{ "Event": { "analysis": "1", "date": "2026-07-01", "extends_uuid": "", "info": "[Threat Intel] How a single ScreenConnect incident exposed a massive campaign", "protected": false, "publish_timestamp": "1783858421", "published": true, "threat_level_id": "2", "timestamp": "1783858421", "uuid": "8db02c4b-6b5b-4272-86da-34d5fe14b670", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#0088cc", "local": false, "name": "misp-galaxy:producer=\"Kaspersky\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#51b040", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"InstallUtil - T1218.004\"", "relationship_type": "" }, { "colour": "#7eb739", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Msiexec - T1218.007\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#4bc785", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#98f3da", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AsyncRAT\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#120044", "local": false, "name": "rectifyq:sub-category=\"intrusion-analysis\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"ScreenConnect\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782990020", "to_ids": false, "type": "link", "uuid": "30e1bd22-9c30-483f-a566-ef151828e863", "value": "https://securelist.com/tr/the-soc-files-screenconnect-campaign-with-asyncrat/120472/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782990020", "to_ids": false, "type": "text", "uuid": "ab98ab91-af2a-40da-ae87-df05533871f4", "value": "A massive campaign distributes malicious installer archives hosted on spoofed websites masquerading as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam. Over 90 domain names localized across 10 languages were discovered. The malicious archives bundle a legitimate Microsoft-signed install.exe binary with a rogue install.res.1033.dll library deployed via DLL sideloading. This installs the ScreenConnect remote access service, which then deploys AsyncRAT payloads through PowerShell and VBS scripts. The threat actors leverage SEO techniques to position fraudulent sites at the top of search engine results, targeting both individual users and corporate networks. The infrastructure spans three IP addresses with domains registered between October 2025 and March 2026, creating a global footprint with multi-language support." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782990020", "to_ids": false, "type": "text", "uuid": "89889846-0662-4ca7-a08f-9aac5a790689", "value": "Name: How a single ScreenConnect incident exposed a massive campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"remote access trojan\", \"fake software\", \"c2 infrastructure\", \"process hollowing\", \"screenconnect\", \"powershell loader\", \"typosquatting\", \"seo poisoning\", \"dll sideloading\", \"asyncrat\"]\nTgtd countries: []\nMlwr families: [\"AsyncRAT\", \"ScreenConnect\"]\nAttack_ids: [\"T1053.005\", \"T1036.005\", \"T1204.002\", \"T1566.002\", \"T1218.004\", \"T1218.007\", \"T1106\", \"T1140\", \"T1055\", \"T1112\", \"T1059.001\", \"T1562.001\", \"T1055.012\", \"T1027\", \"T1071.001\", \"T1059.005\", \"T1574.002\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848210", "to_ids": true, "type": "domain", "uuid": "04754c7d-1948-44f8-8e54-67c95412b68f", "value": "corel-draw.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848231", "to_ids": true, "type": "ip-dst", "uuid": "7a64e1a5-ddca-4c11-8c22-663a3ddf9a96", "value": "185.254.97.249", "Tag": [ { "colour": "#a6d82c", "local": false, "name": "asn:asn=\"58212\"", "relationship_type": "" }, { "colour": "#9bbf19", "local": false, "name": "asn:as-owner=\"DATAFOREST\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848252", "to_ids": true, "type": "domain", "uuid": "0f97e16b-cee1-4ccf-8f5d-220ee390c1cb", "value": "vlc-player.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848273", "to_ids": true, "type": "domain", "uuid": "dde78c5f-391d-4d5e-927c-86448711e7e1", "value": "processhacker.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848294", "to_ids": true, "type": "domain", "uuid": "1fc06e1a-1745-40eb-9582-d5e892156bb1", "value": "km-player.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848315", "to_ids": true, "type": "domain", "uuid": "c17c027d-6f16-41f3-8094-7a50459af08b", "value": "defender-control.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848336", "to_ids": true, "type": "domain", "uuid": "1f925e96-f6a7-448e-b007-225b9070981e", "value": "crusader-kings.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848357", "to_ids": true, "type": "domain", "uuid": "8853503e-7467-4671-8bb1-e0f00e3d0751", "value": "arma-reforger.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848378", "to_ids": true, "type": "domain", "uuid": "6cefbf6d-3fe2-4e30-a3fc-b6da475f5bd1", "value": "obs-studio.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848399", "to_ids": true, "type": "domain", "uuid": "3e12299c-0a3e-4b8e-806c-dae78aa4aa54", "value": "obs-studio.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848421", "to_ids": true, "type": "domain", "uuid": "43b23298-ab3d-4380-aab1-3968c000fe0f", "value": "studio-obs.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848442", "to_ids": true, "type": "domain", "uuid": "5d4b851f-b702-489b-8f38-11d26130fe84", "value": "studio-obs.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848463", "to_ids": true, "type": "ip-dst", "uuid": "707827d5-518e-40f3-bd6c-bb4997c8b449", "value": "2.59.134.97", "Tag": [ { "colour": "#a6d82c", "local": false, "name": "asn:asn=\"58212\"", "relationship_type": "" }, { "colour": "#9bbf19", "local": false, "name": "asn:as-owner=\"DATAFOREST\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848484", "to_ids": true, "type": "domain", "uuid": "42d3e21d-6173-4468-ba9a-61f820eb3c1f", "value": "winservec.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848506", "to_ids": true, "type": "hostname", "uuid": "0bb17ee8-c163-4399-9d3f-ae764a675a91", "value": "mora1987.work.gd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848527", "to_ids": true, "type": "domain", "uuid": "04d5d497-a2d1-47e4-9048-2827988e3b21", "value": "serverdnsplan.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848548", "to_ids": true, "type": "hostname", "uuid": "b259e9dd-f768-48eb-b48e-eab0f867ba7d", "value": "free-download.camdvr.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848569", "to_ids": true, "type": "domain", "uuid": "11474f8c-1ff3-43a1-8cd9-93bae348a960", "value": "managedevice.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848590", "to_ids": true, "type": "domain", "uuid": "345318f4-7cd0-44cf-9bb7-e6dd03fc09e7", "value": "pingpanl.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848611", "to_ids": true, "type": "domain", "uuid": "db2f7f44-d331-49db-9d08-5e47d165e939", "value": "manageserver.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848632", "to_ids": true, "type": "hostname", "uuid": "d41e74a8-3307-44f8-9a44-6d7af813b42c", "value": "r.servermanagemen.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848653", "to_ids": true, "type": "hostname", "uuid": "7f7d5a75-b031-4aa0-a4e2-35207b6f421c", "value": "r.manage-server.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848674", "to_ids": true, "type": "domain", "uuid": "7dd64b51-2a81-4269-b257-358f44c3ea31", "value": "ehostservers.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848695", "to_ids": true, "type": "ip-dst", "uuid": "03d46087-2c19-4276-9fc1-6ea86e2f165a", "value": "162.216.241.242", "Tag": [ { "colour": "#47469b", "local": false, "name": "asn:asn=\"398019\"", "relationship_type": "" }, { "colour": "#321467", "local": false, "name": "asn:as-owner=\"DYNU\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848716", "to_ids": true, "type": "ip-dst", "uuid": "5d3a968d-1362-4cb3-8fcc-e7a02723fbbe", "value": "45.145.41.205", "Tag": [ { "colour": "#a6d82c", "local": false, "name": "asn:asn=\"58212\"", "relationship_type": "" }, { "colour": "#9bbf19", "local": false, "name": "asn:as-owner=\"DATAFOREST\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848737", "to_ids": true, "type": "domain", "uuid": "88fa7293-75a6-4317-a5d0-ee77581ec60c", "value": "crosshairx.