{ "Event": { "analysis": "1", "date": "2026-07-09", "extends_uuid": "", "info": "[Threat Intel] One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement", "protected": false, "publish_timestamp": "1784349322", "published": true, "threat_level_id": "2", "timestamp": "1784349322", "uuid": "7cc91f5a-c282-448e-bde8-ee57fab7cb33", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#75e21e", "local": false, "name": "misp-galaxy:producer=\"SentinelOne\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#7773ac", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "relationship_type": "" }, { "colour": "#77a4ec", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#fe1ef0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#3780c6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"User Execution - T1204\"", "relationship_type": "" }, { "colour": "#1b95cd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#bf2644", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Server Software Component - T1505\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#670cf4", "local": false, "name": "misp-galaxy:target-information=\"Pakistan\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"india\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#1c006d", "local": false, "name": "rectifyq:topic=\"geopolitical\"", "relationship_type": "" }, { "colour": "#d92121", "local": false, "name": "rectifyq:target=\"targeted\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AsyncRAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Cobalt Strike\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"PlugX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ShadowPad\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783681211", "to_ids": false, "type": "link", "uuid": "7b694406-80d5-4452-a067-1d3df44accec", "value": "https://www.sentinelone.com/labs/one-target-china-india-espionage-converge-on-pakistani-law-enforcement/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783681211", "to_ids": false, "type": "text", "uuid": "ea9a2df9-fb18-4223-a3b3-72efc06589b9", "value": "Between February 2024 and April 2026, multiple cyberespionage actors, suspected to be China-nexus and India-nexus threat groups, conducted sustained intrusions into Pakistani law enforcement organizations, particularly Balochistan Police. The compromised infrastructure included network appliances and servers hosting web applications managing criminal records, biometric data, hotel registrations, and citizen complaints. A suspected China-nexus actor weaponized the Complaint Management System web application by deploying custom implants disguised as portal updates, targeting both police personnel and citizens. China's likely motivation stems from concerns over the safety of Chinese nationals in Pakistan, particularly regarding attacks by separatist groups. India's suspected interest relates to its adversarial relationship with Pakistan, with Balochistan Police offering intelligence on security operations in a strategically sensitive province. The attackers deployed PlugX, ShadowPad, Cobalt Strike, Remcos, an..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783681211", "to_ids": false, "type": "text", "uuid": "24e03dc0-510a-4910-987b-97b931c6f2ae", "value": "Name: One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement\nAuthor: AlienVault\nAdversary: TAG-179\nTags: [\"pakistan\", \"china-nexus\", \"india-nexus\", \"law enforcement targeting\", \"shadowpad\", \"remcos\", \"asyncrat\", \"balochistan police\", \"cyberespionage\", \"cobalt strike\", \"plugx\"]\nTgtd countries: [\"Pakistan\"]\nMlwr families: [\"PlugX - S0013\", \"Thoper\", \"TVT\", \"DestroyRAT\", \"Sogu\", \"Kaba\", \"Korplug\", \"ShadowPad - S0596\", \"POISONPLUG.SHADOW\", \"Cobalt Strike - S0154\", \"Remcos\", \"AsyncRAT\"]\nAttack_ids: [\"T1133\", \"T1114\", \"T1036.005\", \"T1204.002\", \"T1566.001\", \"T1071\", \"T1005\", \"T1190\", \"T1036\", \"T1505.003\", \"T1059\", \"T1204\", \"T1566\", \"T1027\", \"T1573\", \"T1505\", \"T1071.001\"]\nIndustries: [\"Government\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783681211", "to_ids": false, "type": "threat-actor", "uuid": "f50bf16e-9ea5-45c6-ba3f-f8e8ec3cc10f", "value": "TAG-179" }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS3223 voxility llp", "deleted": false, "disable_correlation": false, "timestamp": "1784348454", "to_ids": true, "type": "ip-dst", "uuid": "20ce53cc-baca-47a5-9cd2-394402589ec4", "value": "172.94.9.19", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784348475", "to_ids": true, "type": "hostname", "uuid": "dd230572-77b4-43d9-bf5b-ad921fd7f50a", "value": "cms.balochistanpolice.gov.pk", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS9009 m247 ltd", "deleted": false, "disable_correlation": false, "timestamp": "1784348496", "to_ids": true, "type": "ip-dst", "uuid": "09c1ce78-b2b4-489b-bd6b-4681af7227c8", "value": "172.111.233.105", "Tag": [ { "colour": "#64bed2", "local": false, "name": "asn:asn=\"9009\"", "relationship_type": "" }, { "colour": "#41c276", "local": false, "name": "asn:as-owner=\"M247\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS9009 m247 ltd", "deleted": false, "disable_correlation": false, "timestamp": "1784348517", "to_ids": true, "type": "ip-dst", "uuid": "fcab63fb-dc37-4910-846f-5690cfd789a6", "value": "172.111.233.96", "Tag": [ { "colour": "#64bed2", "local": false, "name": "asn:asn=\"9009\"", "relationship_type": "" }, { "colour": "#41c276", "local": false, "name": "asn:as-owner=\"M247\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=CA ASN=AS577 bell canada", "deleted": false, "disable_correlation": false, "timestamp": "1784348538", "to_ids": true, "type": "ip-dst", "uuid": "0fe80d31-ab47-48ca-8bea-096961539c38", "value": "142.171.183.8", "Tag": [ { "colour": "#2e9721", "local": false, "name": "asn:asn=\"35916\"", "relationship_type": "" }, { "colour": "#997cc2", "local": false, "name": "asn:as-owner=\"MULTA-ASN1\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS9009 