{ "Event": { "analysis": "1", "date": "2026-06-29", "extends_uuid": "", "info": "[Threat Intel] Rapid growth and a new ransomware variant", "protected": false, "publish_timestamp": "1783115659", "published": true, "threat_level_id": "2", "timestamp": "1783115658", "uuid": "8ae24e8d-12f1-45ba-bcfb-968e5499c132", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#1d736f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Sniffing - T1040\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": "" }, { "colour": "#fa3e60", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Command History - T1070.003\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#2d0c2f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable Windows Event Logging - T1562.002\"", "relationship_type": "" }, { "colour": "#041edc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SMB/Windows Admin Shares - T1021.002\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Group Policy Modification - T1484.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"", "relationship_type": "" }, { "colour": "#36a9d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#59699c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#50bd28", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"", "relationship_type": "" }, { "colour": "#fae37b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#52d590", "local": false, "name": "misp-galaxy:target-information=\"China\"", "relationship_type": "" }, { "colour": "#f9cdc4", "local": false, "name": "misp-galaxy:target-information=\"Indonesia\"", "relationship_type": "" }, { "colour": "#2613b0", "local": false, "name": "misp-galaxy:target-information=\"Taiwan\"", "relationship_type": "" }, { "colour": "#33360c", "local": false, "name": "misp-galaxy:target-information=\"Thailand\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:ransomware=\"the gentlemen\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Linux\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Windows\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"PSEXEC\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782817207", "to_ids": false, "type": "link", "uuid": "2adbeaa4-2d18-4d6a-86d3-8252f6c3a0fd", "value": "https://securelist.com/the-gentlemen-raas/120447/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782817207", "to_ids": false, "type": "text", "uuid": "bf7b4549-c8a5-494c-b0b7-a2f661642ab0", "value": "The Gentlemen ransomware-as-a-service group emerged as a top-10 threat actor in the first half of 2026. The group exploits vulnerabilities in internet-facing devices like VPNs and firewalls, potentially collaborating with initial access brokers. They employ comprehensive reconnaissance using tools like SharpADWS, NetScan, and Advanced IP Scanner, capturing network traffic with netsh. The attackers disable security products through BYOVD techniques using vulnerable drivers, and deploy custom Go-based backdoors and ransomware variants. They spread laterally via GPO deployment and PsExec, encrypt files using Curve25519 and XChaCha20, and recently developed a C-based ransomware variant using AES256-GCM and RSA. The group targets multiple industries worldwide, particularly in Brazil, China, Indonesia, Taiwan, and Thailand, with attacks focusing on manufacturing, IT services, healthcare, and financial sectors." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782817207", "to_ids": false, "type": "text", "uuid": "b6943cbf-105c-4c54-9f6f-fdc463482ce4", "value": "Name: Rapid growth and a new ransomware variant\nAuthor: AlienVault\nAdversary: The Gentlemen\nTags: [\"vulnerable drivers\", \"sharkloader\", \"zichatbot\", \"coolclient\", \"gpo deployment\", \"ransomware-as-a-service\", \"powercloud\", \"appleseed\", \"mgbot\", \"encryption tactics\", \"byovd\", \"reversesocks\", \"cobalt strike\", \"network reconnaissance\", \"custom backdoor\", \"lateral movement\"]\nTgtd countries: [\"Brazil\", \"China\", \"Indonesia\", \"Taiwan\", \"Thailand\"]\nMlwr families: [\"SharkLoader\", \"Cobalt Strike - S0154\", \"ZiChatBot\", \"MgBot\", \"ReverseSocks\", \"PowerCloud\", \"AppleSeed - S0622\", \"CoolClient\"]\nAttack_ids: [\"T1543.003\", \"T1040\", \"T1135\", \"T1070.003\", \"T1190\", \"T1562.002\", \"T1021.002\", \"T1484.001\", \"T1070.001\", \"T1087\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1078\", \"T1027\", \"T1486\", \"T1018\", \"T1046\", \"T1569.002\", \"T1490\"]\nIndustries: [\"Manufacturing\", \"Technology\", \"Healthcare\", \"Finance\", \"Construction\", \"Transportation\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1782817207", "to_ids": false, "type": "threat-actor", "uuid": "5c1c1e89-66ea-4371-b9d8-3c7839a6d230", "value": "The