{ "Event": { "analysis": "1", "date": "2026-07-09", "extends_uuid": "", "info": "[Threat Intel] GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses", "protected": false, "publish_timestamp": "1784408586", "published": true, "threat_level_id": "2", "timestamp": "1784408586", "uuid": "9090b7a4-1186-49fc-a54e-ed156b6c608f", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#892644", "local": false, "name": "misp-galaxy:producer=\"Symantec\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#f28fb8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"OS Credential Dumping - T1003\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#041edc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"SMB/Windows Admin Shares - T1021.002\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clear Windows Event Logs - T1070.001\"", "relationship_type": "" }, { "colour": "#07ff3c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"LSASS Memory - T1003.001\"", "relationship_type": "" }, { "colour": "#dac154", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#fae37b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"", "relationship_type": "" }, { "colour": "#297c25", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Inhibit System Recovery - T1490\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"MimiKatz\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"AnyDesk\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"PSEXEC\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Netscan\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783681238", "to_ids": false, "type": "link", "uuid": "22ca6357-6849-4cf1-8a10-e3aeed7a4a0c", "value": "https://www.security.com/threat-intelligence/goddamn-ransomware-beast-rebrand" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783681238", "to_ids": false, "type": "text", "uuid": "0638283f-09b6-4684-882a-077a7c67a17d", "value": "GodDamn ransomware represents the third iteration of ransomware developed by Hyadina, following Monster (2022) and Beast (2024). A recent attack in June 2026 demonstrates sophisticated tactics including AnyDesk for remote access, NirSoft-based credential harvesting tools, and the PoisonX kernel driver for defense evasion. PoisonX is a malicious driver signed by Microsoft that terminates security processes at the kernel level. Attackers used PsExec for lateral movement, deployed comprehensive credential theft toolkits comprising 14 different tools, and disabled endpoint defenses before encrypting files. The encrypted files were renamed with victim organization names as extensions. The four-day dwell period allowed attackers to stage payloads and conduct reconnaissance before triggering encryption across at least 10 hosts within the targeted organization." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783681238", "to_ids": false, "type": "text", "uuid": "061950dd-d88c-4209-9b4b-8520d7c32420", "value": "Name: GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses\nAuthor: AlienVault\nAdversary: Hyadina\nTags: [\"kernel driver\", \"defense evasion\", \"anydesk\", \"credential harvesting\", \"mimikatz\", \"goddamn\", \"beast\", \"poisonx\", \"monster\", \"byovd\", \"poisonx driver\"]\nTgtd countries: []\nMlwr families: [\"GodDamn\", \"Beast\", \"Monster\", \"PoisonX\", \"Mimikatz\"]\nAttack_ids: [\"T1003\", \"T1543.003\", \"T1135\", \"T1082\", \"T1555\", \"T1219\", \"T1055\", \"T1021.002\", \"T1555.003\", \"T1070.001\", \"T1003.001\", \"T1049\", \"T1057\", \"T1059.001\", \"T1562.001\", \"T1486\", \"T1018\", \"T1569.002\", \"T1490\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783681238", "to_ids": false, "type": "threat-actor", "uuid": "6a0c2247-85f8-4798-af33-056eb6ff1fe6", "value": "Hyadina" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784408586", "to_ids": true, "type": "sha256", "uuid": "0e46478f-bb31-42ad-ae85-75744caea449", "value": "e097f3b445b63b07afacde8d6a67f0be654dd51e228a3610fb0710a1f7e29a69", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408129", "uuid": "d9d6766a-1a6b-4086-9ae3-89d6c82c8546", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "md5", "timestamp": "1784408128", "to_ids": true, "type": "md5", "uuid": "851d2fde-1796-452a-ae46-dae883b5d016", "value": "75b55bb34dac9d02740b9ad6b6820360", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "sha1", "timestamp": "1784408128", "to_ids": true, "type": "sha1", "uuid": "5a1986ff-a7f1-45e8-b807-209820b4beb3", "value": "a17c21b909c56d93d978014e63fb06926eaea8e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "sha256", "timestamp": "1784408129", "to_ids": true, "type": "sha256", "uuid": "2066fb1f-063e-4848-8fe9-fff6f599795b", "value": "141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "text", "timestamp": "1784367983", "to_ids": false, "type": "text", "uuid": "07f3ae62-316a-4a48-9b75-cc42e9f38b7f", "value": "Type Description: Win32 EXE\nOriginal name: psexesvc.exe\nVerified: Signed\nSigning date: 06:42 PM 06/28/2016\nSigners: Microsoft Corporation; Microsoft Code Signing PCA; Microsoft Root Certificate Authority\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Seen In The Wild: 2016-08-27T02:25:31+00:00\nFirst Submission: 2016-06-30T13:28:30+00:00\nLast Submission: 2026-07-17T03:02:29+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "creation-time", "timestamp": "1784367983", "to_ids": false, "type": "datetime", "uuid": "8d28f931-1151-48f2-8417-3d4752e8757c", "value": "2016-06-28T18:41:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "ssdeep", "timestamp": "1784367983", "to_ids": true, "type": "ssdeep", "uuid": "628691cd-d7d8-4a45-b065-7ca2cd14c163", "value": "3072:yDlGttzhA9HY4ZUFxPkwlmlGev5Vy16cEZ3:yDlGtEC1xn/O5r3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1784367983", "to_ids": false, "type": "size-in-bytes", "uuid": "9375f5d2-d472-4451-83f9-2dcbc2582b16", "value": "145568" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "vhash", "timestamp": "1784367983", "to_ids": true, "type": "vhash", "uuid": "c4d49130-366a-4e3b-83b0-96b0d8c4814d", "value": "015056655d151563c8z58hz13z8fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2016-06-30T13:28:30+00:00", "last_seen": "2026-07-17T03:02:29+00:00", "object_relation": "filename", "timestamp": "1784367983", "to_ids": true, "type": "filename", "uuid": "56d7a38e-8d8b-47fd-9174-76acbecc4ced", "value": "psexesvc.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408132", "uuid": "1e28a850-a0a4-4752-9ed6-aab9f33caf51", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "md5", "timestamp": "1784408131", "to_ids": true, "type": "md5", "uuid": "bdbc453a-77e2-481f-b8e3-854a94f17230", "value": "d28f0cfae377553fcb85918c29f4889b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "sha1", "timestamp": "1784408131", "to_ids": true, "type": "sha1", "uuid": "4e65d0ec-e412-4075-b43e-fb87fc198970", "value": "32e24780735a0148c3cc4ce7dda30ed9365397a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "sha256", "timestamp": "1784408132", "to_ids": true, "type": "sha256", "uuid": "9d48630e-6d0f-4650-88b3-b4456096aeb1", "value": "816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "text", "timestamp": "1784368005", "to_ids": false, "type": "text", "uuid": "aab47294-1b1f-43ce-8254-3b1e74d6e591", "value": "Type Description: Win32 EXE\nFile distributed by: ['Nir Sofer']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['VNCPassView.exe']\nOriginal name: VNCPassView.exe\nMicrosoft: None\nClamAV: None\nVT Total Detection: 41/74\nFirst Seen In The Wild: 2015-02-17T13:38:38+00:00\nFirst Submission: 2014-08-01T09:20:52+00:00\nLast Submission: 2026-06-20T02:00:14+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "creation-time", "timestamp": "1784368005", "to_ids": false, "type": "datetime", "uuid": "25c5d23a-6773-4a0c-83cf-7a7e7cf55b56", "value": "2014-07-31T08:43:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "ssdeep", "timestamp": "1784368005", "to_ids": true, "type": "ssdeep", "uuid": "5f485745-b6c8-4c9c-8f31-138b3d4af496", "value": "1536:NN7ZEyhh5vmK6ApMmmIzrhz9vfbw557J6:vpZv0rmmAt9nk557J6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368005", "to_ids": false, "type": "size-in-bytes", "uuid": "8abbe410-ff05-4dbe-80ad-eff19ced677c", "value": "54272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "vhash", "timestamp": "1784368005", "to_ids": true, "type": "vhash", "uuid": "af59c7c5-93a3-4e09-97b2-d66c70c80b62", "value": "054046655d1510407011z9002727fz12z4afz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2014-08-01T09:20:52+00:00", "last_seen": "2026-06-20T02:00:14+00:00", "object_relation": "filename", "timestamp": "1784368005", "to_ids": true, "type": "filename", "uuid": "cd3ef87c-7da8-44be-8fac-fdefbf2384c1", "value": "VNCPassView.