m247 ltd", "deleted": false, "disable_correlation": false, "timestamp": "1784348559", "to_ids": true, "type": "ip-dst", "uuid": "c0900d83-6368-4625-acce-4dc7a8bda15e", "value": "172.111.233.12", "Tag": [ { "colour": "#64bed2", "local": false, "name": "asn:asn=\"9009\"", "relationship_type": "" }, { "colour": "#41c276", "local": false, "name": "asn:as-owner=\"M247\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=HK ASN=AS55933 cloudie limited", "deleted": false, "disable_correlation": false, "timestamp": "1784348580", "to_ids": true, "type": "ip-dst", "uuid": "b6eab745-be60-4493-9e82-7729be233b1e", "value": "193.42.25.65", "Tag": [ { "colour": "#89180a", "local": false, "name": "asn:asn=\"55933\"", "relationship_type": "" }, { "colour": "#8d5bf4", "local": false, "name": "asn:as-owner=\"CLOUDIE-AS-AP Cloudie Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=HK ASN=AS55933 cloudie limited", "deleted": false, "disable_correlation": false, "timestamp": "1784348602", "to_ids": true, "type": "ip-dst", "uuid": "6d5aee6c-59a4-4957-8e35-638184c857a3", "value": "45.125.32.218", "Tag": [ { "colour": "#89180a", "local": false, "name": "asn:asn=\"55933\"", "relationship_type": "" }, { "colour": "#8d5bf4", "local": false, "name": "asn:as-owner=\"CLOUDIE-AS-AP Cloudie Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=RS ASN=AS9009 m247 ltd", "deleted": false, "disable_correlation": false, "timestamp": "1784348624", "to_ids": true, "type": "ip-dst", "uuid": "00bc085b-bad4-49b2-9e72-aba10133e84e", "value": "89.31.121.220", "Tag": [ { "colour": "#64bed2", "local": false, "name": "asn:asn=\"9009\"", "relationship_type": "" }, { "colour": "#41c276", "local": false, "name": "asn:as-owner=\"M247\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS3223 voxility llp", "deleted": false, "disable_correlation": false, "timestamp": "1784348645", "to_ids": true, "type": "ip-dst", "uuid": "cbc2b3be-2531-4744-b3de-5e70cfdb275a", "value": "172.94.9.43", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DE ASN=AS3223 voxility llp", "deleted": false, "disable_correlation": false, "timestamp": "1784348666", "to_ids": true, "type": "ip-dst", "uuid": "b4d21523-51ed-4ef4-b89e-58eb8dd2a519", "value": "172.94.9.49", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784348687", "to_ids": true, "type": "ip-dst", "uuid": "bca36905-c26e-4787-a01f-05d92cc3bf90", "value": "41.216.188.140", "Tag": [ { "colour": "#4eed01", "local": false, "name": "asn:asn=\"211138\"", "relationship_type": "" }, { "colour": "#36e30c", "local": false, "name": "asn:as-owner=\"PRIVATEHOSTING-NET\"", "relationship_type": "" }, { "colour": "#c4c131", "local": false, "name": "asn:as-country=\"IT\"", "relationship_type": "" }, { "colour": "#224d6a", "local": false, "name": "misp-galaxy:country=\"italy\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784348708", "to_ids": true, "type": "url", "uuid": "17c310b8-e0aa-4c18-a9a3-49fa2efcca1a", "value": "http://cms.balochistanpolice.gov.pk/client%20scripts/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784348729", "to_ids": true, "type": "url", "uuid": "8760d81a-fe39-4c6a-a132-b2d11064de72", "value": "http://cms.balochistanpolice.gov.pk/client%20scripts/cms_plugin.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS9009 m247 ltd", "deleted": false, "disable_correlation": false, "timestamp": "1784348750", "to_ids": true, "type": "ip-dst", "uuid": "30c2a8d6-c33c-4498-8e2f-b2317f653ddf", "value": "172.111.233.26", "Tag": [ { "colour": "#64bed2", "local": false, "name": "asn:asn=\"9009\"", "relationship_type": "" }, { "colour": "#41c276", "local": false, "name": "asn:as-owner=\"M247\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS9009 m247 ltd", "deleted": false, "disable_correlation": false, "timestamp": "1784348771", "to_ids": true, "type": "ip-dst", "uuid": "f7b4cf60-c4be-4f7b-ab15-ab01cec63e90", "value": "172.111.233.36", "Tag": [ { "colour": "#64bed2", "local": false, "name": "asn:asn=\"9009\"", "relationship_type": "" }, { "colour": "#41c276", "local": false, "name": "asn:as-owner=\"M247\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=BE ASN=AS9009 m247 ltd", "deleted": false, "disable_correlation": false, "timestamp": "1784348792", "to_ids": true, "type": "ip-dst", "uuid": "3cfa640d-18e1-471c-8c48-547759a9ba51", "value": "45.74.6.17", "Tag": [ { "colour": "#64bed2", "local": false, "name": "asn:asn=\"9009\"", "relationship_type": "" }, { "colour": "#41c276", "local": false, "name": "asn:as-owner=\"M247\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784348813", "to_ids": true, "type": "url", "uuid": "aa409b56-33a4-4f8f-94ba-bd4a9a5a58bb", "value": "https://cms.balochistanpolice.gov.pk/client%20scripts/cms_plugin.exe", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-11-26T15:44:24+00:00", "last_seen": "2025-11-26T15:44:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348835", "uuid": "d0ba45f9-03ab-426f-8447-b9785341ae0c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T15:44:24+00:00", "last_seen": "2025-11-26T15:44:24+00:00", "object_relation": "md5", "timestamp": "1784348835", "to_ids": true, "type": "md5", "uuid": "ca41bf6b-3ae2-4453-9e69-c0c10715c9c6", "value": "fc59fc3d4b2af739014de04428ce2fb5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T15:44:24+00:00", "last_seen": "2025-11-26T15:44:24+00:00", "object_relation": "sha1", "timestamp": "1784344604", "to_ids": true, "type": "sha1", "uuid": "a16e7dab-ac8a-4a40-80e5-72c73bfbf738", "value": "2bab40c55637398f0497cff9c8cbea564d595c7f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T15:44:24+00:00", "last_seen": "2025-11-26T15:44:24+00:00", "object_relation": "sha256", "timestamp": "1784344604", "to_ids": true, "type": "sha256", "uuid": "f67cf5f3-f54d-4636-a1a7-45807e81e55e", "value": "1fd8ba64a687247466fa6e8b7d194154439ef527746fdb8c18b3c3d65b6d2390", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-26T15:44:24+00:00", "last_seen": "2025-11-26T15:44:24+00:00", "object_relation": "text", "timestamp": "1784343179", "to_ids": false, "type": "text", "uuid": "14588443-7c3f-4a79-80f2-2e9717610133", "value": "Type