Gentlemen" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783098606", "to_ids": true, "type": "hostname", "uuid": "f13040cb-c97e-4e6c-bf42-caac4e9f0f8c", "value": "rsat.activedirectory.ds-lds.tools", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096958", "to_ids": true, "type": "md5", "uuid": "1aeec12a-25c8-4f98-a82c-997f6738e21d", "value": "02944c8a5535cdb5b2cbb893db2d5acf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096959", "to_ids": true, "type": "md5", "uuid": "1ddac7fb-b620-4760-9440-8cff0c354fd8", "value": "3c471ebc947cdf32240a90ffadf49b13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096960", "to_ids": true, "type": "md5", "uuid": "7cd14a64-c7e0-4456-9af9-c880fc24a74f", "value": "4be8bb62f0ebbcf4ce52c35ab6f794f5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096961", "to_ids": true, "type": "md5", "uuid": "7bc3d6f0-5245-44d8-9fa7-af16d5a278b0", "value": "53c616677bc7e2a0a03127f19166d007", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096962", "to_ids": true, "type": "md5", "uuid": "86f2cc20-e009-4243-b66a-796c3913a66f", "value": "554e699c96b332468f1ae69c1ae81ef9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096964", "to_ids": true, "type": "md5", "uuid": "f55272f9-f6eb-4832-861f-df93d9966915", "value": "5c3b9821fc82a9028cb63b9671950919", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096964", "to_ids": true, "type": "md5", "uuid": "627e0470-119c-4222-abc5-743b37a63a14", "value": "5f0b2c6d9f442754258bf4dd841c8341", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096965", "to_ids": true, "type": "md5", "uuid": "c0d5c172-ff8f-4579-9f14-7518cceec882", "value": "608faf58353b65c45ef9833358ac3787", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096966", "to_ids": true, "type": "md5", "uuid": "36ee5bd9-e019-4eed-adec-1e9a2284fcf2", "value": "846dc77c1246db20d976346e0e359502", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096967", "to_ids": true, "type": "md5", "uuid": "a353a75c-3073-448f-9fc8-aa0713c52396", "value": "adac9984b3cc43d66a0d33079bbec299", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096968", "to_ids": true, "type": "md5", "uuid": "94940861-210d-40d5-86ce-3c16539397a3", "value": "ae0e536766788478263bf448a9381641", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096969", "to_ids": true, "type": "md5", "uuid": "eb9e5a87-9722-4fde-a79c-2e62b0d329c8", "value": "b3e418d30312c1b2c58a791286868f42", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096970", "to_ids": true, "type": "md5", "uuid": "4febfe1e-b250-41c6-bda7-a21483932e0f", "value": "c2764744dcb4b0e1db79ca1e8bf65368", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096971", "to_ids": true, "type": "md5", "uuid": "b9d3ed47-99f7-4cf1-a716-4dcb0943602a", "value": "d12a5b36dd00586cc374a1cae43efed4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096972", "to_ids": true, "type": "md5", "uuid": "052924af-c02d-4a83-9adf-897c93376810", "value": "d2f72897e8986303d5567eb2384932b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096974", "to_ids": true, "type": "md5", "uuid": "a27f10dc-57f7-4e3e-840a-029a24be7f11", "value": "de1522f9219497632f30f8a6e72f26b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 04/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783096974", "to_ids": true, "type": "md5", "uuid": "4cf2bfc5-af26-4304-bb01-b4989b3ecc29", "value": "fdae2beb813778b4540a997706862096", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783098628", "to_ids": true, "type": "ip-dst", "uuid": "e42b31dd-5a8f-4d6e-806d-f40ec12e5ab8", "value": "81.177.215.15", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098650", "uuid": "0ce06210-aa54-423c-a4bc-2c48bbc324b6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "md5", "timestamp": "1783098650", "to_ids": true, "type": "md5", "uuid": "73c46393-368e-4343-8f0c-49d224ba693d", "value": "9321a61a25c7961d9f36852ecaa86f55", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "sha1", "timestamp": "1783096940", "to_ids": true, "type": "sha1", "uuid": "99024dba-e7f5-4473-a3dd-af1546aaacbc", "value": "6afc6b04cf73dd461e4a4956365f25c1f1162387", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "sha256", "timestamp": "1783096941", "to_ids": true, "type": "sha256", "uuid": "d8e33883-7794-4d01-aab1-7faf97a02b84", "value": "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "text", "timestamp": "1783094880", "to_ids": false, "type": "text", "uuid": "a15e39d9-181a-4f47-96cd-a8eadf055789", "value": "Type Description: Win32 EXE\nOriginal name: inpoutx64.sys\nVerified: Signed\nSigning date: 12:17 AM 10/18/2008\nSigners: Red Fox UK Limited; VeriSign Class 3 Code Signing 2004 CA; VeriSign Class 3 Public Primary CA\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Seen In The Wild: 2011-04-05T16:07:32+00:00\nFirst Submission: 2012-02-11T13:18:12+00:00\nLast Submission: 2026-07-03T11:17:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "creation-time", "timestamp": "1783094880", "to_ids": false, "type": "datetime", "uuid": "12a7e7ef-3eac-42b1-927e-1717b2c4cfe2", "value": "2008-10-17T23:01:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "ssdeep", "timestamp": "1783094880", "to_ids": true, "type": "ssdeep", "uuid": "c0ee3943-f3a6-45f0-ad1f-79405a8068a1", "value": "192:31Hhhh0mwRJnyowJL/aMjGwP7HM3UM+ebMPkuZgjlBME:lH90mwRJnYJLWZLbkku6j" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1783094880", "to_ids": false, "type": "size-in-bytes", "uuid": "9445a779-feda-4669-bbfa-de3318d4971d", "value": "15008" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "vhash", "timestamp": "1783094880", "to_ids": true, "type": "vhash", "uuid": "d6bcd94a-0ad6-4d2d-8e1d-c04c91907d48", "value": "014066551d151e1519z17zcxz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2012-02-11T13:18:12+00:00", "last_seen": "2026-07-03T11:17:45+00:00", "object_relation": "filename", "timestamp": "1783094880", "to_ids": true, "type": "filename", "uuid": "450fa6c2-ccc5-457a-bff4-c2d6ea99760f", "value": "inpoutx64.