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848759", "to_ids": true, "type": "domain", "uuid": "159b6492-93d6-4719-8a89-6d1bed64cc46", "value": "crosshairx.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848780", "to_ids": true, "type": "hostname", "uuid": "c89f23e4-ba69-4d71-b43e-a6c7801edc0d", "value": "fileget.loseyourip.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848801", "to_ids": true, "type": "domain", "uuid": "4d254957-8b59-4b7b-b445-f24a74e80450", "value": "km-player.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848822", "to_ids": true, "type": "domain", "uuid": "db3f91e6-1fca-4a9d-aa94-0d6de1c28eaf", "value": "kms-tools.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848843", "to_ids": true, "type": "domain", "uuid": "733248b1-a526-4973-aa5f-b6af6aecd493", "value": "vlc-media.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848864", "to_ids": true, "type": "domain", "uuid": "6b95aeab-170a-4c44-8f5e-853902900ab5", "value": "vlc-media.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848886", "to_ids": true, "type": "hostname", "uuid": "b7eb5c37-22f0-4ec0-bdb1-25746972c017", "value": "download-full-version.ooguy.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848907", "to_ids": true, "type": "domain", "uuid": "6e23c7d9-7779-4e2f-8c59-175a9cba0073", "value": "servermanagemen.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 12/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783846964", "to_ids": true, "type": "md5", "uuid": "eda8a61b-9926-453c-a009-b661d5f1e109", "value": "479bd3bb617b39cd4a46d0768a2592d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 12/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783846965", "to_ids": true, "type": "md5", "uuid": "d9a37d7a-9e0d-46ea-b7e4-4555b4694799", "value": "54025ce2a9405039899fe99a1d77e0bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 12/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783846966", "to_ids": true, "type": "md5", "uuid": "93ed20cf-28e0-4461-b683-f8805fac762e", "value": "5f96c04e3afae97017b201be112284d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 12/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783846968", "to_ids": true, "type": "md5", "uuid": "cf34184f-fcb7-44df-abf5-480b2d25fa65", "value": "776dfd3df9c04bb9fcdd6c1880c3761a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 12/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1783846969", "to_ids": true, "type": "md5", "uuid": "a15be148-23da-4eef-8380-9565a09d4ca2", "value": "a40d3aeb0dae5b00bdb3a517f3135bbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848929", "to_ids": true, "type": "ip-dst", "uuid": "6ef87760-0ba9-40dd-b91c-d879fc33238d", "value": "198.23.185.81", "Tag": [ { "colour": "#e72c52", "local": false, "name": "asn:asn=\"63025\"", "relationship_type": "" }, { "colour": "#c6aecd", "local": false, "name": "asn:as-owner=\"NOHAVPS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848950", "to_ids": true, "type": "url", "uuid": "364b083f-9320-46dc-9deb-41e3e953db42", "value": "http://fileget.loseyourip.com/obs-studio-windows-full/gVOMs5VZ9BtlcaM", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848971", "to_ids": true, "type": "url", "uuid": "8bba5fa5-14ee-49e6-8437-62daf7612c16", "value": "https://fileget.loseyourip.com/obs-studio-windows-full/gVOMs5VZ9BtlcaM", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783848992", "to_ids": true, "type": "url", "uuid": "f5f1e9c3-ef15-4df0-96f8-23fbb5078672", "value": "https://www.studioobs.com/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849013", "to_ids": true, "type": "domain", "uuid": "5d678063-9894-4d42-9d5b-6ff0b7fce4ab", "value": "antimicrox.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849034", "to_ids": true, "type": "domain", "uuid": "54854fec-088b-4d8f-a891-c9d4831e7e2c", "value": "antimicrox.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849055", "to_ids": true, "type": "domain", "uuid": "3a4772bd-3dcd-4f53-af16-33a375d27a4c", "value": "apexlegends.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849076", "to_ids": true, "type": "domain", "uuid": "b660459c-e086-49c2-9bf1-cd02c7ebc21c", "value": "arksurvival-ascended.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849097", "to_ids": true, "type": "domain", "uuid": "2f6a9383-8912-42ee-b33e-544965926669", "value": "bandicam.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849118", "to_ids": true, "type": "domain", "uuid": "3d4ec2f7-b399-4cf9-9c12-fc373269b11c", "value": "bandicam.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849140", "to_ids": true, "type": "domain", "uuid": "5a4086ab-685b-458f-af1b-f30bc726a70a", "value": "bandizip.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849161", "to_ids": true, "type": "domain", "uuid": "b76fe1ed-d643-42eb-82b6-d3a96728afcc", "value": "bandizip.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849182", "to_ids": true, "type": "domain", "uuid": "9cba0552-787d-4512-a302-eb0a3bf26273", "value": "clair-obscur-33.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849203", "to_ids": true, "type": "domain", "uuid": "a3ff850b-c8dc-4ace-9ab0-285e2cb2afcf", "value": "clair-obscur-33.town", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849224", "to_ids": true, "type": "domain", "uuid": "7a743cc8-7c8a-4f72-a37c-b01e9cfb2511", "value": "cloudsynn.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849245", "to_ids": true, "type": "domain", "uuid": "d9441408-bf67-4895-8d26-08df6082e19f", "value": "cpuz.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849266", "to_ids": true, "type": "domain", "uuid": "47b27adf-6c0e-4ef4-8c20-1ec02ed7c6e7", "value": "crosshair-x.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849287", "to_ids": true, "type": "domain", "uuid": "a488281c-4953-4d9b-bfb3-195785f61125", "value": "crosshairx.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849308", "to_ids": true, "type": "domain", "uuid": "2dc3c137-73b9-4155-862b-6bfac3ec9791", "value": "crosshairx2.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849329", "to_ids": true, "type": "domain", "uuid": "64f9f552-9750-472c-8223-e954794f9225", "value": "crosshairxv2.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849350", "to_ids": true, "type": "domain", "uuid": "8959a449-a620-434f-be2c-27049a3b4465", "value": "crusader-kings.church", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849371", "to_ids": true, "type": "domain", "uuid": "5fbd7435-4fa8-43a0-86cb-0494d289cf48", "value": "crystaldiskmark.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849393", "to_ids": true, "type": "domain", "uuid": "85511ab4-4674-48af-8f28-59abcdded730", "value": "crystaldiskmark.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849415", "to_ids": true, "type": "domain", "uuid": "3d18f983-169b-4e30-8054-34b92859081f", "value": "crystaldiskmark.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849437", "to_ids": true, "type": "domain", "uuid": "11b107df-13a7-46b5-84cc-ea8fc9e484d2", "value": "crystaldiskmark.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849458", "to_ids": true, "type": "domain", "uuid": "20a77165-e7ec-4b70-8938-2ce520703203", "value": "deadreset.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849479", "to_ids": true, "type": "domain", "uuid": "9735f0ed-6913-4064-b310-6f3aabdda95d", "value": "defendercontrol.download", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849500", "to_ids": true, "type": "domain", "uuid": "eec7edbb-bd77-4a22-ad41-3f34ad5d428b", "value": "defendercontrol.