Description: Compiled HTML Help\nMicrosoft: None\nClamAV: None\nVT Total Detection: 18/74\nFirst Submission: 2025-11-26T15:44:24+00:00\nLast Submission: 2025-11-26T15:44:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-26T15:44:24+00:00", "last_seen": "2025-11-26T15:44:24+00:00", "object_relation": "ssdeep", "timestamp": "1784343179", "to_ids": true, "type": "ssdeep", "uuid": "e2b2bff6-ae21-47bc-8953-5e3df0dae9df", "value": "49152:yqS07I+ZYsyzeQHwamNHzcBezrKRSELp8XX533I:LhI7sOGp1cBg+RrLpCnI" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-26T15:44:24+00:00", "last_seen": "2025-11-26T15:44:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343179", "to_ids": false, "type": "size-in-bytes", "uuid": "60811c75-8685-4a20-9e78-9e747af96a8f", "value": "2209093" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-26T15:44:24+00:00", "last_seen": "2025-11-26T15:44:24+00:00", "object_relation": "filename", "timestamp": "1784343179", "to_ids": true, "type": "filename", "uuid": "a5689fea-a4d0-42cf-bad8-1ae85a0fafb3", "value": "Action_Plan_ACC_2025.chm" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-08T07:15:33+00:00", "last_seen": "2025-12-08T12:05:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348856", "uuid": "f222f334-f71e-4d74-ae5d-cd9a6e8f0bc4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-08T07:15:33+00:00", "last_seen": "2025-12-08T12:05:49+00:00", "object_relation": "md5", "timestamp": "1784348856", "to_ids": true, "type": "md5", "uuid": "64c00522-5211-4c92-9a87-a509a853b75e", "value": "d92fac74e6d7f4d8fc96c9ce6239435f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-08T07:15:33+00:00", "last_seen": "2025-12-08T12:05:49+00:00", "object_relation": "sha1", "timestamp": "1784344605", "to_ids": true, "type": "sha1", "uuid": "6e795db7-ff70-4be7-937a-f2c1a36c204c", "value": "539bd79fbb684edea94eb37518134b97e94b9dd8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-08T07:15:33+00:00", "last_seen": "2025-12-08T12:05:49+00:00", "object_relation": "sha256", "timestamp": "1784344605", "to_ids": true, "type": "sha256", "uuid": "dfe999dd-c1d2-4325-a3d0-802e5d082a7b", "value": "71fa6a00314701fef5c6f32c17e1438063d05616198ac9a12004aeab957e11ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-08T07:15:33+00:00", "last_seen": "2025-12-08T12:05:49+00:00", "object_relation": "text", "timestamp": "1784343201", "to_ids": false, "type": "text", "uuid": "1d3a4dd4-0dce-4b86-ae2f-f4831a3283ea", "value": "Type Description: Compiled HTML Help\nMicrosoft: None\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2025-12-08T07:15:33+00:00\nLast Submission: 2025-12-08T12:05:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-08T07:15:33+00:00", "last_seen": "2025-12-08T12:05:49+00:00", "object_relation": "ssdeep", "timestamp": "1784343201", "to_ids": true, "type": "ssdeep", "uuid": "8f62dfd6-d264-4f83-99d2-facc5b0a51fa", "value": "49152:m0kINEULUrEelx7jZ6rGmGHCir2vXgvksD/qyB:jNEO2EerZwGDRCvXKTB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-08T07:15:33+00:00", "last_seen": "2025-12-08T12:05:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343201", "to_ids": false, "type": "size-in-bytes", "uuid": "05622fbd-2071-4024-adb5-5b454f41dc45", "value": "1682505" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-08T07:15:33+00:00", "last_seen": "2025-12-08T12:05:49+00:00", "object_relation": "filename", "timestamp": "1784343201", "to_ids": true, "type": "filename", "uuid": "33b52c4c-4294-4760-addd-b0e354cdcd18", "value": "PDTrgCourseLAS01_12_2025.chm" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348877", "uuid": "e704033c-aadf-406e-bee7-a4628d65ce76", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "md5", "timestamp": "1784348877", "to_ids": true, "type": "md5", "uuid": "580f14b2-59a0-4ae5-9260-b390272ee6c3", "value": "397591dd098f9240684f9a999e38eb12", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "sha1", "timestamp": "1784344606", "to_ids": true, "type": "sha1", "uuid": "b063766c-efdb-4768-910f-d6c2562f4ef5", "value": "000fad96a85dd6933c22d3dbec9aed47b7f1f066", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "sha256", "timestamp": "1784344606", "to_ids": true, "type": "sha256", "uuid": "7311043c-e0a7-4bdf-b713-060bb15dc12e", "value": "b0146683c933b9c8d5f417ee876fa95021ed379d96a37a19330ee3d1fd18389f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "text", "timestamp": "1784343222", "to_ids": false, "type": "text", "uuid": "52c7615b-969e-470f-b2a8-5a166615d958", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 43/74\nFirst Submission: 2026-02-04T18:01:57+00:00\nLast Submission: 2026-02-04T18:01:57+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "creation-time", "timestamp": "1784343223", "to_ids": false, "type": "datetime", "uuid": "f041017e-673f-4068-b7ed-6d68c66e0ccd", "value": "2025-12-30T08:12:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "ssdeep", "timestamp": "1784343222", "to_ids": true, "type": "ssdeep", "uuid": "87b84315-063b-41e1-9cc6-78608553a511", "value": "98304:xA496StBqoo9n6RFSMLcwmBXDII6KGC8TA3XT9S2fAiRlQTQnq1XrD1AwhVQ2L:xA4YSbr+n5MH0XkIHG5A5vt6TQqtv7Vz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343222", "to_ids": false, "type": "size-in-bytes", "uuid": "fb6b9fb8-6fe7-41a8-b0c2-54ec68148488", "value": "5999104" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "vhash", "timestamp": "1784343223", "to_ids": true, "type": "vhash", "uuid": "917a0f50-895d-434a-bd4e-6978184e95d4", "value": "056066656d1515751az2dhz3lz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:01:57+00:00", "last_seen": "2026-02-04T18:01:57+00:00", "object_relation": "filename", "timestamp": "1784343223", "to_ids": true, "type": "filename", "uuid": "7af914ec-76aa-4d76-926b-b83c2664d6dc", "value": "Reclarification_on_offer_for_overhaul_of_06x_WP13F_Engine_of_F7_Series_aircraft.