{ "Event": { "analysis": "1", "date": "2026-07-15", "extends_uuid": "", "info": "[Threat Intel] June 2026 Infostealer Trend Report", "protected": false, "publish_timestamp": "1784553527", "published": true, "threat_level_id": "3", "timestamp": "1784553527", "uuid": "7b384126-5bb4-48eb-aca2-16c85f5c7271", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#bb889f", "local": false, "name": "misp-galaxy:producer=\"AhnLab\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#bb2745", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#36a9d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#7628f7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#15723e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Launch Agent - T1543.001\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#8d021b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#150050", "local": false, "name": "rectifyq:sub-category=\"report\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#fdcb58", "local": false, "name": "rectifyq:MY-relevancy=\"somewhat-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AMOS\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Lumma Stealer\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remus\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Vidar\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784170854", "to_ids": false, "type": "link", "uuid": "03c3ec69-658b-4060-9559-6429363a9e99", "value": "https://asec.ahnlab.com/en/94486/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784170854", "to_ids": false, "type": "text", "uuid": "9302bd40-0227-4fd6-a57d-dece6c87db73", "value": "During June 2026, multiple infostealer families including Remus, ACRStealer, LummaC2, and Vidar were distributed through SEO poisoning techniques, disguised as illegal software such as cracks and keygens. Attacks utilized EXE files (84.5%) and DLL side-loading (15.5%) methods, with distribution primarily through Mediafire, Mega, and cloud storage platforms. Microsoft Corporation was the most frequently impersonated entity. MacOS environments were targeted through ClickFix techniques and malicious Bash scripts, with one variant dynamically obtaining C2 addresses via Polygon smart contracts. Email-based campaigns distributed AgentTesla and DarkCloud through compressed attachments, with both variants exfiltrating data via SMTP. The stolen credentials pose significant risks for dark web trading and secondary attacks." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784170854", "to_ids": false, "type": "text", "uuid": "2f52ff18-7179-4f59-8165-48aa06df30f8", "value": "Name: June 2026 Infostealer Trend Report\nAuthor: AlienVault\nAdversary: \nTags: [\"darkcloud\", \"vidar\", \"email campaign\", \"acrstealer\", \"clickfix\", \"seo poisoning\", \"amos\", \"credential theft\", \"blockchain c2\", \"agenttesla\", \"lummac2\", \"remus\", \"macos targeting\", \"infostealer\", \"dll side-loading\"]\nTgtd countries: []\nMlwr families: [\"Remus\", \"ACRStealer\", \"LummaC2\", \"Vidar\", \"AgentTesla\", \"DarkCloud\", \"AMOS\"]\nAttack_ids: [\"T1113\", \"T1033\", \"T1132.001\", \"T1056.001\", \"T1539\", \"T1204.002\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1555\", \"T1016\", \"T1087\", \"T1083\", \"T1041\", \"T1059.004\", \"T1027\", \"T1543.001\", \"T1071.001\", \"T1574.002\", \"T1102.001\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784470208", "to_ids": true, "type": "domain", "uuid": "e04fd7d7-f7a9-422c-88c9-67d1350aa5bc", "value": "apdhlhs3.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784552805", "to_ids": true, "type": "domain", "uuid": "2bd431fc-0e0e-4a58-97b7-b010d5cc0c1b", "value": "bduwih8.pro", "Tag": [ { "colour": "#81bddc", "local": false, "name": "QuotaExceededError", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784552827", "to_ids": true, "type": "domain", "uuid": "574ddf7f-3e0b-4372-a974-dddc13d9025c", "value": "johncon.my", "Tag": [ { "colour": "#81bddc", "local": false, "name": "QuotaExceededError", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 19/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784463718", "to_ids": true, "type": "md5", "uuid": "31c98b71-0c14-440d-9a48-47a92f85c517", "value": "04d91c168c7617c38199983858cfbb4e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784552848", "uuid": "2e42ae9b-3cae-4a02-9229-63a1cb4ed128", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "object_relation": "md5", "timestamp": "1784552848", "to_ids": true, "type": "md5", "uuid": "0c74b969-e131-4d24-b706-3323fff30abb", "value": "042db31ea5443d78aeee714556813a28", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#81bddc", "local": false, "name": "QuotaExceededError", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "object_relation": "sha1", "timestamp": "1784463713", "to_ids": true, "type": "sha1", "uuid": "a8d33c00-2bd2-4fc3-99e4-dde34fe32448", "value": "c8c80cde1ae90d6a594980e117977437de97ebb1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "object_relation": "sha256", "timestamp": "1784463713", "to_ids": true, "type": "sha256", "uuid": "616590c4-63ce-4052-91dd-3e3e48e8441c", "value": "d15248555e7a2d9c279d219e6587a74fca9c25720194512a2e4b0757f7a63219", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "object_relation": "text", "timestamp": "1784462171", "to_ids": false, "type": "text", "uuid": "334b1f50-ec0b-41a6-83ec-a3878730a159", "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/Obfus!MSR\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2026-06-12T22:00:29+00:00\nLast