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849521", "to_ids": true, "type": "domain", "uuid": "83c813f8-4475-42b9-9f51-3a4d0f310f3f", "value": "defendercontrol.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849544", "to_ids": true, "type": "domain", "uuid": "fb041820-ddfc-4691-8e7e-17f741a0301a", "value": "dns-jumper.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849565", "to_ids": true, "type": "domain", "uuid": "09a0d858-1a3f-45c0-8747-b9670d12ef01", "value": "dnsjumper.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849586", "to_ids": true, "type": "domain", "uuid": "d56fb685-4f6f-4352-8b47-7db348c03a45", "value": "dnsjumper.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849607", "to_ids": true, "type": "domain", "uuid": "f86c258a-f6b0-4b9a-bbd3-32fc9085c8f6", "value": "ds4windows.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849628", "to_ids": true, "type": "domain", "uuid": "dce39748-80fc-4834-8734-20c4253a9ec6", "value": "ds4windows.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849650", "to_ids": true, "type": "domain", "uuid": "5ec56d01-e627-4c6e-b522-5733117263e6", "value": "ds4windows.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849671", "to_ids": true, "type": "domain", "uuid": "89bbf1f3-49cb-40f3-8bfd-764d9de4c567", "value": "edgeserv.ru", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849692", "to_ids": true, "type": "domain", "uuid": "6b5a59f7-cbaa-4246-9454-a0068c6d3c91", "value": "elden-ringnightreign.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849713", "to_ids": true, "type": "domain", "uuid": "f3c00457-da7c-47cd-af33-a2ef9bde375b", "value": "ferdium.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849734", "to_ids": true, "type": "domain", "uuid": "c2e1f595-b437-4e98-818f-28186bc4c1c1", "value": "fernbus-simulator.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849755", "to_ids": true, "type": "domain", "uuid": "1140449c-7d71-4a30-b5d2-107c5f7e8080", "value": "glary-utilities.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849776", "to_ids": true, "type": "domain", "uuid": "debfd5a2-584c-494b-8718-83fe38100924", "value": "gom-player.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849798", "to_ids": true, "type": "domain", "uuid": "b2c82bb3-a4f0-44f6-9589-3ce97c2a2178", "value": "kms-tools.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849819", "to_ids": true, "type": "domain", "uuid": "fa07a9c1-2024-4a1a-b6f4-629ef4a5a64b", "value": "libreoffice.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849840", "to_ids": true, "type": "domain", "uuid": "112179c4-8b67-44c7-a621-074ded770419", "value": "lossless-scaling.download", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849861", "to_ids": true, "type": "domain", "uuid": "332f82a5-659d-4213-aa5e-af36dc2f8c98", "value": "lossless-scaling.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849882", "to_ids": true, "type": "domain", "uuid": "a7985eae-417f-404f-952c-7d685a1d656c", "value": "losslessscaling.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849903", "to_ids": true, "type": "domain", "uuid": "a5f461cb-e614-41a3-8d59-6c2ca4616885", "value": "mediaplayerclassic.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849924", "to_ids": true, "type": "domain", "uuid": "89a9bd70-69db-4e54-8644-ed437e585617", "value": "mediaplayerclassic.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849945", "to_ids": true, "type": "domain", "uuid": "57bad92a-e88e-4808-9f5e-cbc4bfd01569", "value": "mgba.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849966", "to_ids": true, "type": "domain", "uuid": "ac6d389b-4bdd-4912-8506-aa99a7ee618e", "value": "mgba.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783849988", "to_ids": true, "type": "domain", "uuid": "77630ffd-22a0-4806-9cd8-401fb40db3c9", "value": "monster-hunterwilds.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850009", "to_ids": true, "type": "domain", "uuid": "e5e39763-9832-460b-9bbe-eb95cf500b60", "value": "ovr-advanced-settings.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850030", "to_ids": true, "type": "domain", "uuid": "3394aef6-300b-45c9-894f-4d622f60c367", "value": "ovr-toolkit.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850051", "to_ids": true, "type": "domain", "uuid": "50246614-24ab-4e41-ba37-bbca472f4126", "value": "pingserv.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850072", "to_ids": true, "type": "domain", "uuid": "1bdc4816-1d93-441b-8076-03dce979048e", "value": "processhacker.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850093", "to_ids": true, "type": "domain", "uuid": "634d8bc4-eb96-4abf-94d7-4fcdb7a38ef0", "value": "processhacker.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850114", "to_ids": true, "type": "domain", "uuid": "552129fa-85f1-4355-8a3c-3a1fbbf3cf5e", "value": "ready-ornot.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850135", "to_ids": true, "type": "domain", "uuid": "451bd15d-b872-4613-a17b-af0df5f084d3", "value": "steamtools.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850156", "to_ids": true, "type": "domain", "uuid": "d01b3886-8cab-4bc9-af35-695c32e507b6", "value": "steamtools.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850177", "to_ids": true, "type": "domain", "uuid": "4c47223a-c09d-4406-a2c6-1a6d1dcd9866", "value": "studio-obs.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850198", "to_ids": true, "type": "domain", "uuid": "49b9b944-688e-491c-ad10-70671b9403f4", "value": "studioobs.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850219", "to_ids": true, "type": "domain", "uuid": "a87bcef5-7fe4-4e49-b41d-2d84415022fc", "value": "studioobs.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850241", "to_ids": true, "type": "domain", "uuid": "e37da894-36fa-43df-ba24-d341d2005e13", "value": "tmod-loader.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850262", "to_ids": true, "type": "domain", "uuid": "0f660a38-b564-4ed3-9592-9895eb36b1fb", "value": "tmodloader.download", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850283", "to_ids": true, "type": "domain", "uuid": "704cf190-aafd-47a8-8cd2-a7d86bca6c07", "value": "tmodloader.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850304", "to_ids": true, "type": "domain", "uuid": "825750b1-8498-46ee-8ca2-3ad7a7c8abd4", "value": "tmodloader.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850325", "to_ids": true, "type": "hostname", "uuid": "83f74d4c-2ed8-4b4c-bee1-94d0c34b84f3", "value": "all-toll-free.loseyourip.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850346", "to_ids": true, "type": "hostname", "uuid": "c9f1b89d-7d1c-4d49-bac2-965a55e76719", "value": "trojan.js.sagent.sb", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850367", "to_ids": true, "type": "hostname", "uuid": "0ce50e7c-4fa5-43eb-819f-c8c605de370b", "value": "www.studioobs.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850388", "to_ids": true, "type": "hostname", "uuid": "4e16ff14-e41e-4e7f-b4d6-eaebbecd2e52", "value": "direct-download.giize.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850410", "to_ids": true, "type": "domain", "uuid": "611d9d47-8aec-4cf8-b07c-d3ff4b174308", "value": "tmodloader.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850431", "to_ids": true, "type": "domain", "uuid": "1c5ec9cc-d4b3-4959-a24e-d4dc80b66a5b", "value": "losslessscaling.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850452", "to_ids": true, "type": "domain", "uuid": "a9625284-7d83-4286-a6dc-3e59ff138fb6", "value": "dnsjumper.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850473", "to_ids": true, "type": "domain", "uuid": "4091b551-c266-4f98-b58d-03704e41a6fc", "value": "cpuz.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850494", "to_ids": true, "type": "domain", "uuid": "a8facd6e-50c9-44cc-9078-0d40cb9b0352", "value": "processhacker.