{ "Event": { "analysis": "1", "date": "2026-07-22", "extends_uuid": "", "info": "[Threat Intel] Inside a TrickBot Variant Using DNS Tunneling for C2", "protected": false, "publish_timestamp": "1785577596", "published": true, "threat_level_id": "3", "timestamp": "1785577596", "uuid": "8307b053-d5d0-4423-bb07-f17b2e478f2f", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#7223eb", "local": false, "name": "misp-galaxy:producer=\"Fortinet\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#177fb7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rundll32 - T1218.011\"", "relationship_type": "" }, { "colour": "#110e53", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DNS - T1071.004\"", "relationship_type": "" }, { "colour": "#657ac3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"", "relationship_type": "" }, { "colour": "#20f80d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"", "relationship_type": "" }, { "colour": "#73cdf4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Portable Executable Injection - T1055.002\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"", "relationship_type": "" }, { "colour": "#ee83bf", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Thread Local Storage - T1055.005\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"TrickBot\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784775613", "to_ids": false, "type": "link", "uuid": "5b0cc7e9-308c-4bc5-a92d-b2a315dc9697", "value": "https://www.fortinet.com/blog/threat-research/inside-a-trickbot-variant-using-dns-tunneling-for-c2" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784775613", "to_ids": false, "type": "text", "uuid": "8c48f40d-e937-430d-b284-e09b626d0d69", "value": "A TrickBot variant has been identified that uses DNS tunneling for command-and-control communications instead of traditional HTTP protocols. The malware maintains persistence through Windows Task Scheduler, creating disguised tasks that execute at startup and repeat every five minutes. Configuration data is stored in NTFS Alternate Data Streams to evade detection. The malware employs multiple obfuscation techniques including encrypted strings, runtime API resolution via hash-based lookups, and dynamically calculated constants. Its modular architecture supports twelve different control commands enabling capabilities such as module downloads, process injection through hollowing and doppelg\u00e4nging techniques, PowerShell execution, and raw machine code execution. The variant transfers data through specially crafted DNS queries to public DNS servers, encoding command data in malformed domain names and receiving responses embedded within multiple IPv4 addresses, achieving transfer speeds of approximately 30.7 KB/s." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784775613", "to_ids": false, "type": "text", "uuid": "28a50bff-58de-4579-a464-669f390dc457", "value": "Name: Inside a TrickBot Variant Using DNS Tunneling for C2\nAuthor: AlienVault\nAdversary: \nTags: [\"task scheduler\", \"obfuscation techniques\", \"dns tunneling\", \"process injection\", \"persistence mechanism\", \"trickbot\", \"modular architecture\"]\nTgtd countries: []\nMlwr families: [\"TrickBot - S0266\", \"Totbrick\", \"TSPY_TRICKLOAD\"]\nAttack_ids: [\"T1053.005\", \"T1218.011\", \"T1071.004\", \"T1497.001\", \"T1082\", \"T1106\", \"T1140\", \"T1055\", \"T1572\", \"T1112\", \"T1059\", \"T1055.002\", \"T1059.001\", \"T1027\", \"T1012\", \"T1564.003\", \"T1055.005\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785119836", "to_ids": true, "type": "domain", "uuid": "713a755a-02fa-46e5-98d8-2198b00428f1", "value": "westurn.in", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 27/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785118285", "to_ids": true, "type": "md5", "uuid": "f40ab132-ac36-4556-9e9c-103fe6869c29", "value": "f7f2f482f3bc6345a44e4a6d647731ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119857", "uuid": "7ab3f3c7-b530-487c-9787-b77f9e2cb70a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "md5", "timestamp": "1785119857", "to_ids": true, "type": "md5", "uuid": "e89b2aa3-e038-4605-ab72-74f54c7c7b77", "value": "8d5b3a0512744efc132afa6fc75c64d8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "sha1", "timestamp": "1785118277", "to_ids": true, "type": "sha1", "uuid": "9b83bb15-3ade-4880-ab79-5bf733bae4ec", "value": "48fd2036b6556c6747197e07f1706bcf58a27518", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "sha256", "timestamp": "1785118277", "to_ids": true, "type": "sha256", "uuid": "9232cecf-89e4-4488-b3d6-b60cb4d78b74", "value": "6c677eb2b3ffd288083c59a13d7bb712d4754af61a5563873f76c440962346f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "text", "timestamp": "1785116723", "to_ids": false, "type": "text", "uuid": "cf3c1d34-7dfc-462f-a0a8-0e6025cb4461", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/AnchorBot.G!MSR\nClamAV: Win.Trojan.Anchor-9800038-0\nVT Total Detection: 52/74\nFirst Submission: 2026-04-20T08:02:21+00:00\nLast Submission: 2026-04-20T08:02:21+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "creation-time", "timestamp": "1785116723", "to_ids": false, "type": "datetime", "uuid": "938f70aa-4855-4242-a7bd-ceee2fa07a8c", "value": "2020-06-24T13:35:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "ssdeep", "timestamp": "1785116723", "to_ids": true, "type": "ssdeep", "uuid": "b951ae8b-4e87-466d-97ef-527d9f0cd021", "value": "12288:H1Yk6Q7tcT7DRxLqkRiQyrvEB+R1zjDbjZa4Jo6iBzJ3XopVa:HaQ7tcT7DnqkRizrvE+R1zPbjZa4Jo6G" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116723", "to_ids": false, "type": "size-in-bytes", "uuid": "05ea04f9-b6fa-45b0-82fa-df3faee7aeb3", "value": "678912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "vhash", "timestamp": "1785116723", "to_ids": true, "type": "vhash", "uuid": "99eb4a88-d8ac-4541-85f4-fa19661948e0", "value": "0650d61666161616155d1az7d9z4jz27z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T08:02:21+00:00", "last_seen": "2026-04-20T08:02:21+00:00", "object_relation": "filename", "timestamp": "1785116723", "to_ids": true, "type": "filename", "uuid": "fe2880fa-4b37-49c7-909a-76c00a1b231f", "value": "drsza.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119879", "uuid": "3cbe6251-b1b9-48aa-82e2-b02f70944482", "Attribute": [ { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "md5", "timestamp": "1785119879", "to_ids": true, "type": "md5", "uuid": "ee36ab49-58a6-42c9-8429-42d47f68c838", "value": "16efec8d78f9105d9285f6af93327ee3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "sha1", "timestamp": "1785118278", "to_ids": true, "type": "sha1", "uuid": "9be4f491-74ec-414a-be5a-f1dfdcff578f", "value": "698be143d61fa10556528839eb1c3200b5de7e07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "sha256", "timestamp": "1785118278", "to_ids": true, "type": "sha256", "uuid": "822d282a-0b8d-44cc-93ef-46a1e9717807", "value": "105f652e6b8f31c371f2385877e43b6772aff5d3168d5d4635f8a1fcbb321421", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "text", "timestamp": "1785116766", "to_ids": false, "type": "text", "uuid": "f280d729-3993-4ac4-9aa2-1e61ce68d6b8", "value": "TrickBot\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/AnchorBot.G!MSR\nClamAV: Win.Trojan.Anchor-9800038-0\nVT Total Detection: 50/74\nFirst Submission: 2026-04-19T17:33:23+00:00\nLast Submission: 2026-04-19T17:33:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "creation-time", "timestamp": "1785116766", "to_ids": false, "type": "datetime", "uuid": "b10dbb96-51dc-48e4-8392-3e91f78f9ad7", "value": "2020-06-24T13:35:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "ssdeep", "timestamp": "1785116766", "to_ids": true, "type": "ssdeep", "uuid": "b3a44521-e44a-4629-a9ed-2c24712650c7", "value": "12288:H1Yk6Q7tcT7DRxLqkRiQyrvEB+R1zjDbjZa4Jo6iBzv3XopVa:HaQ7tcT7DnqkRizrvE+R1zPbjZa4Jo6w" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116766", "to_ids": false, "type": "size-in-bytes", "uuid": "768c018b-e2f2-48a6-9b37-56f6b959d25f", "value": "678912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "vhash", "timestamp": "1785116766", "to_ids": true, "type": "vhash", "uuid": "08bf10cb-4264-4608-aca9-210bd4734093", "value": "0650d61666161616155d1az7d9z4jz27z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-19T17:33:23+00:00", "last_seen": "2026-04-19T17:33:23+00:00", "object_relation": "filename", "timestamp": "1785116766", "to_ids": true, "type": "filename", "uuid": "e0e26ffd-6369-47a6-a5af-fb5e05b4913b", "value": "ta4blbj0p.