc100c", "value": "6bcf91af52b9577ba81cbae9368f91f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "sha1", "timestamp": "1784463655", "to_ids": true, "type": "sha1", "uuid": "92ad1dc6-af3b-4cf5-9e61-ab3b10b72158", "value": "c1a691fdd339709439774e9402b71a4b4ba50f42", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "sha256", "timestamp": "1784463655", "to_ids": true, "type": "sha256", "uuid": "a6c7dfd3-f1aa-41bc-a4cc-54913ac04d4e", "value": "ee9dd2a180aea75af5c0eda16b83681c0a5fed451bfad6d5b3af85c3b62fa210", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "text", "timestamp": "1784461255", "to_ids": false, "type": "text", "uuid": "5d728af4-6816-4903-bacb-599e5994e7b5", "value": "Type Description: Win32 EXE\nOriginal name: Extractor funtions.exe\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: Win.Malware.LNKAgent-10043840-0\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-07-01T10:08:57+00:00\nFirst Submission: 2026-06-30T08:28:24+00:00\nLast Submission: 2026-07-01T06:04:33+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "creation-time", "timestamp": "1784461255", "to_ids": false, "type": "datetime", "uuid": "ca334a95-cb62-4dc8-8e0c-b530183140f6", "value": "2090-10-18T06:04:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "ssdeep", "timestamp": "1784461255", "to_ids": true, "type": "ssdeep", "uuid": "9ceb836e-d6f3-41a1-bb13-bc3dff8c318f", "value": "24576:U5NY5TL5Hl/fFs0YeLCvPoGyO22J35NY5TL5Hl/fFs0YeLCvPoGyO22J:UYBlTs9AC3yQYBlTs9AC3y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461255", "to_ids": false, "type": "size-in-bytes", "uuid": "32315916-1dbb-4e90-92db-438f775e237d", "value": "1312256" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "vhash", "timestamp": "1784461255", "to_ids": true, "type": "vhash", "uuid": "32007a99-d22a-4b77-a99f-cb164aed84ca", "value": "2160367555157022104850901c18" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:28:24+00:00", "last_seen": "2026-07-01T06:04:33+00:00", "object_relation": "filename", "timestamp": "1784461255", "to_ids": true, "type": "filename", "uuid": "a98a738a-3530-499e-9e85-72762428e817", "value": "Extractor funtions.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784464494", "uuid": "3aaf78be-c7a4-4b4d-b0ed-304d88fecb98", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "object_relation": "md5", "timestamp": "1784464494", "to_ids": true, "type": "md5", "uuid": "7e0a0a13-54c8-4c9e-85bd-74959004c7ac", "value": "6f2fd5cb3901d6818316423ac72da5e8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "object_relation": "sha1", "timestamp": "1784463656", "to_ids": true, "type": "sha1", "uuid": "5e0cb54f-ad45-4818-b950-ba04d1cf38b3", "value": "081747ca2a2f4be07b52ab1da0c76b8e508248a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "object_relation": "sha256", "timestamp": "1784463656", "to_ids": true, "type": "sha256", "uuid": "fa5ac72c-bb1f-431c-997f-195b6daf2ef9", "value": "fd2ac3a761f66dc6954014532795f9108f65739f23e4b294d4563673b7996881", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "object_relation": "text", "timestamp": "1784461276", "to_ids": false, "type": "text", "uuid": "c9d77417-fb3b-4db5-83d9-45c79de1d7b0", "value": "Type Description: PDF\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-06-30T13:13:04+00:00\nLast Submission: 