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-04T18:34:30+00:00", "last_seen": "2026-02-04T22:52:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348898", "uuid": "bd7f4fac-12d2-4717-a3f8-d32edd59df71", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:34:30+00:00", "last_seen": "2026-02-04T22:52:26+00:00", "object_relation": "md5", "timestamp": "1784348898", "to_ids": true, "type": "md5", "uuid": "6f497246-3f69-4e43-a2be-885c07cd1270", "value": "215f9329d0f33a7215e9d553be06d32a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:34:30+00:00", "last_seen": "2026-02-04T22:52:26+00:00", "object_relation": "sha1", "timestamp": "1784344608", "to_ids": true, "type": "sha1", "uuid": "afb39e9c-4025-4732-8a2a-bf6c758958cd", "value": "c6c197e61079a0a33108c2c87b5e3c7056a138ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:34:30+00:00", "last_seen": "2026-02-04T22:52:26+00:00", "object_relation": "sha256", "timestamp": "1784344608", "to_ids": true, "type": "sha256", "uuid": "a306c3f6-96f7-45f2-9327-a37611f48505", "value": "05e77d64dc5ce8d9642b750db3363c1ec4e2838ffd9d288546ef6a49d05380ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:34:30+00:00", "last_seen": "2026-02-04T22:52:26+00:00", "object_relation": "text", "timestamp": "1784343244", "to_ids": false, "type": "text", "uuid": "5383ac39-2a68-4f0e-b5e6-94cdf96c9f22", "value": "Type Description: Compiled HTML Help\nMicrosoft: None\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2026-02-04T18:34:30+00:00\nLast Submission: 2026-02-04T22:52:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:34:30+00:00", "last_seen": "2026-02-04T22:52:26+00:00", "object_relation": "ssdeep", "timestamp": "1784343244", "to_ids": true, "type": "ssdeep", "uuid": "f08d9667-7129-45a1-8ce1-5856e68df585", "value": "24576:8SWrZx0Df1f4eWkG/oj25MgGc7lxd7FyLnhq4nv:8SIZkfp4F/MRgGc7rdsnhz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:34:30+00:00", "last_seen": "2026-02-04T22:52:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343244", "to_ids": false, "type": "size-in-bytes", "uuid": "4b07bb1c-c907-420a-b546-815d147aef84", "value": "975190" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:34:30+00:00", "last_seen": "2026-02-04T22:52:26+00:00", "object_relation": "filename", "timestamp": "1784343244", "to_ids": true, "type": "filename", "uuid": "ab592c22-3648-4b52-b1d3-d768f33061e6", "value": "05e77d64dc5ce8d9642b750db3363c1ec4e2838ffd9d288546ef6a49d05380ba.chm" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-17T10:52:44+00:00", "last_seen": "2026-03-05T21:09:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348919", "uuid": "d883e8ec-2ffc-4315-8bab-a8c672f85296", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T10:52:44+00:00", "last_seen": "2026-03-05T21:09:07+00:00", "object_relation": "md5", "timestamp": "1784348919", "to_ids": true, "type": "md5", "uuid": "0af89fe8-c413-4128-8c9c-2644ea2f0c5d", "value": "96b15bb9ce8ef7c41b708b1620029d99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T10:52:44+00:00", "last_seen": "2026-03-05T21:09:07+00:00", "object_relation": "sha1", "timestamp": "1784344609", "to_ids": true, "type": "sha1", "uuid": "df352fd9-2dd5-4365-aa26-c8accc382510", "value": "6fe2e74d009abbd56de01fd7404a1245e9b47c79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T10:52:44+00:00", "last_seen": "2026-03-05T21:09:07+00:00", "object_relation": "sha256", "timestamp": "1784344609", "to_ids": true, "type": "sha256", "uuid": "0f482506-aeba-4e9b-bcb0-8fd7742ed7de", "value": "7ea0930a332788c2e88e5822e4908d77cdcaad57e0e97401ed8fe4b117fdfc95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T10:52:44+00:00", "last_seen": "2026-03-05T21:09:07+00:00", "object_relation": "text", "timestamp": "1784343265", "to_ids": false, "type": "text", "uuid": "34ceccb9-2380-43fb-b7e8-f824a0224d28", "value": "Type Description: Compiled HTML Help\nMicrosoft: None\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-02-17T10:52:44+00:00\nLast Submission: 2026-03-05T21:09:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T10:52:44+00:00", "last_seen": "2026-03-05T21:09:07+00:00", "object_relation": "ssdeep", "timestamp": "1784343265", "to_ids": true, "type": "ssdeep", "uuid": "aefe9faa-db80-42da-a517-c34c5489c74e", "value": "196608:Ou5LBuWfFAiGmWTkPhR7B5aTUK+MYvCHfU1FzJOvly:LuWtAiJP/7/auvC/Ubzily" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T10:52:44+00:00", "last_seen": "2026-03-05T21:09:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343265", "to_ids": false, "type": "size-in-bytes", "uuid": "95179289-b584-43a5-9da8-7404af48e262", "value": "6513936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T10:52:44+00:00", "last_seen": "2026-03-05T21:09:07+00:00", "object_relation": "filename", "timestamp": "1784343265", "to_ids": true, "type": "filename", "uuid": "8ab93413-d170-47f2-ba67-ba867f91aa19", "value": "NASTP_ACAST_AND_AVIONICS_DIVISION_ROADMAP_Final_Ver_2.chm" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348940", "uuid": "0c58142c-f2f1-4e5f-8a78-bc5346d3c69a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "md5", "timestamp": "1784348940", "to_ids": true, "type": "md5", "uuid": "bc0ed6da-1be4-4206-b411-23b33aee0cdd", "value": "91693c2d5a4b7d090fe06cc7382dfc18", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "sha1", "timestamp": "1784344610", "to_ids": true, "type": "sha1", "uuid": "36c75c40-7023-47c2-bcc5-e881879e6165", "value": "47f8cb0c2dcf62702f58cfc1603d6325755f6820", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "sha256", "timestamp": "1784344610", "to_ids": true, "type": "sha256", "uuid": "54402c84-cb34-4604-b5ac-7e65cd21662d", "value": "9fb6f4c55e5198739123264f8007cf6e22b3821af97a00a471bd54b30991ecd0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "text", "timestamp": "1784343287", "to_ids": false, "type": "text", "uuid": "c76e7641-c9af-41af-b660-f4b2dfc18ea9", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2026-02-17T19:48:54+00:00\nLast