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119900", "uuid": "e60e1227-2c84-4abb-820b-c88bee5cca0a", "Attribute": [ { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "md5", "timestamp": "1785119900", "to_ids": true, "type": "md5", "uuid": "7fb32c57-a3b7-40de-8b6b-b3b4823c8d5c", "value": "d2ac351cb04dca722610c1b21e41c216", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "sha1", "timestamp": "1785118280", "to_ids": true, "type": "sha1", "uuid": "be155fc9-9ab3-4e30-9da8-ed257fd377be", "value": "e382cf5f7744ce8e2912297ccc627c3c603fca95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "sha256", "timestamp": "1785118280", "to_ids": true, "type": "sha256", "uuid": "66f460f0-11aa-480c-b46f-8c910203f49d", "value": "33c331ededbf8ee9829895424423ce3fd17e359d2e784fcbce396aacff458cf5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "text", "timestamp": "1785116788", "to_ids": false, "type": "text", "uuid": "e0a0b620-6837-472f-b48c-38471575032a", "value": "TrickBot\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/AnchorBot.G!MSR\nClamAV: Win.Trojan.Anchor-9800038-0\nVT Total Detection: 50/74\nFirst Submission: 2026-04-20T16:53:43+00:00\nLast Submission: 2026-04-20T16:53:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "creation-time", "timestamp": "1785116788", "to_ids": false, "type": "datetime", "uuid": "13cd694b-27bd-4856-9787-9491332830cb", "value": "2020-06-24T13:35:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "ssdeep", "timestamp": "1785116788", "to_ids": true, "type": "ssdeep", "uuid": "b32082ca-95f1-4660-bef2-f8430ab70980", "value": "12288:H1Yk6Q7tcT7DRxLqkRiQyrvEB+R1zjDbjZa4Jo6iBzE3XopVa:HaQ7tcT7DnqkRizrvE+R1zPbjZa4Jo6Z" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116788", "to_ids": false, "type": "size-in-bytes", "uuid": "a6c6e544-dba1-4ed1-b551-c069627677ed", "value": "678912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "vhash", "timestamp": "1785116788", "to_ids": true, "type": "vhash", "uuid": "266ed4ca-d078-41b5-b542-a44bc14e0181", "value": "0650d61666161616155d1az7d9z4jz27z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T16:53:43+00:00", "last_seen": "2026-04-20T16:53:43+00:00", "object_relation": "filename", "timestamp": "1785116788", "to_ids": true, "type": "filename", "uuid": "379ec5a1-3436-4de6-bd6b-b0921bf7c798", "value": "jro2jm.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119921", "uuid": "fd66867c-8dc6-4374-867a-d00dc3e33b03", "Attribute": [ { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "md5", "timestamp": "1785119921", "to_ids": true, "type": "md5", "uuid": "d0b8a410-d3f0-4bd3-a7e2-cec9a36ffa2a", "value": "e0e4df7e239ccec982e512c6533d84e8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "sha1", "timestamp": "1785118281", "to_ids": true, "type": "sha1", "uuid": "47ada510-89ec-4b6a-9343-c6a2535be716", "value": "aadcfaae51aa48c2a887a2bab6b6369262083e16", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "sha256", "timestamp": "1785118281", "to_ids": true, "type": "sha256", "uuid": "55496ff6-5801-4a1f-9a62-4adf20aae498", "value": "3b19a82e1354ac14a3da7c840cbdd0ce50db38432d78e767b36f08e45024c23d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "text", "timestamp": "1785116809", "to_ids": false, "type": "text", "uuid": "d707239f-ea51-4fac-a4fa-32c4aeff8ee7", "value": "TrickBot\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/AnchorBot.G!MSR\nClamAV: Win.Trojan.Anchor-9800038-0\nVT Total Detection: 55/74\nFirst Submission: 2026-04-20T18:36:04+00:00\nLast Submission: 2026-04-20T18:36:04+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "creation-time", "timestamp": "1785116809", "to_ids": false, "type": "datetime", "uuid": "6a6750f5-9303-409b-8eb3-926dafe09a2d", "value": "2020-06-24T13:35:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "ssdeep", "timestamp": "1785116809", "to_ids": true, "type": "ssdeep", "uuid": "6fe41c50-8cce-4be1-8b31-ff0b8483d14a", "value": "12288:H1Yk6Q7tcT7DRxLqkRiQyrvEB+R1zjDbjZa4Jo6iBzi3XopVa:HaQ7tcT7DnqkRizrvE+R1zPbjZa4Jo6L" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116809", "to_ids": false, "type": "size-in-bytes", "uuid": "303e8fd4-9b3e-4693-bcfd-1c90c03d5a1a", "value": "678912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "vhash", "timestamp": "1785116809", "to_ids": true, "type": "vhash", "uuid": "cb52243c-e2d3-4859-a63a-2e2180215f08", "value": "0650d61666161616155d1az7d9z4jz27z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T18:36:04+00:00", "last_seen": "2026-04-20T18:36:04+00:00", "object_relation": "filename", "timestamp": "1785116809", "to_ids": true, "type": "filename", "uuid": "2651df15-1231-4c66-ad13-5998002f39f0", "value": "7f5gzx0a5.