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850515", "to_ids": true, "type": "domain", "uuid": "9ca55a89-dcbd-4069-aebe-a15881e910f1", "value": "wallpaper-engine.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850537", "to_ids": true, "type": "domain", "uuid": "49005bdb-3d84-4c47-bc03-14f592bf85ef", "value": "defendercontrol.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850558", "to_ids": true, "type": "domain", "uuid": "217db58a-54a9-451c-9d9c-0ac6792d2e8e", "value": "bandicam.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850579", "to_ids": true, "type": "domain", "uuid": "c68fbbb8-09b1-4e49-b175-f4ce5dc5daa4", "value": "mgba.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850600", "to_ids": true, "type": "domain", "uuid": "c61e4c15-23d1-44b4-b27c-643bdb1aff22", "value": "ferdium.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850624", "to_ids": true, "type": "domain", "uuid": "2eb43c67-c28a-4b02-8e22-a94d7ae72c97", "value": "gom-player.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850645", "to_ids": true, "type": "domain", "uuid": "6e4a36c0-def8-4edf-8419-e81582af694c", "value": "lossless-scaling.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850666", "to_ids": true, "type": "domain", "uuid": "baa02a67-620a-44a3-aa0e-35367972a4a9", "value": "crystaldiskmark.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850687", "to_ids": true, "type": "hostname", "uuid": "fe821e9b-1631-467a-8a4b-424110debb00", "value": "file-download-crosshairx.giize.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850709", "to_ids": true, "type": "hostname", "uuid": "4bc7c572-0cef-4d25-b984-cdc716cf06bc", "value": "mpc-update.giize.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783850730", "to_ids": true, "type": "hostname", "uuid": "11ace1dc-2687-4584-bb0a-b4bff1742dea", "value": "all-toll-free.publicvm.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850751", "uuid": "30f3dabe-7fca-498f-84a8-389433897b98", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "md5", "timestamp": "1783850751", "to_ids": true, "type": "md5", "uuid": "5caeaffa-ba56-4fe6-b023-486626b9524c", "value": "8e4c57358a66eb14d31abb614ddc68de", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "sha1", "timestamp": "1783846944", "to_ids": true, "type": "sha1", "uuid": "d82acfa0-305e-4a08-8e19-18bd999968c3", "value": "c2679a152084f3ebdb39aacb6ec6a23c61a46ae6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "sha256", "timestamp": "1783846944", "to_ids": true, "type": "sha256", "uuid": "8d2a6d6b-6fed-4539-b48f-8d4337108ff8", "value": "6ed15aec7504081c3e14a9f6064d7b754aa283e4adb1a59edf3beff65369bc55", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "text", "timestamp": "1783846062", "to_ids": false, "type": "text", "uuid": "5ba6ad55-3e87-4132-ba19-c050e72c8638", "value": "Type Description: Win32 DLL\nOriginal name: uiwrapperres.dll\nMicrosoft: None\nClamAV: None\nVT Total Detection: 43/74\nFirst Seen In The Wild: 2025-12-01T02:49:13+00:00\nFirst Submission: 2025-11-29T07:45:46+00:00\nLast Submission: 2026-06-07T13:11:46+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "creation-time", "timestamp": "1783846062", "to_ids": false, "type": "datetime", "uuid": "65f1acb1-e613-44e9-b1d5-5a338f24869b", "value": "2025-11-29T05:28:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "ssdeep", "timestamp": "1783846062", "to_ids": true, "type": "ssdeep", "uuid": "e96a472b-5b75-4808-b481-0c10c97da22b", "value": "384:0WgOu8S898Jcef12Eas1RZcqqdfTcytGCl/kvtYq7IFO1/mwckp5RxF1/2RuZoiZ:0+XRIb7IFtSjt/vZ8N6HwEMj8A8p" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846062", "to_ids": false, "type": "size-in-bytes", "uuid": "3be54915-3a0d-499a-891f-516d03e27200", "value": "39424" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "vhash", "timestamp": "1783846062", "to_ids": true, "type": "vhash", "uuid": "f3a8e7b7-f1d0-499d-a997-cd3b16a1748a", "value": "134066655d1515151088z1dhz17z13z15z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-11-29T07:45:46+00:00", "last_seen": "2026-06-07T13:11:46+00:00", "object_relation": "filename", "timestamp": "1783846062", "to_ids": true, "type": "filename", "uuid": "3d7724dc-e327-4c1c-95c8-9cac68697b2a", "value": "uiwrapperres.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850772", "uuid": "db015de4-3161-4770-ace0-70815e59aad7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "md5", "timestamp": "1783850772", "to_ids": true, "type": "md5", "uuid": "e6128545-4b59-4c01-9265-1e292806d4cc", "value": "01325880efffec546f59490089a3b415", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "sha1", "timestamp": "1783846945", "to_ids": true, "type": "sha1", "uuid": "dfc5f089-73df-4ad7-ad05-bc9ab54f4ad8", "value": "56af5e46a034a9338011672bbcbe6b6bab17ebdd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "sha256", "timestamp": "1783846945", "to_ids": true, "type": "sha256", "uuid": "22bfa4d3-2ce6-4868-89f3-daee28324375", "value": "dfdbfa4f0e436d5c12c38627dec0f006b304fdb097bd060440669ff98c3b0cc9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "text", "timestamp": "1783846083", "to_ids": false, "type": "text", "uuid": "2b4a9ca7-16bc-4775-88b5-5749b1df976b", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/DLLHijack.NUA!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-07-01T13:00:44+00:00\nFirst Submission: 2026-03-11T00:14:23+00:00\nLast Submission: 2026-03-11T00:14:23+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "creation-time", "timestamp": "1783846083", "to_ids": false, "type": "datetime", "uuid": "402d40fd-3929-495c-abcc-27b42a799d27", "value": "2024-05-20T04:29:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "ssdeep", "timestamp": "1783846083", "to_ids": true, "type": "ssdeep", "uuid": "8cc6e6f0-0db3-4d5b-bcce-638699648e22", "value": "384:Jw+zwgZfUTcvaiHsuhDTiOLCPO8/1hsvPwzwhb6arkRuZoijtBKYkOlCtNRuZoiC:VMg1UTcvNRchsvPNh+W56nQpVy4Pr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846083", "to_ids": false, "type": "size-in-bytes", "uuid": "f65dd997-4c82-4f9b-82dd-b278d81222e5", "value": "39936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "vhash", "timestamp": "1783846083", "to_ids": true, "type": "vhash", "uuid": "bae71032-d35a-4666-9a19-ab6f7477bf42", "value": "134066655d1515151028z1chz1dz25z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-11T00:14:23+00:00", "last_seen": "2026-03-11T00:14:23+00:00", "object_relation": "filename", "timestamp": "1783846083", "to_ids": true, "type": "filename", "uuid": "375a90f4-c3f3-44db-9a56-f1626648d5b2", "value": "install.res.1033.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850793", "uuid": "e0d063e9-7007-4856-817d-d367a0f9cdc2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "object_relation": "md5", "timestamp": "1783850793", "to_ids": true, "type": "md5", "uuid": "bc0460b8-6ea3-4109-b261-a062394c2a26", "value": "0eee9bad07e22415439e854657fa1366", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "object_relation": "sha1", "timestamp": "1783846947", "to_ids": true, "type": "sha1", "uuid": "1ef31704-1f46-41bb-82ee-0b14aaaa607f", "value": "d497271a32633ddb4f56d548a13fefdab864b6e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "object_relation": "sha256", "timestamp": "1783846947", "to_ids": true, "type": "sha256", "uuid": "5338e924-3df5-4903-932f-b96809313bd6", "value": "5b95e1d05d913676e9ebbd897a403ddfa6476524651a038d08ecebde29159b9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "object_relation": "text", "timestamp": "1783846105", "to_ids": false, "type": "text", "uuid": "a5eac2d4-c156-4cbd-ad21-ab14bb69d6a3", "value": "Type Description: VBA\nMicrosoft: Trojan:VBS/Obfuse.AHB!MTB\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-03-02T01:34:08+00:00\nLast Submission: 2026-03-15T02:40:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "object_relation": "ssdeep", "timestamp": "1783846105", "to_ids": true, "type": "ssdeep", "uuid": "3d0dcaee-0ee5-4eb8-8161-bddf8c5b44c3", "value": "3072:jj07S7Wb80555nLqJiwCIGMQPdi4EDYouZTE8JC+VJdztDafdMSqLduGxy8NLOXf:8SCuJiwCIp+vYHJ" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846105", "to_ids": false, "type": "size-in-bytes", "uuid": "ee8cb40a-6dcb-4f03-b408-11d72e321d49", "value": "629427" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "object_relation": "vhash", "timestamp": "1783846105", "to_ids": true, "type": "vhash", "uuid": "3801bf0a-ee63-412d-9dff-12f67bfdbdc1", "value": "8a94b7f033493141efb74e5c16a9a02c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:34:08+00:00", "last_seen": "2026-03-15T02:40:30+00:00", "object_relation": "filename", "timestamp": "1783846105", "to_ids": true, "type": "filename", "uuid": "54c7a0c0-6433-4acb-b5e8-5816bae5622d", "value": "installer_method2_fso.vbs-4.