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098671", "uuid": "ddc679f9-1e27-452b-97da-8636486e957d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "md5", "timestamp": "1783098671", "to_ids": true, "type": "md5", "uuid": "9f6f4413-b740-456d-bebb-56206c03d383", "value": "b6b51508ad6f462c45fe102c85d246c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "sha1", "timestamp": "1783096942", "to_ids": true, "type": "sha1", "uuid": "fba59ac2-b2cf-4862-86a5-803a8dd50c19", "value": "96f0dbf52aed0afd43e44500116b04b674f7358e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "sha256", "timestamp": "1783096942", "to_ids": true, "type": "sha256", "uuid": "1188412e-3ae1-41e2-a00b-3df460af8ab5", "value": "5af1dae21425dda8311a2044209c308525135e1733eeff5dd20649946c6e054c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "text", "timestamp": "1783094903", "to_ids": false, "type": "text", "uuid": "edb14a64-d50a-48bb-8803-48791a5b838d", "value": "Type Description: Win32 EXE\nOriginal name: wamsdk.sys\nVerified: Signed\nSigning date: 06:45 PM 07/01/2025\nSigners: WATCHDOGDEVELOPMENT.COM, LLC; GlobalSign GCC R45 EV CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign; GlobalSign Root CA - R1\nMicrosoft: VulnerableDriver:Win64/Wasmdk!MSR\nClamAV: Win.Trojan.Generic-10056419-0\nVT Total Detection: 26/74\nFirst Submission: 2025-07-03T01:48:05+00:00\nLast Submission: 2026-05-21T20:12:14+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "creation-time", "timestamp": "1783094903", "to_ids": false, "type": "datetime", "uuid": "fc550093-44fe-4bb7-b330-fa6e6de1a63b", "value": "2025-07-01T18:21:01+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "ssdeep", "timestamp": "1783094903", "to_ids": true, "type": "ssdeep", "uuid": "c0a6c810-6206-4955-813b-d8db95f0464f", "value": "3072:6oV1yKCmHEa5XFZHgeLYrAfs0rfwaEed/QDBJ:6oV1rCZatgeOEwaEi4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1783094903", "to_ids": false, "type": "size-in-bytes", "uuid": "2231f423-23eb-4a71-911c-2d612626cecd", "value": "192440" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "vhash", "timestamp": "1783094903", "to_ids": true, "type": "vhash", "uuid": "6c0a4c86-c24d-430d-9662-f9d15d298e0c", "value": "015086655d55166655151iz7bxz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-07-03T01:48:05+00:00", "last_seen": "2026-05-21T20:12:14+00:00", "object_relation": "filename", "timestamp": "1783094903", "to_ids": true, "type": "filename", "uuid": "a46bcfdb-bdf6-465d-9cf9-d72cf5728979", "value": "wamsdk.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098720", "uuid": "91882a84-b294-4c82-bdfe-25c942fd568f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "md5", "timestamp": "1783098720", "to_ids": true, "type": "md5", "uuid": "ae4326d0-9d14-4f8d-abc2-0ee17e9e7008", "value": "8f0577d28c4ff5f71b149f444bfaba8e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "sha1", "timestamp": "1783096943", "to_ids": true, "type": "sha1", "uuid": "aa0d1133-170e-447c-94b8-59d79311da97", "value": "7556ae58c215b8245a43f764f0676c7a8f0fdd1a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "sha256", "timestamp": "1783096943", "to_ids": true, "type": "sha256", "uuid": "7a9381e4-0851-4a91-bb10-cf46e4636770", "value": "9ddae47ff968343a8c32a5344060257fdc08e2a7bdb9a227c8b3a584ee3c9f1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "text", "timestamp": "1783094924", "to_ids": false, "type": "text", "uuid": "7c6c7a3b-bf56-4f43-9231-f9a1582048d5", "value": "Type Description: Win32 EXE\nOriginal name: GameDriverX64.sys\nVerified: Signed\nSigning date: 03:31 AM 04/17/2023\nSigners: Fedeen Games Limited; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4\nMicrosoft: None\nClamAV: None\nVT Total Detection: 9/74\nFirst Seen In The Wild: 2024-02-01T14:19:37+00:00\nFirst Submission: 2024-02-07T16:57:01+00:00\nLast Submission: 2026-07-01T10:54:40+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "creation-time", "timestamp": "1783094925", "to_ids": false, "type": "datetime", "uuid": "008857fd-dd68-454d-bcc6-88ad0c863db2", "value": "2023-04-10T07:40:34+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "ssdeep", "timestamp": "1783094925", "to_ids": true, "type": "ssdeep", "uuid": "3009f3fa-1d3a-4d4d-92e6-886d16e03682", "value": "1536:CM4RHcydPl0T8sQmSwhi7/3h1JPRMElzK:w8Il0D5i/JPtW" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "size-in-bytes", "timestamp": "1783094925", "to_ids": false, "type": "size-in-bytes", "uuid": "5b3c9847-7fa2-42d3-b8db-487cd74a5691", "value": "57552" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "vhash", "timestamp": "1783094925", "to_ids": true, "type": "vhash", "uuid": "63a639cb-c54c-4b04-95e9-80f510018eac", "value": "054096651d75767656551iz45xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-02-07T16:57:01+00:00", "last_seen": "2026-07-01T10:54:40+00:00", "object_relation": "filename", "timestamp": "1783094925", "to_ids": true, "type": "filename", "uuid": "d764883d-6fbb-4e56-bf4d-95aeb116d80a", "value": "GameDriverX64.