Submission: 2026-07-01T10:51:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "object_relation": "ssdeep", "timestamp": "1784462171", "to_ids": true, "type": "ssdeep", "uuid": "6fab558d-9cde-4a50-b5ed-b7610f955598", "value": "98304:WN0skRnKgp59g7QgAeTLF3JQ3NuZXCwkdwZb2D4M38rOEH2xf7qRQHyCzzE9CX:WNIPpDvWJ5/P68rOwRuHyC/ICX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "object_relation": "size-in-bytes", "timestamp": "1784462171", "to_ids": false, "type": "size-in-bytes", "uuid": "dbe7c58a-e719-46f1-901b-d379533bf960", "value": "6609631" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "object_relation": "vhash", "timestamp": "1784462171", "to_ids": true, "type": "vhash", "uuid": "0ad3c518-159d-4088-82c8-20357b632913", "value": "6c4c0b0fd95888b606efe46530bf94f8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T22:00:29+00:00", "last_seen": "2026-07-01T10:51:01+00:00", "object_relation": "filename", "timestamp": "1784462171", "to_ids": true, "type": "filename", "uuid": "35fb3229-7cdc-4616-8246-e97a8f62950c", "value": "RFQ SUPPLY - PIPE AND FITTINGS.JS" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784552869", "uuid": "4d84fff5-b573-483d-a968-0db3bd7e4a8f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "md5", "timestamp": "1784552869", "to_ids": true, "type": "md5", "uuid": "a37ba17f-d5ce-4db3-9cd0-e0f7b778594c", "value": "02c7d78e6c5816f1df250f995a776aa2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#81bddc", "local": false, "name": "QuotaExceededError", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "sha1", "timestamp": "1784463715", "to_ids": true, "type": "sha1", "uuid": "b079169f-815f-41a9-9385-876aba7bd44b", "value": "076096925cf1148eff80605620224860dfb85c5e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "sha256", "timestamp": "1784463715", "to_ids": true, "type": "sha256", "uuid": "dcecac59-c6e9-4208-8b46-d41f1dcd742b", "value": "0af4a196760707c94a86a3ba87d999e405408b4c13c98f94a4d66e488cdef023", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 13/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "text", "timestamp": "1784462193", "to_ids": false, "type": "text", "uuid": "145f1c38-b703-49eb-8801-30f15dc08c61", "value": "Type Description: Win32 DLL\nOriginal name: logviewer.exe\nVerified: The digital signature of the object did not verify.\nSigning date: 03:53 AM 03/06/2026\nSigners: Amazon.com Services LLC; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-06-12T06:09:09+00:00\nLast Submission: 2026-06-12T20:14:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "creation-time", "timestamp": "1784462193", "to_ids": false, "type": "datetime", "uuid": "60bf4d2c-25ae-49ec-b8a9-4453dc4d9644", "value": "2018-06-27T04:07:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "ssdeep", "timestamp": "1784462193", "to_ids": true, "type": "ssdeep", "uuid": "5e8b0a16-61ce-41e9-b441-76cad0961a3f", "value": "98304:Jv+vLbe8BAWhHwMZ0U8cOzjQUF6NJzVr7EWA1xW1q:J2Z0p6NJzV3EWuQ1q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784462193", "to_ids": false, "type": "size-in-bytes", "uuid": "f0a58d1b-3986-40eb-a042-d201009da5b0", "value": "401876148" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "vhash", "timestamp": "1784462193", "to_ids": true, "type": "vhash", "uuid": "60368a69-34dc-4942-8444-2b5554c2685f", "value": "148056655d55557198z82jz23z33z34z60c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-12T06:09:09+00:00", "last_seen": "2026-06-12T20:14:49+00:00", "object_relation": "filename", "timestamp": "1784462193", "to_ids": true, "type": "filename", "uuid": "e05823fa-daa3-4a48-914e-7b65422a8365", "value": "logviewer.