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850814", "uuid": "db3a7eb1-58c1-4c5c-ac2a-44ecf3ae1e73", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "md5", "timestamp": "1783850814", "to_ids": true, "type": "md5", "uuid": "ab8eae7c-3d92-40a8-a0cf-c2433063c402", "value": "1e6a5c7b620d487d0cfc6874c3b77c90", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "sha1", "timestamp": "1783846948", "to_ids": true, "type": "sha1", "uuid": "afd19f13-64c1-49b1-9e90-e19bd5127b40", "value": "b12b5720404e3d8794d72af064939dd953b6a8e0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "sha256", "timestamp": "1783846948", "to_ids": true, "type": "sha256", "uuid": "09e8ae58-6131-4ef1-bf08-a21673cbcfdb", "value": "3cbd65ae3ff5039324b03a66947a1d1b808ea5ddb09da917ed8f1323c34e80f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "text", "timestamp": "1783846126", "to_ids": false, "type": "text", "uuid": "2416c407-822c-4b2f-bd58-939505877c08", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/Tedy.CM!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-07-01T13:00:44+00:00\nFirst Submission: 2026-03-06T15:31:15+00:00\nLast Submission: 2026-03-24T23:35:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "creation-time", "timestamp": "1783846126", "to_ids": false, "type": "datetime", "uuid": "8e5c1357-95c4-4b8f-9a4b-de0089f5c59e", "value": "2025-03-23T16:06:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "ssdeep", "timestamp": "1783846126", "to_ids": true, "type": "ssdeep", "uuid": "f82bbf5e-03be-4fa6-af04-bc961ab0695e", "value": "3072:wRuZVIE+47DGjIAsxfcXPfMo0iqB8ca4kQdJZGT/i:qi+8DALrXUBdiTa" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846126", "to_ids": false, "type": "size-in-bytes", "uuid": "c6c3395c-648f-4a2e-aefd-6030fc000bf2", "value": "145920" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "vhash", "timestamp": "1783846126", "to_ids": true, "type": "vhash", "uuid": "9fde9efa-2b8a-4d9c-99a9-fceb549524e9", "value": "115076655d155d15155028z51hz1lz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T15:31:15+00:00", "last_seen": "2026-03-24T23:35:59+00:00", "object_relation": "filename", "timestamp": "1783846126", "to_ids": true, "type": "filename", "uuid": "93108aa8-ed51-44af-aab5-1a8d1ec3c7f1", "value": "install.res.1033.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850835", "uuid": "af121635-2cd8-4b98-b514-e66e8c1649cd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "object_relation": "md5", "timestamp": "1783850835", "to_ids": true, "type": "md5", "uuid": "0b253baf-2957-429d-b06b-47003522f195", "value": "5b7e1fe55bd7b5ea54bd4ed1677e5a26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "object_relation": "sha1", "timestamp": "1783846949", "to_ids": true, "type": "sha1", "uuid": "34bd04c3-b55f-486c-93ec-e00e69f5e857", "value": "f2ca21ae017df9c8c28521580dfdbb8ee0224b92", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "object_relation": "sha256", "timestamp": "1783846949", "to_ids": true, "type": "sha256", "uuid": "6e0411f1-5642-4296-82ff-e842c3f8b62c", "value": "3d42a18bea2e4df9223d1963755224ef2a81c900b5e389d394dac0dea6658877", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "object_relation": "text", "timestamp": "1783846190", "to_ids": false, "type": "text", "uuid": "aad34c87-c925-4f45-8c2c-a09f765944ae", "value": "Type Description: Powershell\nMicrosoft: Trojan:PowerShell/Boxter.AHB!MTB\nClamAV: None\nVT Total Detection: 31/74\nFirst Seen In The Wild: 2026-03-03T11:40:18+00:00\nFirst Submission: 2026-03-02T01:41:58+00:00\nLast Submission: 2026-07-02T22:24:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "object_relation": "ssdeep", "timestamp": "1783846190", "to_ids": true, "type": "ssdeep", "uuid": "95f63d6b-9698-417b-a325-2db6c8f26c97", "value": "24:SbPz2Xm4ztQkS2szOxOom+zOIMYeMm+wxzk:S7z14z+kTYO3/MYeMUxzk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846190", "to_ids": false, "type": "size-in-bytes", "uuid": "3968f349-71be-46d8-ac9b-ef617150065e", "value": "825" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "object_relation": "vhash", "timestamp": "1783846190", "to_ids": true, "type": "vhash", "uuid": "d248b805-929e-4cc8-9756-5ca509406d26", "value": "a3d9768430fa5625a1c1be4a477662ec" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:41:58+00:00", "last_seen": "2026-07-02T22:24:45+00:00", "object_relation": "filename", "timestamp": "1783846190", "to_ids": true, "type": "filename", "uuid": "12093e66-804d-42a0-aa46-5a8e92a3d3e5", "value": "cap.ps1" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850856", "uuid": "621ababa-dc21-43f9-aea2-28d5ddd80fe7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "md5", "timestamp": "1783850856", "to_ids": true, "type": "md5", "uuid": "c91f410e-3041-441b-b997-846cc4287a40", "value": "695e794631ef130583368770e7b81e98", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "sha1", "timestamp": "1783846950", "to_ids": true, "type": "sha1", "uuid": "149e6664-8753-49c9-a834-cccbe7634d46", "value": "5d8e4d155f1513dea81968ab7ce08860297acfd4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "sha256", "timestamp": "1783846950", "to_ids": true, "type": "sha256", "uuid": "9bb8d2e1-6f3e-48b6-a530-458e582f78e1", "value": "340d24efd50d67c56a657c00d8e060c34204e0a4132639fb9ca2fb131c6615f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 08/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "text", "timestamp": "1783846232", "to_ids": false, "type": "text", "uuid": "1999157b-fdc4-4446-acf6-34ba14803d0e", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/DLLHijack.NUA!MTB\nClamAV: None\nVT Total Detection: 46/73\nFirst Seen In The Wild: 2026-03-03T00:50:10+00:00\nFirst Submission: 2026-03-02T11:37:52+00:00\nLast Submission: 2026-04-07T06:37:53+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "creation-time", "timestamp": "1783846232", "to_ids": false, "type": "datetime", "uuid": "91ac5814-c3b0-4cb2-8557-568585de5f0b", "value": "2026-03-01T18:30:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "ssdeep", "timestamp": "1783846232", "to_ids": true, "type": "ssdeep", "uuid": "bbb77d04-1acf-448a-b10c-6dca7723a79c", "value": "384:H+zwgZfUTcvaiHsuhDTiLLCPO8/1hsyPwzwhb6arGRuZoijtBKYkOlCtNRuZoije:eMg1UTcvNwchsyPNh+W/ZQpVy4/h" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846232", "to_ids": false, "type": "size-in-bytes", "uuid": "5ae55a1d-7e56-44c1-999a-495396454cc8", "value": "39936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "vhash", "timestamp": "1783846232", "to_ids": true, "type": "vhash", "uuid": "ff63fb33-a4f2-4239-b916-99719eceab28", "value": "134066655d1515151028z1chz1dz25z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T11:37:52+00:00", "last_seen": "2026-04-07T06:37:53+00:00", "object_relation": "filename", "timestamp": "1783846232", "to_ids": true, "type": "filename", "uuid": "f8de215e-aaf6-4d51-acd4-c4beb3f90007", "value": "install.res.1033.