2026-06-30T13:13:04+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "object_relation": "ssdeep", "timestamp": "1784461276", "to_ids": true, "type": "ssdeep", "uuid": "e94b7603-d4b8-4668-8856-7a978d49317f", "value": "12288:ZD4sn2F93QejmJzfMjpe6JOKZkeO3fMcFzu8wxudpVsx5ZuxFl:ZD4zQBVCpeqOKZ43f9FzHpOxaV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461276", "to_ids": false, "type": "size-in-bytes", "uuid": "19c294a4-f3f0-41ce-970b-061f40bf70d8", "value": "610616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "object_relation": "vhash", "timestamp": "1784461276", "to_ids": true, "type": "vhash", "uuid": "3edd384f-aeb7-424e-aa04-5d528b9a32d0", "value": "90c5d99ec45ca43de914ebfcd954fdeb1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T13:13:04+00:00", "last_seen": "2026-06-30T13:13:04+00:00", "object_relation": "filename", "timestamp": "1784461276", "to_ids": true, "type": "filename", "uuid": "c7c21b0e-c49b-49ff-9cd7-f4677c8f14f9", "value": "file.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784464515", "uuid": "93710987-54ce-4c2f-b805-c41728e71ee2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "object_relation": "md5", "timestamp": "1784464515", "to_ids": true, "type": "md5", "uuid": "b2fd90b2-8816-4328-891e-b9745b464e77", "value": "90682a7c53132750b1517f80cab2281c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "object_relation": "sha1", "timestamp": "1784463658", "to_ids": true, "type": "sha1", "uuid": "32bc0785-649e-4d1c-8c72-e588b6be480a", "value": "a154f9bff1999be4a42ffc4cbfc686e64a163997", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "object_relation": "sha256", "timestamp": "1784463658", "to_ids": true, "type": "sha256", "uuid": "834d382f-5a58-4138-93d0-00cfc1ee8893", "value": "70fe7576f20f5dd6a3d872753c922f1394d91487f5eabb417b240b83c22e31b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "object_relation": "text", "timestamp": "1784461298", "to_ids": false, "type": "text", "uuid": "47e509e5-d1a7-4919-9aba-4a89a0668993", "value": "Type Description: Powershell\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 17/74\nFirst Submission: 2026-06-30T08:27:19+00:00\nLast Submission: 2026-07-01T06:00:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "object_relation": "ssdeep", "timestamp": "1784461298", "to_ids": true, "type": "ssdeep", "uuid": "a073293b-1a75-48aa-aebb-cb2cac0f13bb", "value": "48:QpSqg8fySfX0fq9LfqwVfqhbr7rywX3EL+QVGkc2B6HBf:QE8fyN4xkrywXUU2Bc" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461298", "to_ids": false, "type": "size-in-bytes", "uuid": "ec67e501-ef73-47d9-ac99-644afc199493", "value": "1717" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "object_relation": "vhash", "timestamp": "1784461298", "to_ids": true, "type": "vhash", "uuid": "7a1985e7-e1d1-45dd-b034-7a303a1a4fee", "value": "4ff2a78864232305bcd51d29a60b5c2e" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:27:19+00:00", "last_seen": "2026-07-01T06:00:52+00:00", "object_relation": "filename", "timestamp": "1784461298", "to_ids": true, "type": "filename", "uuid": "1a8c5171-5397-4e8f-b919-65bad01c8a22", "value": "JT-agenda.ps1" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784464536", "uuid": "4836fe49-2af4-4f5f-abc0-af7398660818", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "object_relation": "md5", "timestamp": "1784464536", "to_ids": true, "type": "md5", "uuid": "fbbf7b49-2383-4564-9cb5-8b6d2a3574ca", "value": "43a6e1e5be37b1f35071c5a5864b0994", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "object_relation": "sha1", "timestamp": "1784463658", "to_ids": true, "type": "sha1", "uuid": "2d9096aa-ad67-4f78-a29e-2df8f57145b9", "value": "ff0660795fff7404b1d927488cd558deb24a2e68", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "object_relation": "sha256", "timestamp": "1784463658", "to_ids": true, "type": "sha256", "uuid": "93129427-85a8-49e8-9940-7b3b043ed17d", "value": "2b33b5185e93e1655eb27dbaa025d7ee088627db3d640fe4709be705646b189c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "object_relation": "text", "timestamp": "1784461319", "to_ids": false, "type": "text", "uuid": "570e483d-4322-490c-a7bf-b1d61789ad5d", "value": "Type