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119943", "uuid": "13dad8ee-ca5f-44cf-852c-355f15f0f88c", "Attribute": [ { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "md5", "timestamp": "1785119943", "to_ids": true, "type": "md5", "uuid": "ef911c0d-df03-4a23-b63f-58d94d0a8a33", "value": "e14edfa1871deb30208828523164bd4e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "sha1", "timestamp": "1785118282", "to_ids": true, "type": "sha1", "uuid": "c81288ea-3a2a-400c-b00a-b6bd641ec179", "value": "7046f5a25f70dc171df7698f0b53e6d0c67b383c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "sha256", "timestamp": "1785118283", "to_ids": true, "type": "sha256", "uuid": "da22806c-bb01-4433-ae2a-d8826f18e5c6", "value": "bf80245ba792992fbfe24abac33f8fd66f24cdeb5f0f21cfdf45a29d107c8d3b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "text", "timestamp": "1785116831", "to_ids": false, "type": "text", "uuid": "f50911f6-12e7-4fda-bbeb-a73afce3fd43", "value": "TrickBot\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/AnchorBot.G!MSR\nClamAV: Win.Trojan.Anchor-9800038-0\nVT Total Detection: 53/74\nFirst Submission: 2026-04-20T18:38:29+00:00\nLast Submission: 2026-04-20T18:38:29+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "creation-time", "timestamp": "1785116831", "to_ids": false, "type": "datetime", "uuid": "5b910ae3-6b1c-448b-a37f-fb969701ae7c", "value": "2020-06-24T13:35:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "ssdeep", "timestamp": "1785116831", "to_ids": true, "type": "ssdeep", "uuid": "4846b767-228d-4505-afe0-70473408ade3", "value": "12288:H1Yk6Q7tcT7DRxLqkRiQyrvEB+R1zjDbjZa4Jo6iBzY3XopVa:HaQ7tcT7DnqkRizrvE+R1zPbjZa4Jo6l" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116831", "to_ids": false, "type": "size-in-bytes", "uuid": "4b6fde93-075a-4ed0-be07-ae04a209ae56", "value": "678912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "vhash", "timestamp": "1785116831", "to_ids": true, "type": "vhash", "uuid": "4cf39bc7-3a12-42dd-8eb0-335a4dbb6cf7", "value": "0650d61666161616155d1az7d9z4jz27z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T18:38:29+00:00", "last_seen": "2026-04-20T18:38:29+00:00", "object_relation": "filename", "timestamp": "1785116831", "to_ids": true, "type": "filename", "uuid": "01166efc-2ddb-4675-99f2-e01feab1ef68", "value": "68z7j.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785119964", "uuid": "00a3761c-bd93-4bbd-aae0-ac4a2f5ff36a", "Attribute": [ { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "md5", "timestamp": "1785119964", "to_ids": true, "type": "md5", "uuid": "fa3833c3-441b-4109-8b73-8c56de81bb62", "value": "4d99f6b0e27c9bc29a909a8830082d05", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "sha1", "timestamp": "1785118284", "to_ids": true, "type": "sha1", "uuid": "ce0be849-0e43-4fdf-bc00-97a54f59782c", "value": "4e3026397aed9171cbbe3843a748c1f03d5c8a58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TrickBot", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "sha256", "timestamp": "1785118284", "to_ids": true, "type": "sha256", "uuid": "55184ba1-540c-4d3e-92a5-c2c8ae58a1b9", "value": "df527a5c2fbde43816cd02f4cd49eee4bb82fb4a3c7045021360888c7d504c98", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 27/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "text", "timestamp": "1785116852", "to_ids": false, "type": "text", "uuid": "a50864a3-1aaa-4dcb-9188-7ee64da969d8", "value": "TrickBot\r\nType Description: Win32 EXE\nMicrosoft: Trojan:Win64/AnchorBot.G!MSR\nClamAV: Win.Trojan.Anchor-9800038-0\nVT Total Detection: 55/74\nFirst Submission: 2026-04-21T16:14:45+00:00\nLast Submission: 2026-04-21T16:14:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "creation-time", "timestamp": "1785116852", "to_ids": false, "type": "datetime", "uuid": "0676b3c1-49b7-4eaa-ac1d-5efedf62610e", "value": "2020-06-24T13:35:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "ssdeep", "timestamp": "1785116852", "to_ids": true, "type": "ssdeep", "uuid": "be416527-4517-4f43-ab53-5a2ac8835a94", "value": "12288:H1Yk6Q7tcT7DRxLqkRiQyrvEB+R1zjDbjZa4Jo6iBz43XopVa:HaQ7tcT7DnqkRizrvE+R1zPbjZa4Jo6J" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1785116852", "to_ids": false, "type": "size-in-bytes", "uuid": "8827307e-d054-4ef0-8844-f5104fe69b47", "value": "678912" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "vhash", "timestamp": "1785116852", "to_ids": true, "type": "vhash", "uuid": "2702571d-8459-4806-9333-d651d993447e", "value": "0650d61666161616155d1az7d9z4jz27z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T16:14:45+00:00", "last_seen": "2026-04-21T16:14:45+00:00", "object_relation": "filename", "timestamp": "1785116852", "to_ids": true, "type": "filename", "uuid": "b9b4bae0-a914-430f-a747-3ba72c425734", "value": "un14k.exe" } ] } ] } }