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850877", "uuid": "39e92b6d-713a-40fd-840e-e8580fa9009a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "md5", "timestamp": "1783850877", "to_ids": true, "type": "md5", "uuid": "b6edc6cf-865a-4144-a2d8-e946a168a759", "value": "73bead922109a61e5f9f85771a7812c5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "sha1", "timestamp": "1783846951", "to_ids": true, "type": "sha1", "uuid": "4d5c5071-d60d-401f-9abb-e94148127f1e", "value": "d3c011361436d43b62171f76d9a24df06cedba8f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "sha256", "timestamp": "1783846951", "to_ids": true, "type": "sha256", "uuid": "051fab2a-14d9-409e-86fe-698ae18723f8", "value": "6edefb2712ade6c028f53410118bf093e282c0f306e3c85e4d0ae3b0a0a8104a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "text", "timestamp": "1783846253", "to_ids": false, "type": "text", "uuid": "87118ddf-95d5-423e-9cf5-31a91942fe49", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/DLLHijack.NUA!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-03-07T19:51:01+00:00\nFirst Submission: 2026-03-07T10:57:58+00:00\nLast Submission: 2026-03-07T10:57:58+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "creation-time", "timestamp": "1783846254", "to_ids": false, "type": "datetime", "uuid": "86e262bd-e76c-4b0b-a6b1-a8d7a98fd4a2", "value": "2023-06-19T02:05:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "ssdeep", "timestamp": "1783846253", "to_ids": true, "type": "ssdeep", "uuid": "479ad5eb-d7d2-4446-9a33-70cc5132195f", "value": "384:P+zwgZfUTcvaiHsuhDTiOLCPO8/1hsvPwzwhb6arGRuZoijtBKYkOlCtNRuZoije:WMg1UTcvNRchsvPNh+W/6nQpVy4wl" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846253", "to_ids": false, "type": "size-in-bytes", "uuid": "2b7bf4c8-70cd-4e73-a367-77f247fe1ef0", "value": "39936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "vhash", "timestamp": "1783846253", "to_ids": true, "type": "vhash", "uuid": "601a8d66-b0bd-4678-a0b4-994553f068a1", "value": "134066655d1515151028z1chz1dz25z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-07T10:57:58+00:00", "last_seen": "2026-03-07T10:57:58+00:00", "object_relation": "filename", "timestamp": "1783846253", "to_ids": true, "type": "filename", "uuid": "b493979a-7dfd-4330-8df9-538ac878e0f4", "value": "install.res.1033.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850898", "uuid": "3c32f62a-2bf8-4d49-b486-2437256b351d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "md5", "timestamp": "1783850898", "to_ids": true, "type": "md5", "uuid": "9c822c78-d6e2-4698-80bf-6a5141f57570", "value": "83601c3d4ed28e8d2be1b99beb8ec18c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "sha1", "timestamp": "1783846952", "to_ids": true, "type": "sha1", "uuid": "993f687d-cc53-4dec-9437-944d843fe4ed", "value": "b731ec0715b98c51d5d152e2f1a974b9ed25c2e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "sha256", "timestamp": "1783846952", "to_ids": true, "type": "sha256", "uuid": "a74b0f2a-600a-450a-9286-9da1454e054a", "value": "39527d9c7ec527dd8f36a3c4f86af0812abfe673fc568b6cff4cb05b3ca2d81a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 08/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "text", "timestamp": "1783846296", "to_ids": false, "type": "text", "uuid": "54b253d6-c31e-42de-8221-24e89285c6d0", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/DLLHijack.NUA!MTB\nClamAV: None\nVT Total Detection: 44/73\nFirst Seen In The Wild: 2026-03-03T00:48:46+00:00\nFirst Submission: 2026-03-01T09:30:33+00:00\nLast Submission: 2026-04-15T06:58:07+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "creation-time", "timestamp": "1783846296", "to_ids": false, "type": "datetime", "uuid": "60d95f4e-0666-432d-93bc-6c7a7f869450", "value": "2026-03-01T03:09:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "ssdeep", "timestamp": "1783846296", "to_ids": true, "type": "ssdeep", "uuid": "5b480d23-8caa-430e-9965-a8d94776732d", "value": "384:e+zwgZfUTcvaiHsuhDTiLLCPO8/1hsyPwzwhb6arGRuZoijtBKYkOlCtNRuZoijy:ZMg1UTcvNwchsyPNh+W/WwQpVy4/h" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846296", "to_ids": false, "type": "size-in-bytes", "uuid": "d500a7c5-8155-4aad-9a4d-dd64233b6899", "value": "39936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "vhash", "timestamp": "1783846296", "to_ids": true, "type": "vhash", "uuid": "2607deb4-79ec-4244-8f74-848f6878714c", "value": "134066655d1515151028z1chz1dz25z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-01T09:30:33+00:00", "last_seen": "2026-04-15T06:58:07+00:00", "object_relation": "filename", "timestamp": "1783846296", "to_ids": true, "type": "filename", "uuid": "66bd9b51-a954-46fc-ba7c-198ff398cce4", "value": "install.res.1033.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850920", "uuid": "46fe723f-d00d-4206-8780-7544533040c0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "md5", "timestamp": "1783850920", "to_ids": true, "type": "md5", "uuid": "21784072-df37-4f12-8029-9dca17196c99", "value": "87603ea025623b19954e460add532048", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "sha1", "timestamp": "1783846954", "to_ids": true, "type": "sha1", "uuid": "85569cc6-2058-4c4a-aea0-7435260ee6dc", "value": "d27fc9abbeccb60906d22906ef9a73bd05da2b7a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "sha256", "timestamp": "1783846954", "to_ids": true, "type": "sha256", "uuid": "79fe5971-0b1f-4cf0-860e-2479d39fb62a", "value": "8d08136a1964c72b6b450b11d9bf2b3d3d289c26dfadfc9f021114eac2cea1ca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 09/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "text", "timestamp": "1783846317", "to_ids": false, "type": "text", "uuid": "045961a7-c816-46bc-b970-48ebe01d52c0", "value": "Type Description: Win32 EXE\nFile distributed by: ['DICE']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['install.exe']\nOriginal name: Install.exe\nVerified: Signed\nSigning date: 07:47 PM 07/29/2008\nSigners: Microsoft Corporation; Microsoft Code Signing PCA; Microsoft Root Authority\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2017-03-16T16:00:42+00:00\nFirst Submission: 2009-03-26T22:43:38+00:00\nLast Submission: 2026-07-11T18:42:26+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "creation-time", "timestamp": "1783846317", "to_ids": false, "type": "datetime", "uuid": "72020918-b4cd-4cf4-87bd-8cb45ffae277", "value": "2008-07-29T12:10:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "ssdeep", "timestamp": "1783846317", "to_ids": true, "type": "ssdeep", "uuid": "4bcfd2a1-a760-43fb-9f69-af7356981e12", "value": "12288:dfEy/iRnznUDL4vr6yM29LQQ9j/Eh//FoXZ6tx95yW9Dmg:dfniBiL4ZM2GQ9j/E1eYX6Y" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846317", "to_ids": false, "type": "size-in-bytes", "uuid": "aefaab70-a657-49aa-99c9-c10fa81b7f3f", "value": "855552" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "vhash", "timestamp": "1783846317", "to_ids": true, "type": "vhash", "uuid": "637c76dc-e6f5-4afd-a02f-069822522e0b", "value": "085066651d15551511z52z1500977ze0d5z307005703dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2009-03-26T22:43:38+00:00", "last_seen": "2026-07-11T18:42:26+00:00", "object_relation": "filename", "timestamp": "1783846317", "to_ids": true, "type": "filename", "uuid": "249e8315-dc3c-4326-a13b-57cb3ddba9c9", "value": "Install.