Submission: 2026-02-24T04:05:55+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "creation-time", "timestamp": "1784343287", "to_ids": false, "type": "datetime", "uuid": "2deee085-7f15-46b8-82f8-6f5d911b92fd", "value": "2026-01-30T06:27:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "ssdeep", "timestamp": "1784343287", "to_ids": true, "type": "ssdeep", "uuid": "2bebe7b5-4e71-418d-ac30-96a4cf54679a", "value": "98304:ehPJw9+gHbNGuGeGlKKLumdkFmZr5dvGuxpECSFQjH0gbgaC5SMQSfc+UD/RJqq:eLYHbkpeC6Mim9iux2ns9kaCLkDRJf" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343287", "to_ids": false, "type": "size-in-bytes", "uuid": "870b0ccc-2320-4411-8cde-9aa56683329a", "value": "5999104" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "vhash", "timestamp": "1784343287", "to_ids": true, "type": "vhash", "uuid": "13376942-ba99-4497-a7ba-b0ea76ac7689", "value": "056066656d1515751az2dhz3lz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T19:48:54+00:00", "last_seen": "2026-02-24T04:05:55+00:00", "object_relation": "filename", "timestamp": "1784343287", "to_ids": true, "type": "filename", "uuid": "89ecf6d4-7d38-4b00-aebe-1ef8461de415", "value": "NASTP_ACAST_AND_AVIONICS_DIVISION_ROADMAP_Final_Ver_2.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348961", "uuid": "ffebf4de-8a6f-4a11-8737-c29ed6b6a47f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "md5", "timestamp": "1784348961", "to_ids": true, "type": "md5", "uuid": "709b55bc-0c83-41a2-8c98-22a2502dd0ca", "value": "449f0e87df10a564276ad760a7c5c8e4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "sha1", "timestamp": "1784344611", "to_ids": true, "type": "sha1", "uuid": "9a48fef8-d5da-480b-ba15-bc4ff5f37ab6", "value": "08570471f39bb6725f07b8cddbea99ed48c22686", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "sha256", "timestamp": "1784344611", "to_ids": true, "type": "sha256", "uuid": "2dd49bda-8ef2-4833-9abe-253cf9cc07f9", "value": "974626cf14864f0a3185233bbce417d37bf5c8ad6e3c82774985db027b54acd2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "text", "timestamp": "1784343309", "to_ids": false, "type": "text", "uuid": "048a2b34-ec87-400d-8da1-332a98496349", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 33/74\nFirst Seen In The Wild: 2025-11-26T10:10:20+00:00\nFirst Submission: 2025-11-25T16:41:02+00:00\nLast Submission: 2025-12-08T12:06:22+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "creation-time", "timestamp": "1784343309", "to_ids": false, "type": "datetime", "uuid": "c4ff7591-79a2-4cc0-b581-c897ddbc9c19", "value": "2025-11-18T10:24:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "ssdeep", "timestamp": "1784343309", "to_ids": true, "type": "ssdeep", "uuid": "8d6a88e4-39cf-466e-a515-452fc96a10ac", "value": "98304:XCII1obqdbiBR6TjeTofjCX3rVjnJdyg5XqCA7fpaUyv5BL/y:XCP8wbiqE8jCrlJdy6xSfp5mBLa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343309", "to_ids": false, "type": "size-in-bytes", "uuid": "65214231-2607-4eeb-a07a-8362fcc0705c", "value": "5996544" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "vhash", "timestamp": "1784343309", "to_ids": true, "type": "vhash", "uuid": "1dba919b-d771-4c01-8f19-ec4e922dd800", "value": "056066656d1515751az2dhz3lz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-25T16:41:02+00:00", "last_seen": "2025-12-08T12:06:22+00:00", "object_relation": "filename", "timestamp": "1784343309", "to_ids": true, "type": "filename", "uuid": "a56061f1-666e-44a6-a3e3-885f2fb78d09", "value": "PDTrgCourseLAS01_12_2025.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348982", "uuid": "5622df41-3739-4fdc-b44b-134fe078dfb6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "md5", "timestamp": "1784348982", "to_ids": true, "type": "md5", "uuid": "b694579e-d676-4f5e-8fee-45e907033366", "value": "51b6300980982a20e1464831c21988d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "sha1", "timestamp": "1784344612", "to_ids": true, "type": "sha1", "uuid": "9414549f-56df-487a-82d2-a5fd1c7956da", "value": "23f4766c011d193f076dfc735dc460e2a41ead79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "sha256", "timestamp": "1784344612", "to_ids": true, "type": "sha256", "uuid": "953ce05f-3dda-4e20-8b8a-48539f32da5f", "value": "deb241a46da181c8c1f68a43745fcbf8a6927e4344c2fc96ef4cf31c828576c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "text", "timestamp": "1784343330", "to_ids": false, "type": "text", "uuid": "577dd514-a585-459c-b8ad-4413bda6f4ac", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Malgent!MSR\nClamAV: None\nVT Total Detection: 52/74\nFirst Submission: 2025-12-26T05:30:27+00:00\nLast Submission: 2025-12-30T07:51:16+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "creation-time", "timestamp": "1784343330", "to_ids": false, "type": "datetime", "uuid": "2d72dcc2-a316-4544-98b1-6500f6e964a3", "value": "2025-12-17T05:58:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "ssdeep", "timestamp": "1784343330", "to_ids": true, "type": "ssdeep", "uuid": "637f0493-c400-4b1f-8364-0cc0c63f1187", "value": "98304:bZJYcN5HcovPYWzGwVsi0DHmp80tiV2aprcl0+eXxkOk0oR8LAMpa2AcwxEg:dCC5hvPfzGwVsxDHM80tY2M3XxkxHae" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343330", "to_ids": false, "type": "size-in-bytes", "uuid": "64306812-a69e-47cd-9c7a-f4007ce65ed2", "value": "6371328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "vhash", "timestamp": "1784343330", "to_ids": true, "type": "vhash", "uuid": "8b1e10ab-d2d8-4a6a-ad03-8ce19f022722", "value": "066066656d1515751az26hz3lz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:30:27+00:00", "last_seen": "2025-12-30T07:51:16+00:00", "object_relation": "filename", "timestamp": "1784343330", "to_ids": true, "type": "filename", "uuid": "92c76283-1b6e-41a5-9c1e-44b4b639cf0f", "value": "6jo5ldexd.