Description: ZIP\nMicrosoft: Trojan:Win32/Suschil!rfn\nClamAV: Win.Malware.LNKAgent-10043840-0\nVT Total Detection: 48/74\nFirst Submission: 2026-06-30T09:41:47+00:00\nLast Submission: 2026-06-30T11:21:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "object_relation": "ssdeep", "timestamp": "1784461319", "to_ids": true, "type": "ssdeep", "uuid": "9f613100-d86a-48ba-a200-c14c5316cdfb", "value": "24576:jXpq8wceHl/egGvIgGyE2EH/Zad6dyh5Hl/mqtLv4Gyeol2GMhsrvQF:j5q558TQHEFv4GLm2G90F" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461319", "to_ids": false, "type": "size-in-bytes", "uuid": "5d1966a2-5f19-4ef3-914f-0bab2f31bc8d", "value": "1220796" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "object_relation": "vhash", "timestamp": "1784461319", "to_ids": true, "type": "vhash", "uuid": "a3badb8e-3dec-4ea3-bf3f-5d227403d7fb", "value": "fd993c15ba640e2c186f2904fe6d92ba" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T09:41:47+00:00", "last_seen": "2026-06-30T11:21:19+00:00", "object_relation": "filename", "timestamp": "1784461319", "to_ids": true, "type": "filename", "uuid": "67275c6d-2416-46e4-8e9a-e5ca5418aa13", "value": "Unconfirmed 424662.crdownload" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784464558", "uuid": "94da0a26-95b8-4322-81b5-867d842e0e28", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "object_relation": "md5", "timestamp": "1784464558", "to_ids": true, "type": "md5", "uuid": "5a5fc5a4-fb99-4907-b67e-703fabe99dcb", "value": "314a1d32650361281d86aa8175c05df4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "object_relation": "sha1", "timestamp": "1784463660", "to_ids": true, "type": "sha1", "uuid": "96257bed-a1b4-4951-941c-53c8dcdceb34", "value": "8b33d02e51218461cce1311760c1dd138f9731f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "object_relation": "sha256", "timestamp": "1784463660", "to_ids": true, "type": "sha256", "uuid": "afe66c91-b2b5-4c5a-b0fe-e8ec2e4f8513", "value": "434243e615b93a1b948c26ad55902bd78f9fa18e42375c15790634375c1ad3f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "object_relation": "text", "timestamp": "1784461341", "to_ids": false, "type": "text", "uuid": "b8ee8320-de49-40b3-868d-67aee40b935b", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/WinLNK.GVAC!MTB\nClamAV: None\nVT Total Detection: 31/74\nFirst Seen In The Wild: 2026-06-30T11:43:12+00:00\nFirst Submission: 2026-06-30T09:42:06+00:00\nLast Submission: 2026-06-30T09:42:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "object_relation": "ssdeep", "timestamp": "1784461341", "to_ids": true, "type": "ssdeep", "uuid": "3f375a7b-a2c8-4c23-83dd-874a8e1ac636", "value": "24:8ltnHYVKVWhkTe/CWK+iTlqddqVRXuHYd/elgR:8DHahkKd0rXuHmel" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461341", "to_ids": false, "type": "size-in-bytes", "uuid": "2b0057ac-c621-44aa-8923-20ef940a3762", "value": "2080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "object_relation": "vhash", "timestamp": "1784461341", "to_ids": true, "type": "vhash", "uuid": "119a7e65-8344-4cea-8da4-e4520af2a52b", "value": "217605457b4a7efe1cfb133db8bc6b4c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T09:42:06+00:00", "last_seen": "2026-06-30T09:42:06+00:00", "object_relation": "filename", "timestamp": "1784461341", "to_ids": true, "type": "filename", "uuid": "4529793c-1a4f-4c38-b681-2329ff1e7801", "value": "Document-24062026-Y6352634.