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850941", "uuid": "f84fbe6b-ac75-459c-a3a8-c13f2449b1d3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "object_relation": "md5", "timestamp": "1783850941", "to_ids": true, "type": "md5", "uuid": "e2bfeb1c-1b9b-4304-98cb-ea31f8af0454", "value": "8f4e8b680d3e8d3f5ac39bd72882f713", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "object_relation": "sha1", "timestamp": "1783846955", "to_ids": true, "type": "sha1", "uuid": "98fca173-8c63-49fc-b5b6-a29867a1d095", "value": "e39e7d9a9360ff63c28cae4f360fde2b74363475", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "object_relation": "sha256", "timestamp": "1783846955", "to_ids": true, "type": "sha256", "uuid": "731f774b-591d-49db-96ae-b14d3e010987", "value": "674fd71148a05177e5c26fa4d37a03e257eae5ac466c4bf1702202f2520b85b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "object_relation": "text", "timestamp": "1783846339", "to_ids": false, "type": "text", "uuid": "12e4eb48-2737-4b8a-94e0-ef23c0ca8675", "value": "Type Description: VBA\nMicrosoft: Backdoor:MSIL/AsyncRAT!rfn\nClamAV: None\nVT Total Detection: 31/74\nFirst Seen In The Wild: 2026-03-05T00:00:59+00:00\nFirst Submission: 2026-03-06T22:11:25+00:00\nLast Submission: 2026-03-06T22:11:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "object_relation": "ssdeep", "timestamp": "1783846339", "to_ids": true, "type": "ssdeep", "uuid": "cc578cf0-3d99-4f6c-9cdc-72b256327926", "value": "3072:+j07S7Wb80555nLqJiwCIGMQPdi4EDYouZTE8JC+VJdztDafdMSqLduGxy8NLOXV:dSCuJiwCIp+vYHr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846339", "to_ids": false, "type": "size-in-bytes", "uuid": "9a65de29-3d4e-4842-b6c1-7723568b6f59", "value": "629295" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "object_relation": "vhash", "timestamp": "1783846339", "to_ids": true, "type": "vhash", "uuid": "a3b2784c-80d4-4a6a-bfd8-350459bfe2d9", "value": "e28877232b228c745857e92d84be0e86" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T22:11:25+00:00", "last_seen": "2026-03-06T22:11:25+00:00", "object_relation": "filename", "timestamp": "1783846339", "to_ids": true, "type": "filename", "uuid": "a1ff21f0-7795-4a93-986b-315641a5052b", "value": "installer_method3_stream.vbs-1.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850962", "uuid": "aa4456d7-a8ac-49eb-a0e5-bc176a31caa8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "md5", "timestamp": "1783850962", "to_ids": true, "type": "md5", "uuid": "12d5ff22-f135-4c1e-8b3f-afb83d039698", "value": "999a63730c9634481d1d76955a2e76a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "sha1", "timestamp": "1783846956", "to_ids": true, "type": "sha1", "uuid": "170f5139-1775-49cd-abaf-85370247bbfd", "value": "d8f29d9303eb440e95e7a564c4bf96a804069f27", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "sha256", "timestamp": "1783846956", "to_ids": true, "type": "sha256", "uuid": "640c3065-5b0a-4903-a287-f0793a1f9cc7", "value": "7ff71d0a4b31790d20276f0f01d697df221ab245cc8453a3534669891b33cd47", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "text", "timestamp": "1783846361", "to_ids": false, "type": "text", "uuid": "bc413f7e-1e6e-4733-9c39-fc0333a71e72", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/DLLHijack.NUA!MTB\nClamAV: None\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2026-07-01T13:00:44+00:00\nFirst Submission: 2026-03-29T05:12:59+00:00\nLast Submission: 2026-03-29T05:12:59+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "creation-time", "timestamp": "1783846361", "to_ids": false, "type": "datetime", "uuid": "362b340f-337f-4040-b790-c2c1a27ba653", "value": "2023-07-01T13:46:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "ssdeep", "timestamp": "1783846361", "to_ids": true, "type": "ssdeep", "uuid": "a2a8c870-36f3-418a-976c-a0b39ab8f336", "value": "384:j2+zwgZfUTcvaiHsuhDTiOLCPO8/1hsvPwzwhb6artRuZoijtBKYkOlCtNRuZoih:lMg1UTcvNRchsvPNh+WA6nQpVy4Q5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846361", "to_ids": false, "type": "size-in-bytes", "uuid": "0008ddc2-c945-4a34-bde4-c5a994352308", "value": "39936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "vhash", "timestamp": "1783846361", "to_ids": true, "type": "vhash", "uuid": "a80d5e07-a4b5-4a44-855e-18992cdb8e0e", "value": "134066655d1515151028z1chz1dz25z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-29T05:12:59+00:00", "last_seen": "2026-03-29T05:12:59+00:00", "object_relation": "filename", "timestamp": "1783846361", "to_ids": true, "type": "filename", "uuid": "308f677f-5ffb-4308-a850-9de82ee10994", "value": "install.res.1033.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783850984", "uuid": "45a24504-03db-4cc6-b417-7dee9296bda5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "object_relation": "md5", "timestamp": "1783850984", "to_ids": true, "type": "md5", "uuid": "929a5804-3ec9-497d-b731-e80f8135dba1", "value": "9a9ccd8b0e5d05f4ee77667b024844db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "object_relation": "sha1", "timestamp": "1783846958", "to_ids": true, "type": "sha1", "uuid": "e3e8cfd6-08f3-441c-941e-7005e20b0268", "value": "ce1349eb9d4b2025d1a0dde651a690c7a471c5b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "object_relation": "sha256", "timestamp": "1783846958", "to_ids": true, "type": "sha256", "uuid": "afde7054-b1c8-4db1-91d7-57c253f94f41", "value": "7f53fade6f3942f710b230d52a574fc6066ea282e739e417ca039800dc1bb08e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "object_relation": "text", "timestamp": "1783846382", "to_ids": false, "type": "text", "uuid": "26fec76d-9d2c-4dbd-93ec-4fd8487007d7", "value": "Type Description: VBA\nMicrosoft: Trojan:VBA/Casdet!rfn\nClamAV: None\nVT Total Detection: 29/74\nFirst Seen In The Wild: 2026-03-02T11:37:47+00:00\nFirst Submission: 2026-03-02T01:42:02+00:00\nLast Submission: 2026-06-25T16:36:41+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "object_relation": "ssdeep", "timestamp": "1783846382", "to_ids": true, "type": "ssdeep", "uuid": "44582f5f-2a26-4d43-bd22-efc7585404bb", "value": "12:iThteBneIYAHpcR9kfxBhA98pM8jCXbE/xu1Mn9BnfWFrTyoO1rzG:iTPehKaPhAUNjio/xt9hOHya" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846382", "to_ids": false, "type": "size-in-bytes", "uuid": "73b4dfa6-1a8e-4782-a259-356c3310779e", "value": "489" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "object_relation": "vhash", "timestamp": "1783846382", "to_ids": true, "type": "vhash", "uuid": "df374e2d-f70c-4e2b-b0f8-2ad43dd4340d", "value": "c586120c86c54ecb02c51bf02ac0029a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:42:02+00:00", "last_seen": "2026-06-25T16:36:41+00:00", "object_relation": "filename", "timestamp": "1783846382", "to_ids": true, "type": "filename", "uuid": "dd2ac29c-1740-4ddb-8f80-ab06c6f6fe4a", "value": "script.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783851005", "uuid": "2a11f433-aaea-4113-b71d-c51192219994", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "md5", "timestamp": "1783851005", "to_ids": true, "type": "md5", "uuid": "a307bcf1-2970-4175-81f0-0026de64f970", "value": "a85a5bfdcb7c65ab93043b8cf9e20065", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "sha1", "timestamp": "1783846959", "to_ids": true, "type": "sha1", "uuid": "7ec59c64-f163-430c-bfd6-4892de9d65b9", "value": "e09f7bd74e133381180d59fc2ab911ec9c2f0f35", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "sha256", "timestamp": "1783846959", "to_ids": true, "type": "sha256", "uuid": "ff5d5876-0ce0-41e4-a1a0-f078a47dc658", "value": "d60e1b44b29bcb391c0f6bd0e8a734ff06773976186215f87878f5d0ae4233f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 08/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "text", "timestamp": "1783846424", "to_ids": false, "type": "text", "uuid": "6bb3cd74-f9d5-4515-8863-a6a4aae6e88a", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/DLLHijack.NUA!MTB\nClamAV: None\nVT Total Detection: 45/73\nFirst Seen In The Wild: 2026-07-01T13:00:44+00:00\nFirst Submission: 2026-03-06T18:13:50+00:00\nLast Submission: 2026-03-06T18:13:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "creation-time", "timestamp": "1783846425", "to_ids": false, "type": "datetime", "uuid": "33883001-f3e3-43b8-b360-59a50e7a6459", "value": "2023-12-31T16:01:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "ssdeep", "timestamp": "1783846424", "to_ids": true, "type": "ssdeep", "uuid": "b410aaa0-f2c4-4f0e-be64-bb40a7e009d3", "value": "384:O++zwgZfUTcvaiHsuhDTiOLCPO8/1hsvPwzwhb6ardRuZoijtBKYkOlCtNRuZoix:O5Mg1UTcvNRchsvPNh+Ww6nQpVy4jE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846424", "to_ids": false, "type": "size-in-bytes", "uuid": "748b2607-a9c6-4fed-919d-02e28c2bf2df", "value": "39936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "vhash", "timestamp": "1783846424", "to_ids": true, "type": "vhash", "uuid": "6bfbdbec-c53c-498a-8657-cd600c1a902a", "value": "134066655d1515151028z1chz1dz25z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T18:13:50+00:00", "last_seen": "2026-03-06T18:13:50+00:00", "object_relation": "filename", "timestamp": "1783846424", "to_ids": true, "type": "filename", "uuid": "f9d82cff-cdff-473c-ac78-0b4a4faf2f8b", "value": "install.res.1033.