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784349004", "uuid": "34dbecf6-0235-415e-ac7f-308981b84c6f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "md5", "timestamp": "1784349004", "to_ids": true, "type": "md5", "uuid": "5fb412fd-635d-43ba-af9b-e014efb8d2a2", "value": "9d4168ed11a5c62ddc5de763dd181af3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "sha1", "timestamp": "1784344613", "to_ids": true, "type": "sha1", "uuid": "aa618d0f-7a27-4e40-adeb-6179777af725", "value": "23f6781919a50b118d8d4e6a7e9ae63b71ecc885", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "sha256", "timestamp": "1784344613", "to_ids": true, "type": "sha256", "uuid": "c2c0d860-339b-4add-815e-df6c7145d4ab", "value": "a86eebd6cfb6392a3b4887c4d0cdd9c7b902f95d8190fe2e6d88636cc29cdfb0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "text", "timestamp": "1784343352", "to_ids": false, "type": "text", "uuid": "625ac8ce-25b2-48a2-ab1d-679f2874acb3", "value": "Type Description: Win32 EXE\nOriginal name: 360Safe.exe\nVerified: The digital signature of the object did not verify.\nSigning date: 07:23 AM 05/16/2018\nSigners: Qihoo 360 Software (Beijing) Company Limited; Symantec Class 3 SHA256 Code Signing CA; VeriSign\nMicrosoft: Trojan:MSIL/Jalapeno.SZDF!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Submission: 2024-10-29T08:23:54+00:00\nLast Submission: 2024-10-29T08:23:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "creation-time", "timestamp": "1784343352", "to_ids": false, "type": "datetime", "uuid": "b4087260-93a2-4b73-b35b-b5a85ab29c18", "value": "2051-10-21T01:44:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "ssdeep", "timestamp": "1784343352", "to_ids": true, "type": "ssdeep", "uuid": "ca4668c2-74f3-4656-8f50-b335f2eef93b", "value": "1536:Bz0pOGnTpqJa7OWNN8o+K+0kaXwmR4++bcOxoS:Yea7OW0o+KNf4++bcOiS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343352", "to_ids": false, "type": "size-in-bytes", "uuid": "1a93ee15-c5b8-46b7-bf4d-6d46f0772a8e", "value": "80816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "vhash", "timestamp": "1784343352", "to_ids": true, "type": "vhash", "uuid": "6439fb03-40a9-4f5f-b711-0745b99678f3", "value": "084026555\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-10-29T08:23:54+00:00", "last_seen": "2024-10-29T08:23:54+00:00", "object_relation": "filename", "timestamp": "1784343352", "to_ids": true, "type": "filename", "uuid": "e35220d4-bb61-4590-97aa-6c54225472cb", "value": "360Safe.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784349025", "uuid": "16944e1e-dbb7-4154-83cf-5536f16e544a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "object_relation": "md5", "timestamp": "1784349025", "to_ids": true, "type": "md5", "uuid": "9ed495c5-c61c-4b37-bc22-4d12753ecb8b", "value": "fd1b7060304ce85a7823be776941137b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "object_relation": "sha1", "timestamp": "1784344614", "to_ids": true, "type": "sha1", "uuid": "b025da01-f6bb-4c50-b482-5c1e89cc311c", "value": "4039454c9189e64285e93fc075a30b93f814b5b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "object_relation": "sha256", "timestamp": "1784344615", "to_ids": true, "type": "sha256", "uuid": "5e7ecc0d-6498-4347-ae8d-655af95d07f6", "value": "ecaffde2e95981ad9f301343b278f8078c3a80aaef0ea352a96b9802d781ff35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "object_relation": "text", "timestamp": "1784343373", "to_ids": false, "type": "text", "uuid": "3f1a3210-ad77-4356-8abf-3b72e8872160", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2024-11-05T08:24:00+00:00\nLast Submission: 2024-11-05T08:24:00+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "object_relation": "creation-time", "timestamp": "1784343373", "to_ids": false, "type": "datetime", "uuid": "91cea54e-cd2f-4c23-9ebf-d7ded7745d22", "value": "2024-11-04T07:23:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "object_relation": "ssdeep", "timestamp": "1784343373", "to_ids": true, "type": "ssdeep", "uuid": "c39dba80-c83d-4b73-b531-7afe8944a069", "value": "6144:naqR5+OYcn6SK3esPjyfOKKKdJdvU7yzqrKR+2tJkeZ:nz5jYfLjyVH4yzj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343373", "to_ids": false, "type": "size-in-bytes", "uuid": "6651b3f4-9994-4afe-9ae2-044b58791189", "value": "393216" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-05T08:24:00+00:00", "last_seen": "2024-11-05T08:24:00+00:00", "object_relation": "vhash", "timestamp": "1784343373", "to_ids": true, "type": "vhash", "uuid": "ac553b2b-4c5e-4df8-8345-6c4a1d9180ff", "value": "035076655d155d10155038z3f1z3081z503021z3013z45z97z" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784349047", "uuid": "9b53d050-57d1-4d6b-a1b4-048bf64c3aa7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "md5", "timestamp": "1784349047", "to_ids": true, "type": "md5", "uuid": "b4e9ce42-a204-42d2-b3a2-ad4c7395ea2a", "value": "a45657da1390e54930ee1842065bbb53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "sha1", "timestamp": "1784344616", "to_ids": true, "type": "sha1", "uuid": "4e29c105-00c6-4a4b-9033-4716db8bfa54", "value": "58cb2d95063b9df807b7aa8dc106b74ce988a491", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "sha256", "timestamp": "1784344616", "to_ids": true, "type": "sha256", "uuid": "ae7750d9-f766-4008-a7f9-69ce3e754db2", "value": "545a8be7534115d41eba42f42b8aac3cd17ce937ff1147cff7c43f935c37333d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "text", "timestamp": "1784343394", "to_ids": false, "type": "text", "uuid": "dfc7ee16-b79f-400d-a3c2-9ee491f17a2e", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.C!ml\nClamAV: None\nVT Total Detection: 12/74\nFirst Submission: 2024-11-01T14:45:23+00:00\nLast Submission: 2024-11-01T14:45:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "creation-time", "timestamp": "1784343395", "to_ids": false, "type": "datetime", "uuid": "b6a21461-ca58-4a50-bd01-222a4d861d37", "value": "2024-11-01T08:48:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "ssdeep", "timestamp": "1784343394", "to_ids": true, "type": "ssdeep", "uuid": "1f68ddd5-d7b6-480f-b07b-9487ef967aa6", "value": "49152:dmnu7Cyv5hll6B2Js2h4LPDxHfObNmGCwqsbS5:AArk952S" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343394", "to_ids": false, "type": "size-in-bytes", "uuid": "e9be5f81-581d-44c6-bae7-cef8c7404337", "value": "2890752" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "vhash", "timestamp": "1784343394", "to_ids": true, "type": "vhash", "uuid": "88a781e8-642f-4117-abfa-68883d330aa7", "value": "026076655d156d10155063zb2z491z3081z503021zd013z44z137z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-11-01T14:45:23+00:00", "last_seen": "2024-11-01T14:45:23+00:00", "object_relation": "filename", "timestamp": "1784343394", "to_ids": true, "type": "filename", "uuid": "a5b156b8-8fd6-4b04-bf91-1670cb699c75", "value": "cms_plugin.