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098741", "uuid": "905f2462-fb6a-4ba0-968a-33401b83df0b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "md5", "timestamp": "1783098741", "to_ids": true, "type": "md5", "uuid": "3cff5f22-ed60-4f57-94f5-757abacc0735", "value": "eef8a950952696b018aa9c6da2f5d7ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "sha1", "timestamp": "1783096944", "to_ids": true, "type": "sha1", "uuid": "a7964385-74e1-4242-bb87-dd7eb4dddbc4", "value": "1fa071303fb846308571e64727501fb98b1c2be6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "sha256", "timestamp": "1783096944", "to_ids": true, "type": "sha256", "uuid": "ae188427-8bec-41ff-8cfe-562ff5a0abef", "value": "5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "text", "timestamp": "1783094946", "to_ids": false, "type": "text", "uuid": "4e25b7ad-4266-40b2-8c4d-89c706ed71b7", "value": "Type Description: Win32 EXE\nFile distributed by: ['Microsoft']\nData sources: ['HashDB']\nVerdict filename: ['HWAudioOs2Ec.sys']\nOriginal name: HWAuidoOs2Ec.sys\nVerified: Signed\nSigning date: 02:51 AM 11/16/2021\nSigners: Huawei Device Co., Ltd.; GlobalSign CodeSigning CA - SHA256 - G3; GlobalSign Root CA - R3\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2022-01-14T06:23:32+00:00\nLast Submission: 2026-07-02T21:36:45+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "creation-time", "timestamp": "1783094946", "to_ids": false, "type": "datetime", "uuid": "59670d6d-51d8-41cc-8b58-fdb136d3ed9d", "value": "2021-11-16T02:49:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "ssdeep", "timestamp": "1783094946", "to_ids": true, "type": "ssdeep", "uuid": "bd99d2b6-d398-4654-b521-0d0cb688b187", "value": "768:4vBHl9DiRieNDb8GpJH8iulH4cT/vNMuaxwRenN3mGVjfR7JKhLhn2KBUL:4v8pH7oLdReNWMzRdI2KBUL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1783094946", "to_ids": false, "type": "size-in-bytes", "uuid": "ed840e1a-923b-44b7-9f0d-ba4d789101f9", "value": "47240" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "vhash", "timestamp": "1783094946", "to_ids": true, "type": "vhash", "uuid": "843e0434-f22b-4db4-a197-4a02519030d4", "value": "044086651d151666551519z16z3exz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2022-01-14T06:23:32+00:00", "last_seen": "2026-07-02T21:36:45+00:00", "object_relation": "filename", "timestamp": "1783094946", "to_ids": true, "type": "filename", "uuid": "41c5d31b-016c-49e2-a2b5-df35d07976e7", "value": "HWAuidoOs2Ec.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098762", "uuid": "a8543bf3-ee64-4f2c-8cbf-5989aa96c5e8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "md5", "timestamp": "1783098762", "to_ids": true, "type": "md5", "uuid": "e5f4cf2e-3508-49f7-99b6-c92e372bbf78", "value": "5761bd63da03686fc480245da7bd1e9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "sha1", "timestamp": "1783096946", "to_ids": true, "type": "sha1", "uuid": "3f31daf8-7f04-45b1-b7f0-dc2cda434fca", "value": "68fec379f2ae76c3d2ce913f7be650cea1d06990", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "sha256", "timestamp": "1783096946", "to_ids": true, "type": "sha256", "uuid": "af82fd31-a3c4-482d-97d7-012aa37440d4", "value": "5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "text", "timestamp": "1783094969", "to_ids": false, "type": "text", "uuid": "467da6b4-3eab-41ab-85d5-d6001d5cff73", "value": "Type Description: Win32 EXE\nOriginal name: ProcessMonitorDriver\nVerified: Signed\nSigning date: 08:00 PM 02/04/2026\nSigners: Microsoft Windows Hardware Compatibility Publisher; Microsoft Windows Third Party Component CA 2012; Microsoft Root Certificate Authority 2010\nMicrosoft: None\nClamAV: None\nVT Total Detection: 3/74\nFirst Submission: 2026-02-06T07:33:16+00:00\nLast Submission: 2026-07-01T12:09:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "creation-time", "timestamp": "1783094969", "to_ids": false, "type": "datetime", "uuid": "3bf8cb77-71e6-4e17-8a25-ce253e6d4816", "value": "2026-02-04T19:24:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "ssdeep", "timestamp": "1783094969", "to_ids": true, "type": "ssdeep", "uuid": "9df888ae-b49f-4eda-9427-af1f3fe595a7", "value": "768:4QcpKO3Eb4IF/He7ItmhcK6OpW5ONb8Cf9zuk:wwOjIdHe7ItmhcK6OpFNb8ozj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1783094969", "to_ids": false, "type": "size-in-bytes", "uuid": "c9f388e7-0886-4a67-921a-776531485719", "value": "37456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "vhash", "timestamp": "1783094969", "to_ids": true, "type": "vhash", "uuid": "e2dda9b8-d4ee-46a4-9d05-ffb540cf7e95", "value": "034086651d15151615151iz2fwz1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "filename", "timestamp": "1783094969", "to_ids": true, "type": "filename", "uuid": "a9341e4f-71d2-428f-ac3f-de503df5c8f8", "value": "ProcessMonitorDriver" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098783", "uuid": "b78e61ea-3698-4b01-909d-be14085e3fa1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "object_relation": "md5", "timestamp": "1783098783", "to_ids": true, "type": "md5", "uuid": "4a4aac54-2ffb-46ff-a86d-440ac6b26a90", "value": "6ae7c9a7ea0b8c40a64225734f6bd01d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "object_relation": "sha1", "timestamp": "1783096947", "to_ids": true, "type": "sha1", "uuid": "0432a964-a6ab-4fd9-8ed6-0a6464331757", "value": "8468cb5888fb383d25f9144c2b2f61c414cea3f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "object_relation": "sha256", "timestamp": "1783096947", "to_ids": true, "type": "sha256", "uuid": "db090c5e-4715-4056-a0e2-17ba49a39b49", "value": "c7f7b5a6e7d93221344e6368c7ab4abf93e162f7567e1a7bcb8786cb8a183a73", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "object_relation": "text", "timestamp": "1783094990", "to_ids": false, "type": "text", "uuid": "360c7903-2ba4-406f-81e5-43ce243d4e3c", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Gentlemen.SH!MTB\nClamAV: Win.Tool.Garble-10044180-0\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2026-04-20T14:00:36+00:00\nFirst Submission: 2026-04-03T11:22:28+00:00\nLast Submission: 2026-04-03T11:28:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "object_relation": "ssdeep", "timestamp": "1783094990", "to_ids": true, "type": "ssdeep", "uuid": "319ba610-9361-4879-8d11-bcbc6475340f", "value": "49152:ailDmmQw2iK2EY2spo4/ODIujYaqZGwfh4gpvTeE5EbAk6+cJz9nwPDC7bODth5a:aiFGvbSre2EU2WzFwPD+8th5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1783094990", "to_ids": false, "type": "size-in-bytes", "uuid": "0bf2daba-c366-492c-8f04-4a0f48906542", "value": "3975680" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "object_relation": "vhash", "timestamp": "1783094990", "to_ids": true, "type": "vhash", "uuid": "aea5b6d7-1ff5-432a-9f73-2394907c5f87", "value": "036086655d75551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-03T11:22:28+00:00", "last_seen": "2026-04-03T11:28:20+00:00", "object_relation": "filename", "timestamp": "1783094990", "to_ids": true, "type": "filename", "uuid": "29163422-b745-4bd9-ac03-6ff88337782f", "value": "4jp2foriy.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098805", "uuid": "a7a276dc-5602-4d69-9c20-a69c7b599695", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "object_relation": "md5", "timestamp": "1783098805", "to_ids": true, "type": "md5", "uuid": "3c74e763-39db-4e39-90db-8b351df5a458", "value": "3b46a729db7ae6af8b19711c9452194d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "object_relation": "sha1", "timestamp": "1783096948", "to_ids": true, "type": "sha1", "uuid": "83e5601f-9028-4aa8-835c-ed287e65c045", "value": "5aea74bf3e70f38eb596f8002b3c02514daee4f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "object_relation": "sha256", "timestamp": "1783096948", "to_ids": true, "type": "sha256", "uuid": "346a20b7-9f7a-4905-acda-b4796eca1198", "value": "b67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "object_relation": "text", "timestamp": "1783095012", "to_ids": false, "type": "text", "uuid": "1367cead-8c88-4add-a329-5bf1c879d330", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Gentlemen.SH!MTB\nClamAV: Win.Tool.Garble-10044180-0\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2026-04-20T14:00:35+00:00\nFirst Submission: 2026-04-01T12:09:24+00:00\nLast Submission: 2026-07-03T08:53:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "object_relation": "ssdeep", "timestamp": "1783095012", "to_ids": true, "type": "ssdeep", "uuid": "9c4b1c59-05d7-4a42-8e22-ad04053b0928", "value": "49152:ailDmmYw2i62EYW0po4/2m3jeXiZ+wfN4gpv5eP5EbAk6+cJz9nwPDC7bODth5yX:aiFO34ReBEU2WzFwPD+8th5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095012", "to_ids": false, "type": "size-in-bytes", "uuid": "8dc600f8-8b2b-41b8-8fc1-a0d3b78b42da", "value": "3975680" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "object_relation": "vhash", "timestamp": "1783095012", "to_ids": true, "type": "vhash", "uuid": "1ca9d473-2011-47b9-ba47-317d05ed73d8", "value": "036086655d75551d15541az2e!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-01T12:09:24+00:00", "last_seen": "2026-07-03T08:53:19+00:00", "object_relation": "filename", "timestamp": "1783095012", "to_ids": true, "type": "filename", "uuid": "12411a62-72a6-405b-905d-fc707fcb736a", "value": "3b46a729db7ae6af8b19711c9452194d.file" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098826", "uuid": "c4f76d38-41ff-4516-b7a7-c65daf6d6b1b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "object_relation": "md5", "timestamp": "1783098826", "to_ids": true, "type": "md5", "uuid": "20280ecc-8aa4-4cea-b649-1035e9583b60", "value": "10ca9a4040001560d053b7e7885c1b95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "object_relation": "sha1", "timestamp": "1783096949", "to_ids": true, "type": "sha1", "uuid": "82304dd4-d1f3-4ddd-8642-98ae6a2df682", "value": "e7cc7b32d844ec6a2f41f0efbc64a0783afb56e4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "object_relation": "sha256", "timestamp": "1783096949", "to_ids": true, "type": "sha256", "uuid": "d32c53cc-2195-422c-b7d3-1f891c0ea952", "value": "1af419b36a5edefef387409e2b3248c9223f7dc49a4f7b15ea095d371c3a70b2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "object_relation": "text", "timestamp": "1783095033", "to_ids": false, "type": "text", "uuid": "e0d48463-a51a-4cda-a8f0-af03fe1f94d8", "value": "Type Description: Win32 EXE\nMicrosoft: Ransom:Win64/Gentlemen.B\nClamAV: Win.Tool.Garble-10044180-0\nVT Total Detection: 51/74\nFirst Submission: 2026-04-09T17:47:08+00:00\nLast Submission: 2026-04-09T17:47:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "object_relation": "ssdeep", "timestamp": "1783095033", "to_ids": true, "type": "ssdeep", "uuid": "432faa8a-081e-4d50-b255-5a43066d9065", "value": "49152:kx5UADyeQaU9IK4l3jVoH6dhE3axvkup4r4ISI5ElcYB9nwPDC7bODth5yx30G3a:WDDyeQMK4l5IrpEXBFwPD+8th5S" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095033", "to_ids": false, "type": "size-in-bytes", "uuid": "1e10a693-8b35-45ae-aa19-5b556d9f9b4d", "value": "3885056" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "object_relation": "vhash", "timestamp": "1783095033", "to_ids": true, "type": "vhash", "uuid": "f93b250b-ca66-46c6-bb36-22e526d80315", "value": "036066655d7d15641az2c!z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-09T17:47:08+00:00", "last_seen": "2026-04-09T17:47:08+00:00", "object_relation": "filename", "timestamp": "1783095033", "to_ids": true, "type": "filename", "uuid": "58bf36bb-4cdc-4fb2-b6e7-7b580e7e1727", "value": "uh5a4lt6i.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098847", "uuid": "9891358b-a715-4c58-966a-e4ce7769168d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "md5", "timestamp": "1783098847", "to_ids": true, "type": "md5", "uuid": "0a187e42-efed-4dc8-a852-7ec4e0fa4c74", "value": "73f0a8c3ea794a04e80c32038249f044", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "sha1", "timestamp": "1783096951", "to_ids": true, "type": "sha1", "uuid": "ee247790-186a-40fd-89cb-590331a7a8f0", "value": "ab5ad04bb822435e5453706cd86cc001ee555aee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "sha256", "timestamp": "1783096951", "to_ids": true, "type": "sha256", "uuid": "df0efb6b-a50d-4cf9-9349-36003c1395ab", "value": "cb747c0134f99d5033bac6e966864e2435a2a94244ca8e3f614f4992df93ff10", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "text", "timestamp": "1783095222", "to_ids": false, "type": "text", "uuid": "4d2645c7-1449-4ffd-a147-cf79d389cdd6", "value": "Type Description: Win32 EXE\nOriginal name: wsftprm.sys\nVerified: Signed\nSigning date: 02:23 PM 02/15/2024\nSigners: TPZ SOLUCOES DIGITAIS LTDA; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2023-05-03T20:54:10+00:00\nFirst Submission: 2024-04-28T18:35:51+00:00\nLast Submission: 2026-02-09T20:46:02+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "creation-time", "timestamp": "1783095222", "to_ids": false, "type": "datetime", "uuid": "b232e432-57e7-4782-8cef-20405854c3b4", "value": "2024-02-15T14:21:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "ssdeep", "timestamp": "1783095222", "to_ids": true, "type": "ssdeep", "uuid": "d8ae7a68-45ca-406e-805b-173251b0d4dc", "value": "768:zxLkhtTRHKVFMxQSH4cT2bj1x5uadPaY5CJOgl8TYioQUD4AMxkEv13TDuO9zyY:5khT6SvaPfT7L/xBHzyY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095222", "to_ids": false, "type": "size-in-bytes", "uuid": "cb5695de-df84-4a3a-a99b-69b2930cbc8b", "value": "52104" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "vhash", "timestamp": "1783095222", "to_ids": true, "type": "vhash", "uuid": "33529f06-707d-4203-af42-4cac23532da0", "value": "054086651d55166655151iz37xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-04-28T18:35:51+00:00", "last_seen": "2026-02-09T20:46:02+00:00", "object_relation": "filename", "timestamp": "1783095222", "to_ids": true, "type": "filename", "uuid": "50a257d5-04b6-4cc6-85c8-4efb94c8a4e8", "value": "wsftprm.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098868", "uuid": "62b097f1-f70f-422b-adbe-355575db7e1b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "md5", "timestamp": "1783098868", "to_ids": true, "type": "md5", "uuid": "d82e3679-c105-42ca-87c1-4e7a708d3e67", "value": "b9986a0f1f1f1a798dc3f0c59a80a1a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "sha1", "timestamp": "1783096952", "to_ids": true, "type": "sha1", "uuid": "a4436284-7735-4bd6-8322-45262f36a36f", "value": "02b169d8ac1f3c495000398f2dd35fc9a0f99815", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "sha256", "timestamp": "1783096952", "to_ids": true, "type": "sha256", "uuid": "ca79d903-5546-4fea-8ec3-d2106ba6b047", "value": "086bdbaa9ae8ea7e9f7f22901ea8f06cd5613595fb70f64da63cf78134b21b1d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "text", "timestamp": "1783095328", "to_ids": false, "type": "text", "uuid": "eb61714c-f1d9-43a5-a4f5-7c0b06569005", "value": "Type Description: Win32 EXE\nOriginal name: porelos-gentl\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2026-04-06T08:26:06+00:00\nFirst Submission: 2026-04-02T01:13:22+00:00\nLast Submission: 