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-02T01:41:59+00:00", "last_seen": "2026-07-09T18:03:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783851026", "uuid": "2ae596d7-aa71-4b04-b31f-4ad48659fb41", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:59+00:00", "last_seen": "2026-07-09T18:03:00+00:00", "object_relation": "md5", "timestamp": "1783851026", "to_ids": true, "type": "md5", "uuid": "e8e3dedd-343e-4f84-be3e-38a6990c4754", "value": "b32810973132d11afd61ccee222bbb79", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:59+00:00", "last_seen": "2026-07-09T18:03:00+00:00", "object_relation": "sha1", "timestamp": "1783846961", "to_ids": true, "type": "sha1", "uuid": "353b4a35-c6a1-429d-abdd-dbbf08c3778d", "value": "8d4d123e9ba530605faa58e965f8e5ccba695f4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:59+00:00", "last_seen": "2026-07-09T18:03:00+00:00", "object_relation": "sha256", "timestamp": "1783846961", "to_ids": true, "type": "sha256", "uuid": "c312a189-88f8-4e83-a5f0-6ffc3a26ede8", "value": "cfa37350d3818f2eaa669c3e855cf1601df47b99a88b79e05cd9b6fdfbbf36f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 08/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:41:59+00:00", "last_seen": "2026-07-09T18:03:00+00:00", "object_relation": "text", "timestamp": "1783846446", "to_ids": false, "type": "text", "uuid": "80564d0c-aecb-4ab0-8710-307a8e393c25", "value": "Type Description: VBA\nMicrosoft: Trojan:VBS/Vigorf.A\nClamAV: None\nVT Total Detection: 21/73\nFirst Submission: 2026-03-02T01:41:59+00:00\nLast Submission: 2026-07-09T18:03:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-02T01:41:59+00:00", "last_seen": "2026-07-09T18:03:00+00:00", "object_relation": "ssdeep", "timestamp": "1783846446", "to_ids": true, "type": "ssdeep", "uuid": "14a0860e-d9bc-4002-9b33-5d0b8ee27d45", "value": "384:aYQxtotUPx5chT2N9SrqM8LD5MLrqGRQ0QBxHXKZ:aYQxtotUPNNU+LGv4jHXO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:41:59+00:00", "last_seen": "2026-07-09T18:03:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846446", "to_ids": false, "type": "size-in-bytes", "uuid": "e1f21fa3-fa6d-4928-9078-88b9629b0fad", "value": "14392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-02T01:41:59+00:00", "last_seen": "2026-07-09T18:03:00+00:00", "object_relation": "filename", "timestamp": "1783846446", "to_ids": true, "type": "filename", "uuid": "f54ecac1-8812-4620-852d-e1af34b8771c", "value": "1.vb" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783851047", "uuid": "0f95b491-d5e0-4966-80ea-6f82c8b6b6e6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "md5", "timestamp": "1783851047", "to_ids": true, "type": "md5", "uuid": "e4522fab-4f33-410c-88c6-e49ecfa4f485", "value": "bd05fcf80e493cf9aa71ec510319469d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "sha1", "timestamp": "1783846962", "to_ids": true, "type": "sha1", "uuid": "dbb40f7b-7cee-41bf-83b2-0210377aecf0", "value": "df17eb3a5ed3bf4527ec2d0320ee66bc7c0ef2c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "sha256", "timestamp": "1783846962", "to_ids": true, "type": "sha256", "uuid": "dd35302b-4163-4709-a1ec-d2e2c36052e0", "value": "b5d009f8239cea944660650f1e692ea417e302035fa6de9776490c2f1c30da8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 11/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "text", "timestamp": "1783846467", "to_ids": false, "type": "text", "uuid": "86fadd65-1497-4212-a65c-420e605e35c4", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/DLLHijack!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Seen In The Wild: 2026-03-06T16:42:51+00:00\nFirst Submission: 2026-03-05T15:53:09+00:00\nLast Submission: 2026-03-05T15:53:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "creation-time", "timestamp": "1783846467", "to_ids": false, "type": "datetime", "uuid": "2324c845-e390-4a60-bab5-e385d2765ed6", "value": "2024-11-15T15:10:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "ssdeep", "timestamp": "1783846467", "to_ids": true, "type": "ssdeep", "uuid": "ad374728-d385-48f0-9ca8-bd94d44c19d5", "value": "384:k+zwgZfUTcvaiHsuhDTiOLCPO8/1hsvPwzwhb6arDRuZoijtBKYkOlCtNRuZoijE:fMg1UTcvNRchsvPNh+W66nQpVy4yX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846467", "to_ids": false, "type": "size-in-bytes", "uuid": "794ec0b4-99e1-4870-8d0b-900ec21e8879", "value": "39936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "vhash", "timestamp": "1783846467", "to_ids": true, "type": "vhash", "uuid": "6d86324a-7dcf-48b8-aafc-5c0148e27502", "value": "134066655d1515151028z1chz1dz25z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-05T15:53:09+00:00", "last_seen": "2026-03-05T15:53:09+00:00", "object_relation": "filename", "timestamp": "1783846467", "to_ids": true, "type": "filename", "uuid": "b231f818-1efa-4852-8263-4fc7ca356f94", "value": "install.res.1033.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1783851068", "uuid": "dd30c0f6-4137-4497-bb7b-21ebd3a33412", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "md5", "timestamp": "1783851068", "to_ids": true, "type": "md5", "uuid": "f6746fdb-3b84-41e9-b33e-1824c1d97e77", "value": "edff4f58722c93d7c09ed71899416396", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "sha1", "timestamp": "1783846963", "to_ids": true, "type": "sha1", "uuid": "19f2cf9d-5ce2-4abe-bb94-9e8526473821", "value": "5fd16a3844dce78aa35dad991fa58c9ebab6a845", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "sha256", "timestamp": "1783846963", "to_ids": true, "type": "sha256", "uuid": "8b8b6c0d-249a-42e4-89a5-c3704365d347", "value": "ea0e6ceba1b7e985e98028e7545460a7a01979cc09f2e8947292603752789edc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 12/07/2026\nLast-scan: 10/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "text", "timestamp": "1783846489", "to_ids": false, "type": "text", "uuid": "315f311b-9967-4f0d-a562-6ad9406460b8", "value": "Type Description: Win32 DLL\nOriginal name: install.res.1033.dll\nMicrosoft: Trojan:Win64/DLLHijack.NUA!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2026-07-01T13:00:44+00:00\nFirst Submission: 2026-03-10T17:03:22+00:00\nLast Submission: 2026-03-10T17:03:22+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "creation-time", "timestamp": "1783846489", "to_ids": false, "type": "datetime", "uuid": "efb63bbd-e65a-4718-a886-831fe64368f1", "value": "2025-05-04T23:54:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "ssdeep", "timestamp": "1783846489", "to_ids": true, "type": "ssdeep", "uuid": "3f23df55-9db5-4862-a1c5-82e76e7487a8", "value": "384:U+zwgZfUTcvaiHsuhDTiOLCPO8/1hsvPwzwhb6ar+mRuZoijtBKYkOlCtNRuZoiU:vMg1UTcvNRchsvPNh+Ws6nQpVy4+I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1783846489", "to_ids": false, "type": "size-in-bytes", "uuid": "3022444a-f141-41eb-8e85-2d32a03a6476", "value": "39936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "vhash", "timestamp": "1783846489", "to_ids": true, "type": "vhash", "uuid": "468deb8f-86e0-44d2-bf8a-76b54552d2bb", "value": "134066655d1515151028z1chz1dz25z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-10T17:03:22+00:00", "last_seen": "2026-03-10T17:03:22+00:00", "object_relation": "filename", "timestamp": "1783846489", "to_ids": true, "type": "filename", "uuid": "c7324d65-572f-4ada-980b-79848cf49748", "value": "install.res.1033.dll" } ] } ] } }