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784349068", "uuid": "50b1e98d-9689-4085-adf3-32f2d004e015", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "md5", "timestamp": "1784349068", "to_ids": true, "type": "md5", "uuid": "72b02b4a-a21f-4d9e-8a7d-4ceb7406a03e", "value": "a106b2800db293a639abbb1f5120f5a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "sha1", "timestamp": "1784344617", "to_ids": true, "type": "sha1", "uuid": "c7fd2e5a-465c-4628-8ede-7cd68e83db97", "value": "5d60ff36ff519c2e13e7f66cfa0bb46be79592a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "sha256", "timestamp": "1784344617", "to_ids": true, "type": "sha256", "uuid": "7a761f2d-6ffb-4d13-aac7-f576bcc10f5a", "value": "2b8679d122e5e347e8149c98a1dbca7ad1bebae9cca5732ec223765867d9ce68", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "text", "timestamp": "1784343416", "to_ids": false, "type": "text", "uuid": "4d425f29-fe80-41c8-83de-301354a4c387", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-02-04T18:04:54+00:00\nLast Submission: 2026-02-04T18:04:54+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "creation-time", "timestamp": "1784343416", "to_ids": false, "type": "datetime", "uuid": "61b743d2-7247-42cf-b81c-0fd8e6dcd95a", "value": "2025-12-30T08:12:42+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "ssdeep", "timestamp": "1784343416", "to_ids": true, "type": "ssdeep", "uuid": "c2ee1348-1d83-4281-a8e6-e9e5c207ad56", "value": "98304:Xnm0R1TkeewD1Fiq17UpJwIX4uzWObPPb5QZ:Xnf1QnwD1Ic" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343416", "to_ids": false, "type": "size-in-bytes", "uuid": "7953a253-662d-467d-908e-49889623c780", "value": "6013952" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "vhash", "timestamp": "1784343416", "to_ids": true, "type": "vhash", "uuid": "596d7253-c399-4e0b-a2e2-c3b3508fd0ad", "value": "166066656d1555555az2!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-04T18:04:54+00:00", "last_seen": "2026-02-04T18:04:54+00:00", "object_relation": "filename", "timestamp": "1784343416", "to_ids": true, "type": "filename", "uuid": "05f0736b-a5c8-4b2d-91a4-ba43006a12b9", "value": "relish_for_ketty.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784349089", "uuid": "3b9e4b1b-7670-4b39-9de6-91f4e17bd507", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "md5", "timestamp": "1784349089", "to_ids": true, "type": "md5", "uuid": "6de54c23-bf97-4ece-8efb-8e4ed1bacc8a", "value": "68caae371e3fc55b58817573fc47a4bf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "sha1", "timestamp": "1784344618", "to_ids": true, "type": "sha1", "uuid": "0545208e-5ea0-487e-b86e-61b210db7943", "value": "63b88d00331de88af696dfb7a896935d830e485f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "sha256", "timestamp": "1784344618", "to_ids": true, "type": "sha256", "uuid": "80e2efed-6478-45c3-85c0-11c2d07a43ab", "value": "e5025213f9a3f10ee0b2ef4b0de3b6033e0679b97295296e0deb0c47e0e8f6cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "text", "timestamp": "1784343437", "to_ids": false, "type": "text", "uuid": "bde81410-a713-4041-8ab6-5f399083cf04", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2025-12-26T05:38:55+00:00\nLast Submission: 2025-12-27T03:45:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "creation-time", "timestamp": "1784343437", "to_ids": false, "type": "datetime", "uuid": "d8fd673f-b0ce-438d-8108-d97f7f69f9aa", "value": "2025-12-17T05:58:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "ssdeep", "timestamp": "1784343437", "to_ids": true, "type": "ssdeep", "uuid": "55826a3b-c0a8-4170-a6ef-f35543984626", "value": "98304:4s1TkRmWD1FTq17UpJwIX4uzWObPPURsTu+:n1QIWD1CC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343437", "to_ids": false, "type": "size-in-bytes", "uuid": "369ba253-3e8e-43c0-9971-f794b37b1522", "value": "6343168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "vhash", "timestamp": "1784343437", "to_ids": true, "type": "vhash", "uuid": "d7a77e12-b6d4-4d9a-bc53-1b84441140e9", "value": "166066656d1555555az17?z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:38:55+00:00", "last_seen": "2025-12-27T03:45:50+00:00", "object_relation": "filename", "timestamp": "1784343437", "to_ids": true, "type": "filename", "uuid": "12ee3d32-9763-4301-8d55-f13e8141ee2c", "value": "Monday_Download.