2026-04-03T10:43:32+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "creation-time", "timestamp": "1783095328", "to_ids": false, "type": "datetime", "uuid": "972dd99d-4761-47c1-8b49-7a52ffe7f235", "value": "2026-03-18T09:01:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "ssdeep", "timestamp": "1783095328", "to_ids": true, "type": "ssdeep", "uuid": "0cb6c663-24f2-4f85-8aaa-62c10b67b4b1", "value": "49152:Ljmm0UbMDlE/DYooIVwAsOZQcMmScoCPcw2or1oI1G3tFcGtlqsrQ5h+VBnOOkqD:umKYQEPcxwo3tfRccF+NOj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095328", "to_ids": false, "type": "size-in-bytes", "uuid": "180f007d-5bf2-46f1-a02d-2c7a56153942", "value": "5063168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "vhash", "timestamp": "1783095328", "to_ids": true, "type": "vhash", "uuid": "43192714-1ab8-40aa-88b2-c13f31f7a411", "value": "0560c76d1d7555651c0d5153z82z656dlz34z1e7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-02T01:13:22+00:00", "last_seen": "2026-04-03T10:43:32+00:00", "object_relation": "filename", "timestamp": "1783095328", "to_ids": true, "type": "filename", "uuid": "d1ce92fd-793e-449f-8487-106fa2e08af4", "value": "porelos-gentl" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098889", "uuid": "9e5e9b7b-39c7-4112-b2fc-1ed8d4b62237", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "md5", "timestamp": "1783098889", "to_ids": true, "type": "md5", "uuid": "e58645b6-1991-4c88-8b1b-ca55723e7635", "value": "edb1c480295250dd1a38f3aa1357deae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "sha1", "timestamp": "1783096954", "to_ids": true, "type": "sha1", "uuid": "38dae7d0-d9a3-4ba5-84cc-090f6ae28418", "value": "9f426865aa7a2a6c28b3162f40237678c2e9dec6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "sha256", "timestamp": "1783096954", "to_ids": true, "type": "sha256", "uuid": "e5bbd980-89e2-4363-84ae-3ca974e5e317", "value": "60854005e016393bf041a7e68858f9970d695ca1d448b5a7232709cad2636987", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 30/06/2026", "deleted": false, "disable_correlation": true, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "text", "timestamp": "1783095433", "to_ids": false, "type": "text", "uuid": "48ab7dcd-767b-4ded-ae15-f236371c54f5", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 02:11 AM 07/20/2015\nSigners: SOFTPERFECT PTY. LTD.; DigiCert SHA2 Assured ID Code Signing CA; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/75\nFirst Seen In The Wild: 2015-07-19T20:10:46+00:00\nFirst Submission: 2015-07-20T05:04:05+00:00\nLast Submission: 2026-05-27T12:18:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "creation-time", "timestamp": "1783095433", "to_ids": false, "type": "datetime", "uuid": "c843e61d-b7db-481d-a14f-0a411361a229", "value": "2015-07-20T02:10:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "ssdeep", "timestamp": "1783095433", "to_ids": true, "type": "ssdeep", "uuid": "c3b76561-5b20-4347-ba26-b3696371bcf3", "value": "24576:16vosK5nVzM/OIn9XrYO1gNPNqYaObTQUnw1PAhOV3/rcwSMhaBJ0mBS:ggsWzMmIn951kY11NTcwSMhaBJfBS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095433", "to_ids": false, "type": "size-in-bytes", "uuid": "d22b8a18-18b4-464e-b750-623129cbb9dc", "value": "1648232" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "vhash", "timestamp": "1783095433", "to_ids": true, "type": "vhash", "uuid": "a022f288-6ca2-470a-b5cf-6dfcf57ac958", "value": "01603f7f5d50101011z13z1013z1015z1010101010101016z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2015-07-20T05:04:05+00:00", "last_seen": "2026-05-27T12:18:20+00:00", "object_relation": "filename", "timestamp": "1783095433", "to_ids": true, "type": "filename", "uuid": "fa217a06-0884-43ca-bde1-e222639301c2", "value": "netscan.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098910", "uuid": "03331592-742e-412b-8bef-331976b69346", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "md5", "timestamp": "1783098910", "to_ids": true, "type": "md5", "uuid": "2b627092-5bcf-43d4-abca-13e652e0ac68", "value": "525ef6014f0ef20e44fe47c1d9980b69", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "sha1", "timestamp": "1783096955", "to_ids": true, "type": "sha1", "uuid": "10e7e2b4-77d5-41cf-94fb-575163f9d193", "value": "cab45e9d03efa8a09595b99b275caadb8f250811", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "sha256", "timestamp": "1783096955", "to_ids": true, "type": "sha256", "uuid": "cca7264c-a7bb-4b76-84d8-2e3f0d574cdc", "value": "174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "text", "timestamp": "1783095475", "to_ids": false, "type": "text", "uuid": "9c66ed5d-5117-4b64-8eee-18d23793cd72", "value": "Type Description: Win32 DLL\nOriginal name: biontdrv.sys\nVerified: Signed\nSigning date: 12:04 PM 08/11/2022\nSigners: Paragon Software GmbH; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2022-08-11T05:04:23+00:00\nFirst Submission: 2023-03-02T16:20:30+00:00\nLast Submission: 2026-02-11T15:37:17+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "creation-time", "timestamp": "1783095475", "to_ids": false, "type": "datetime", "uuid": "28ce3fc3-3f99-4397-8f95-4677cad645a7", "value": "2022-08-11T12:04:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "ssdeep", "timestamp": "1783095475", "to_ids": true, "type": "ssdeep", "uuid": "c34b90ce-0190-47df-97e1-0b5254c8cf75", "value": "768:udddkNiXps0Yi8ucQwnpzQeExI8d3519zAaejG:mdq4XK078ucNnpzQXI8ddzTb" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095475", "to_ids": false, "type": "size-in-bytes", "uuid": "40e28553-ffc0-445d-a11f-91030844824c", "value": "32608" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "vhash", "timestamp": "1783095475", "to_ids": true, "type": "vhash", "uuid": "df781995-ad73-44db-9215-054d92072edd", "value": "1340665d1515151519z16z31xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-03-02T16:20:30+00:00", "last_seen": "2026-02-11T15:37:17+00:00", "object_relation": "filename", "timestamp": "1783095475", "to_ids": true, "type": "filename", "uuid": "bd76af2d-ded1-4f4d-981f-b94c0a898ea8", "value": "biontdrv.