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784552890", "uuid": "1aeee368-fda9-485c-86e8-74c2c963bde4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "md5", "timestamp": "1784552890", "to_ids": true, "type": "md5", "uuid": "6f4ea8c6-9adc-4fab-a2ca-fbc6eb0ae07b", "value": "03663f2f81da94cd204837e4bde772ff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#81bddc", "local": false, "name": "QuotaExceededError", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "sha1", "timestamp": "1784463716", "to_ids": true, "type": "sha1", "uuid": "19fec1a1-bb19-4f1d-bc16-50ee28a0e759", "value": "9f8e7f2088faad9960bbd83dc6744afd34ff19a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "sha256", "timestamp": "1784463716", "to_ids": true, "type": "sha256", "uuid": "63f2f20c-5ec0-4e16-bd14-eaabca62ecc8", "value": "02e03571983f70b709c7e9f6d022cc48458ec98a5bc0c2c460fb5c1b3b9281a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 20/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "text", "timestamp": "1784462214", "to_ids": false, "type": "text", "uuid": "31131577-9deb-47e4-9821-3a3f06fac21e", "value": "Type Description: Win32 DLL\nOriginal name: StarterScriptEditor.exe\nVerified: The digital signature of the object did not verify.\nSigning date: 09:30 PM 04/30/2026\nSigners: Cockos Incorporated; SSL.com EV Code Signing Intermediate CA RSA R3; SSL.com EV Root Certification Authority RSA R2\nMicrosoft: None\nClamAV: None\nVT Total Detection: 20/74\nFirst Submission: 2026-06-05T14:41:03+00:00\nLast Submission: 2026-06-06T08:31:05+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "creation-time", "timestamp": "1784462214", "to_ids": false, "type": "datetime", "uuid": "188acef4-b130-4468-afd9-5a767074eb47", "value": "2018-06-27T04:07:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "ssdeep", "timestamp": "1784462214", "to_ids": true, "type": "ssdeep", "uuid": "e8362b71-4545-46b8-bea0-d8a8288976f7", "value": "196608:JVZATHG6YS0POIqb/SuqDliC902HxlZFRlDKDCNfU9WJJHKc2wa61s0u35:JUTmBooiCvxlZvT4cxGx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "size-in-bytes", "timestamp": "1784462214", "to_ids": false, "type": "size-in-bytes", "uuid": "d7aebc7b-5deb-483a-a90f-a541b7a4e14a", "value": "450424918" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "vhash", "timestamp": "1784462214", "to_ids": true, "type": "vhash", "uuid": "bdade8a9-53a9-42c2-96e9-e0337bfe92ee", "value": "148056655d55557198z82jz23z33z34z60c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T14:41:03+00:00", "last_seen": "2026-06-06T08:31:05+00:00", "object_relation": "filename", "timestamp": "1784462214", "to_ids": true, "type": "filename", "uuid": "20c37ae2-a530-40cd-b76d-1e248efe6c34", "value": "StarterScriptEditor.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-05T02:46:38+00:00", "last_seen": "2026-06-06T18:03:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784552911", "uuid": "a7e55894-4ef2-41cc-bf46-dbb696f0ef3d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T02:46:38+00:00", "last_seen": "2026-06-06T18:03:29+00:00", "object_relation": "md5", "timestamp": "1784552911", "to_ids": true, "type": "md5", "uuid": "d89b75d2-2175-487c-ac85-44781214ec17", "value": "03e99ceede013fe1b50a0e06c1f0a02c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#81bddc", "local": false, "name": "QuotaExceededError", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T02:46:38+00:00", "last_seen": "2026-06-06T18:03:29+00:00", "object_relation": "sha1", "timestamp": "1784463717", "to_ids": true, "type": "sha1", "uuid": "de3d5a30-97e3-45d4-abdf-955ed495da99", "value": "dbe028a59ffe936bce9acb56e9c2db93ef6f84fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T02:46:38+00:00", "last_seen": "2026-06-06T18:03:29+00:00", "object_relation": "sha256", "timestamp": "1784463717", "to_ids": true, "type": "sha256", "uuid": "d531d011-0345-45d3-8231-3e53e78675d4", "value": "ac14d191300c2d3aa9f57829b895b7720be1ef3563bace25de731002d52577f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 19/07/2026\nLast-scan: 26/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T02:46:38+00:00", "last_seen": "2026-06-06T18:03:29+00:00", "object_relation": "text", "timestamp": "1784462235", "to_ids": false, "type": "text", "uuid": "f92484df-6353-4869-b9d2-93ba23a7d162", "value": "Type Description: Text\nMicrosoft: Trojan:Win32/Leonem!rfn\nClamAV: None\nVT Total Detection: 27/75\nFirst Submission: 2026-06-05T02:46:38+00:00\nLast Submission: 2026-06-06T18:03:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-05T02:46:38+00:00", "last_seen": "2026-06-06T18:03:29+00:00", "object_relation": "ssdeep", "timestamp": "1784462235", "to_ids": true, "type": "ssdeep", "uuid": "fef38fe4-6b51-464b-980f-efef2be8b0ff", "value": "3072:4qkeNLk8pDNTjDkADd44TAihc/ZPsBU7nIcyGyJSkn8rUqxoYsKAE0uuHwcM+:NdNLrVHkUjwpsW/onUxooF0jwcb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T02:46:38+00:00", "last_seen": "2026-06-06T18:03:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1784462235", "to_ids": false, "type": "size-in-bytes", "uuid": "12d94d6d-2b55-471f-b3d3-2a6ca9c884b8", "value": "164947" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-05T02:46:38+00:00", "last_seen": "2026-06-06T18:03:29+00:00", "object_relation": "filename", "timestamp": "1784462235", "to_ids": true, "type": "filename", "uuid": "7d2e47ec-ca2a-4d3a-8851-85a59c102600", "value": "RFQ_EQ26-189_ D5160747.bat" } ] } ] } }