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-26T05:30:10+00:00", "last_seen": "2026-02-25T07:07:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784349111", "uuid": "325e14a9-6688-48c0-9afe-155821f9689e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:10+00:00", "last_seen": "2026-02-25T07:07:38+00:00", "object_relation": "md5", "timestamp": "1784349111", "to_ids": true, "type": "md5", "uuid": "7af434ca-8e56-488f-b059-5d05ba4f4970", "value": "c463ae1ba749ad0b99a51c57cefa018b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:10+00:00", "last_seen": "2026-02-25T07:07:38+00:00", "object_relation": "sha1", "timestamp": "1784344619", "to_ids": true, "type": "sha1", "uuid": "b425e2c8-10d3-4343-a91e-e0a5ca84fa02", "value": "71757adba833b46f961e840d0f055bcce0b529c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:10+00:00", "last_seen": "2026-02-25T07:07:38+00:00", "object_relation": "sha256", "timestamp": "1784344619", "to_ids": true, "type": "sha256", "uuid": "013c001e-91ee-473c-a7d2-11b196a70b6f", "value": "30645a2d67fa10cb7b6034ea8c5c3198a2d2e255422486893e802b075d5846f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:30:10+00:00", "last_seen": "2026-02-25T07:07:38+00:00", "object_relation": "text", "timestamp": "1784343459", "to_ids": false, "type": "text", "uuid": "4e21ca49-f35a-4d5b-b6ec-d8f17a099d6c", "value": "Type Description: Compiled HTML Help\nMicrosoft: None\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2025-12-26T05:30:10+00:00\nLast Submission: 2026-02-25T07:07:38+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-26T05:30:10+00:00", "last_seen": "2026-02-25T07:07:38+00:00", "object_relation": "ssdeep", "timestamp": "1784343459", "to_ids": true, "type": "ssdeep", "uuid": "ad7c2604-7b76-4e29-b81e-4edb2491d0a9", "value": "49152:22IQZKmVgrtutojY7pVXHsL23yJJAwrwIu/uViyOG25VSuPvaCsOWVh:22txgBaojY7/HpY2wrwIubG2faCfmh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:30:10+00:00", "last_seen": "2026-02-25T07:07:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343459", "to_ids": false, "type": "size-in-bytes", "uuid": "6c16bf5a-495e-4e2f-ac0c-d1f3f175f95c", "value": "2772071" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-26T05:30:10+00:00", "last_seen": "2026-02-25T07:07:38+00:00", "object_relation": "filename", "timestamp": "1784343459", "to_ids": true, "type": "filename", "uuid": "a113d2d1-2be3-49ba-b0bc-6d6bcb37a0f6", "value": "30645a2d67fa10cb7b6034ea8c5c3198a2d2e255422486893e802b075d5846f4.chm" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784349132", "uuid": "4c266601-c827-44cf-b05f-c11dd521f8c4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "md5", "timestamp": "1784349132", "to_ids": true, "type": "md5", "uuid": "5c6de4c3-d4d2-4cde-938c-b7600de1554f", "value": "43e4984a2bcb1656c87c83c18d072494", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "sha1", "timestamp": "1784344620", "to_ids": true, "type": "sha1", "uuid": "ffc6ccbb-ad9c-4aa5-8709-c9cc9f52e7f4", "value": "8c329db96e093fa25268e078405a33c518dbb5c9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "sha256", "timestamp": "1784344620", "to_ids": true, "type": "sha256", "uuid": "873d93c7-9d0e-4fe6-a5bb-d19c535da67c", "value": "98d9c27d3e07c298ef072d0cc3bf9f1f0daa6813deef1da39691b8db6515e372", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "text", "timestamp": "1784343480", "to_ids": false, "type": "text", "uuid": "9e1d340a-6761-49ee-9f56-c4f5a39b0f52", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 30/74\nFirst Submission: 2026-02-17T19:57:40+00:00\nLast Submission: 2026-02-17T19:57:40+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "creation-time", "timestamp": "1784343480", "to_ids": false, "type": "datetime", "uuid": "d5f7185c-b73c-4e0c-aed4-768c158bada7", "value": "2026-01-30T06:27:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "ssdeep", "timestamp": "1784343480", "to_ids": true, "type": "ssdeep", "uuid": "15aead07-e722-49b4-add7-f270c69692f0", "value": "98304:NYNR1TkeewD1Fiq17UpJwIX4uzWObPPb5QZ:NE1QnwD1Ic" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343480", "to_ids": false, "type": "size-in-bytes", "uuid": "af9506b5-3843-41a0-a5f0-0044b2d0de9a", "value": "6013952" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "vhash", "timestamp": "1784343480", "to_ids": true, "type": "vhash", "uuid": "828f16a9-6b17-4ca6-b264-0c60f3e04734", "value": "166066656d1555555az2!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-17T19:57:40+00:00", "last_seen": "2026-02-17T19:57:40+00:00", "object_relation": "filename", "timestamp": "1784343480", "to_ids": true, "type": "filename", "uuid": "299494ee-8762-4157-b26b-73e0f4d06772", "value": "Nafisha.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784349153", "uuid": "49dcf3f6-abe4-4f7a-817d-a96bea809176", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "md5", "timestamp": "1784349153", "to_ids": true, "type": "md5", "uuid": "2c1b47f3-0cc7-4ec8-b5ab-1101e8226192", "value": "1f4adf9695afa103c87ab7a63ffbfddc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "sha1", "timestamp": "1784344622", "to_ids": true, "type": "sha1", "uuid": "74ad77d1-9570-4c86-aad2-a1a7c61032af", "value": "d66ab0cd2e44dc8389c111b7ed34c7bcb0b35311", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "sha256", "timestamp": "1784344622", "to_ids": true, "type": "sha256", "uuid": "ce880586-0867-44d0-a04d-271438bdd9fe", "value": "23e1a14fcb1fd710391bc870c27b0dba899120c8b460f89f10a4f989045e4dcc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "text", "timestamp": "1784343502", "to_ids": false, "type": "text", "uuid": "ce4e1519-ef0d-481a-8d62-d18fe2d82a5d", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2025-11-25T16:49:49+00:00\nLast Submission: 2025-11-25T16:49:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "creation-time", "timestamp": "1784343502", "to_ids": false, "type": "datetime", "uuid": "9e78fe24-93bd-4fd1-b8c3-8f10029b06ca", "value": "2025-11-18T10:24:27+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "ssdeep", "timestamp": "1784343502", "to_ids": true, "type": "ssdeep", "uuid": "9a63a301-3534-4991-99bb-f701d3934bd4", "value": "98304:RU5aR1TkeewD1Fiq17UpJwIX4uzWObPPb5QZ:RUm1QnwD1Ic" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784343502", "to_ids": false, "type": "size-in-bytes", "uuid": "4085428d-30ef-4393-aee0-666867e24e28", "value": "6006272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "vhash", "timestamp": "1784343502", "to_ids": true, "type": "vhash", "uuid": "1af7e697-d488-40ca-b9a7-a60214473b96", "value": "166066656d1555555az2!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-25T16:49:49+00:00", "last_seen": "2025-11-25T16:49:49+00:00", "object_relation": "filename", "timestamp": "1784343502", "to_ids": true, "type": "filename", "uuid": "28f05578-8f5f-455e-a6c3-90c3510593f8", "value": "e4nwum9.exe" } ] } ] } }