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784464579", "uuid": "f0eff68c-4400-4908-99b6-f027757753eb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "md5", "timestamp": "1784464579", "to_ids": true, "type": "md5", "uuid": "4aacfc02-5aad-4392-ad4b-a6f975273be0", "value": "3d06209ab0e61492e7f5d92d253cea7d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "sha1", "timestamp": "1784463662", "to_ids": true, "type": "sha1", "uuid": "1b361b50-2d53-4c79-875b-051801959540", "value": "cfdb95a0280177579197793d68ad504c05964d9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "sha256", "timestamp": "1784463662", "to_ids": true, "type": "sha256", "uuid": "af87331d-454c-4090-a056-4eefc73d736d", "value": "b928e523b51187b932e48a65d36ce3d0c39ee9d409d493b90f98cf3d1e0e73b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "text", "timestamp": "1784461363", "to_ids": false, "type": "text", "uuid": "d6597ed1-291c-4ba6-9e7a-6577f6093273", "value": "Type Description: Win32 EXE\nOriginal name: MicrosoftSyncService.exe\nMicrosoft: Trojan:MSIL/ShadowRecruit.GVC!MTB\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-06-30T08:29:30+00:00\nLast Submission: 2026-06-30T08:29:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "creation-time", "timestamp": "1784461363", "to_ids": false, "type": "datetime", "uuid": "9b49eb92-d9a5-40f5-a625-e5cf4eef6acd", "value": "2043-10-15T03:23:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "ssdeep", "timestamp": "1784461363", "to_ids": true, "type": "ssdeep", "uuid": "481447fb-6073-49e9-9ff2-a5a024de4572", "value": "12288:9Ms9dFmeY5EOhP5ymHl/fFs0Y1kL0HvPoR1GytQQu0bnCPhguGNvcRO:95NY5TL5Hl/fFs0YeLCvPoGyO22J" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461363", "to_ids": false, "type": "size-in-bytes", "uuid": "dac2a310-4da8-4b39-b533-372d1994ea00", "value": "638464" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "vhash", "timestamp": "1784461363", "to_ids": true, "type": "vhash", "uuid": "87a75c5f-dc8e-4681-87dd-a257958bcc06", "value": "26503675151200d41e1e40dc" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:29:30+00:00", "last_seen": "2026-06-30T08:29:30+00:00", "object_relation": "filename", "timestamp": "1784461363", "to_ids": true, "type": "filename", "uuid": "f100624b-6982-4b31-8b90-884dcb9cd229", "value": "MicrosoftSyncService.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784464600", "uuid": "c6196714-813b-4d1c-84a6-bb9fc9c2da1f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "md5", "timestamp": "1784464600", "to_ids": true, "type": "md5", "uuid": "90ede1af-cf03-4ad2-b746-eed712de3a7a", "value": "f570cb086af5ef2b4b9fbad20f43cf1d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "sha1", "timestamp": "1784463663", "to_ids": true, "type": "sha1", "uuid": "c6f15390-2790-4aa3-aadd-daab62011d58", "value": "a8a43bde8b126141b503e605dfb6851464cf386f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "sha256", "timestamp": "1784463663", "to_ids": true, "type": "sha256", "uuid": "90172ed2-f313-483c-addc-42e39f10ad36", "value": "c4859db541b2bd0d266bbc44fafb5a767c862a57a3633a949dfaeebdf88ed529", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 19/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "text", "timestamp": "1784461384", "to_ids": false, "type": "text", "uuid": "03592e9d-b073-4cd3-b1fe-bee575bfd1c6", "value": "Type Descriptio%WINDIR%\\shortcut\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: Win.Malware.LNKAgent-10043840-0\nVT Total Detection: 38/74\nFirst Submission: 