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098932", "uuid": "e550e2ea-2709-4ee6-98fd-447ee840df58", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "md5", "timestamp": "1783098932", "to_ids": true, "type": "md5", "uuid": "30d125f2-85d2-41ee-8945-a3ab36995018", "value": "407b6a136bbaa7172eb44ef9d08bb58a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "sha1", "timestamp": "1783096956", "to_ids": true, "type": "sha1", "uuid": "21166956-b1e5-41e0-8349-05239d732822", "value": "9574b4fed805de56c0070bc43933b726dfee6ad2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "sha256", "timestamp": "1783096956", "to_ids": true, "type": "sha256", "uuid": "bbd1338c-7ed3-427c-989d-625eec0e7b8b", "value": "e4d6a46d95437793c99947d52cd1025ce404f08587369e858740172bf23f1bb2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 02/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "text", "timestamp": "1783095497", "to_ids": false, "type": "text", "uuid": "c36bddb5-036b-4e88-8314-bbb3f5997180", "value": "Type Description: Win32 DLL\nOriginal name: biontdrv.sys\nVerified: Signed\nSigning date: 12:04 PM 08/11/2022\nSigners: Paragon Software GmbH; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2022-08-11T05:04:19+00:00\nFirst Submission: 2022-12-06T22:25:24+00:00\nLast Submission: 2026-01-01T17:40:55+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "creation-time", "timestamp": "1783095497", "to_ids": false, "type": "datetime", "uuid": "02e2ffb4-96b5-40b2-8995-c3261729b1d6", "value": "2022-08-11T12:04:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "ssdeep", "timestamp": "1783095497", "to_ids": true, "type": "ssdeep", "uuid": "4e87e79a-ba86-46dd-887a-006d3c08040c", "value": "768:B+exG49MN2Yi8ucQWWweEFd3r7os29zcd:B+exGl278ucqwDdflCz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095497", "to_ids": false, "type": "size-in-bytes", "uuid": "89570776-c6e7-446c-81ae-fe70852a86a4", "value": "34664" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "vhash", "timestamp": "1783095497", "to_ids": true, "type": "vhash", "uuid": "25561c2e-d884-4adf-a916-fbce5a993e9b", "value": "1340666d1515151519z16z31xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2022-12-06T22:25:24+00:00", "last_seen": "2026-01-01T17:40:55+00:00", "object_relation": "filename", "timestamp": "1783095497", "to_ids": true, "type": "filename", "uuid": "b9e4156e-9e72-43a3-a4e6-45989c226589", "value": "biontdrv.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783098953", "uuid": "f290aeaf-1e4b-4645-9fae-3828f0d7719d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "md5", "timestamp": "1783098953", "to_ids": true, "type": "md5", "uuid": "bfe1966b-1a6e-4b8d-86a5-a5d6d01187ca", "value": "5537c708edb9a2c21f88e34e8a0f1744", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "sha1", "timestamp": "1783096957", "to_ids": true, "type": "sha1", "uuid": "f30ea521-11f9-4cd5-803a-e12c7c5516ed", "value": "86233a285363c2a6863bf642deab7e20f062b8eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "sha256", "timestamp": "1783096957", "to_ids": true, "type": "sha256", "uuid": "81a4e8b8-5297-466b-ab9f-c6e0694c7125", "value": "26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 04/07/2026\nLast-scan: 03/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "text", "timestamp": "1783095519", "to_ids": false, "type": "text", "uuid": "fbe99c7e-8c23-4d10-a60a-6d8a369ac0c3", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 04:51 PM 04/29/2022\nSigners: Famatech Corp.; Symantec Class 3 Extended Validation Code Signing CA - G2; VeriSign\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Seen In The Wild: 2022-05-06T13:46:37+00:00\nFirst Submission: 2022-05-06T12:33:57+00:00\nLast Submission: 2026-07-03T15:16:56+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "creation-time", "timestamp": "1783095519", "to_ids": false, "type": "datetime", "uuid": "4910b01d-1f88-4efb-9ef8-c08c8ee582f7", "value": "2013-01-30T14:21:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "ssdeep", "timestamp": "1783095519", "to_ids": true, "type": "ssdeep", "uuid": "99c16d87-4e16-43e8-8b83-237f70e3c7fe", "value": "393216:Plu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5i:A7Th9mT97S7CzNwWCJK05IRTX+Fi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1783095519", "to_ids": false, "type": "size-in-bytes", "uuid": "a249c664-d067-459c-b72d-4585b1a7fbde", "value": "21050672" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "vhash", "timestamp": "1783095519", "to_ids": true, "type": "vhash", "uuid": "659563f6-aef7-459f-a26f-077e360d12ff", "value": "027086665d1c0d5c0515503016z2az3bz4fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2022-05-06T12:33:57+00:00", "last_seen": "2026-07-03T15:16:56+00:00", "object_relation": "filename", "timestamp": "1783095519", "to_ids": true, "type": "filename", "uuid": "bc7371ab-dfd0-42a3-bc5f-023970b55cdd", "value": "Advanced_IP_Scanner_2.5.4594.1.exe" } ] } ] } }