2026-06-30T08:37:42+00:00\nLast Submission: 2026-06-30T08:37:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "creation-time", "timestamp": "1784461384", "to_ids": false, "type": "datetime", "uuid": "7e463156-c37b-4dee-9949-17b7df6af9e2", "value": "2026-06-23T19:30:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "ssdeep", "timestamp": "1784461384", "to_ids": true, "type": "ssdeep", "uuid": "26b8f82b-524e-4e65-b393-f7e8d5bd7fa8", "value": "24:8WLcHaHGFqvWJ2KxWdPAKPWC+/CWQirVjfZ/18UMkW91SqddNXuHY8iD8D6:8WPmwWQCKMF/18HV1xdLXuHM66" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461384", "to_ids": false, "type": "size-in-bytes", "uuid": "5f0ce7f3-115f-4172-836e-67b29e37239d", "value": "2369" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "vhash", "timestamp": "1784461384", "to_ids": true, "type": "vhash", "uuid": "e453b022-b7a8-4edc-9d4b-da8b5bff9713", "value": "71802e46a1f81169eb6829f29496fd42" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:37:42+00:00", "last_seen": "2026-06-30T08:37:42+00:00", "object_relation": "filename", "timestamp": "1784461384", "to_ids": true, "type": "filename", "uuid": "bdcc096d-bfbf-4cc2-8b27-dc6b2e1b8a20", "value": "document.lnk" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784464621", "uuid": "60356d3f-cf57-476d-ba24-9f7e7dfb7882", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "md5", "timestamp": "1784464621", "to_ids": true, "type": "md5", "uuid": "719d22c2-2dcd-4dcf-a8fc-cbda78c19f08", "value": "720ccdba0490592274a7ba3b3e838e6d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "sha1", "timestamp": "1784463665", "to_ids": true, "type": "sha1", "uuid": "ba80bcca-6194-44ef-96a9-c187a43e58ec", "value": "c20cd3570458ca25f2f226ffc29635c58b172045", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "sha256", "timestamp": "1784463665", "to_ids": true, "type": "sha256", "uuid": "f7cd0397-920b-4e97-8343-981971a58f6b", "value": "cf3f1bceb83fa3acefbabae4bdc275347cfe03dd7fc770052a33baef204a89f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "text", "timestamp": "1784461407", "to_ids": false, "type": "text", "uuid": "7ea58331-57f0-49f2-a9fb-3e872aa71e87", "value": "Type Description: Win32 EXE\nOriginal name: ControlR.Agent.Installer.dll\nVerified: Signed\nSigning date: 09:03 PM 06/27/2026\nSigners: Bitbound; GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-06-30T08:35:07+00:00\nLast Submission: 2026-06-30T08:35:07+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "creation-time", "timestamp": "1784461407", "to_ids": false, "type": "datetime", "uuid": "703f216c-d0f1-4e86-b14f-117531b94f59", "value": "2026-05-20T19:08:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "ssdeep", "timestamp": "1784461407", "to_ids": true, "type": "ssdeep", "uuid": "81d653c3-e783-4982-a4e8-311f839e9a2f", "value": "786432:B86XtSGmctRbAEk5KM0QJStg8cVXOQf0Whdl6F8ItxlxHIPi5f4/0ag:BdsnctRbAEk5KM0BW84OQf0IM8IroPin" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1784461407", "to_ids": false, "type": "size-in-bytes", "uuid": "c92c0210-2afd-489f-af31-cf006b74014a", "value": "42717648" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "vhash", "timestamp": "1784461407", "to_ids": true, "type": "vhash", "uuid": "9b5ccbaa-6e84-40b9-af33-c554972ed1eb", "value": "04709666155d156d1d056148zc7z111b5z13z2dz2c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-30T08:35:07+00:00", "last_seen": "2026-06-30T08:35:07+00:00", "object_relation": "filename", "timestamp": "1784461407", "to_ids": true, "type": "filename", "uuid": "bd82eb96-1bc8-4047-ab9f-199bca157ca5", "value": "ControlR.Agent.Installer.dll" } ] } ] } }