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408136", "uuid": "fd0fffc2-bdf5-4d7f-b6ae-4ad5d9317f31", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "md5", "timestamp": "1784408135", "to_ids": true, "type": "md5", "uuid": "a2849d95-c911-4483-a7b5-569e9f1aa44f", "value": "df218168bf83d26386dfd4ece7aef2d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "sha1", "timestamp": "1784408135", "to_ids": true, "type": "sha1", "uuid": "455a0cf3-2d6c-48f3-91fe-2bd7b77fd7e9", "value": "4a3418d78d8fe36b39d1ee5435796369b88a8762", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "sha256", "timestamp": "1784408136", "to_ids": true, "type": "sha256", "uuid": "6705ba65-da81-4c42-b47b-4cc68d1a5247", "value": "7a313840d25adf94c7bf1d17393f5b991ba8baf50b8cacb7ce0420189c177e26", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "text", "timestamp": "1784368027", "to_ids": false, "type": "text", "uuid": "b50adb3e-7051-4c88-8bb3-9ceab5142595", "value": "Type Description: Win32 EXE\nFile distributed by: ['Nanni Bassetti']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['MessenPass.exe']\nOriginal name: mspass.exe\nMicrosoft: None\nClamAV: Win.Trojan.Sality-126545\nVT Total Detection: 54/74\nFirst Seen In The Wild: 2014-11-01T08:49:40+00:00\nFirst Submission: 2014-09-17T11:38:59+00:00\nLast Submission: 2026-07-16T10:47:50+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "creation-time", "timestamp": "1784368027", "to_ids": false, "type": "datetime", "uuid": "790b8963-dabd-4e3b-9d21-24f9d0d24227", "value": "2014-09-17T08:54:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "ssdeep", "timestamp": "1784368027", "to_ids": true, "type": "ssdeep", "uuid": "773cf776-e755-49ea-b60d-164c49d0fd0a", "value": "1536:gvcwAKSueykH88dTJ0sprwe4l9yj1iyjNQbH:g6K3eyc88ZqorweA9ajKj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368027", "to_ids": false, "type": "size-in-bytes", "uuid": "871e39cd-d510-47e0-bbbf-427cc0ced3b8", "value": "66048" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "vhash", "timestamp": "1784368027", "to_ids": true, "type": "vhash", "uuid": "2e4df4a2-29c5-4ce4-b930-f29abdc88cd6", "value": "06403e0f7d10101011z11z6015z17z13z1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2014-09-17T11:38:59+00:00", "last_seen": "2026-07-16T10:47:50+00:00", "object_relation": "filename", "timestamp": "1784368027", "to_ids": true, "type": "filename", "uuid": "84e69ded-9080-45e4-895d-db5c79e8a7ec", "value": "mspass.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408149", "uuid": "2cd62540-e12a-4dee-a686-c08007a7f136", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "md5", "timestamp": "1784408149", "to_ids": true, "type": "md5", "uuid": "3971fa79-0518-40a8-a43a-763b5d1d9b6a", "value": "6121393a37c3178e7c82d1906ea16fd4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "sha1", "timestamp": "1784408149", "to_ids": true, "type": "sha1", "uuid": "fdae3fb1-8330-4522-bfc2-789845a92dcf", "value": "28ae5dc662dcb251cc67ebc5841df02f3b4bd875", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "sha256", "timestamp": "1784408149", "to_ids": true, "type": "sha256", "uuid": "e6fe37a2-edb8-4d4f-8ca0-db0a1ac7ae89", "value": "5e85446910e732111ca9ac90f9ed8b1dee13c3314d2c5117dcf672994ce73bd6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "text", "timestamp": "1784368049", "to_ids": false, "type": "text", "uuid": "b92a3d3a-0450-47f2-a159-105e7948c18b", "value": "Type Description: Win32 EXE\nFile distributed by: ['Nir Sofer']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['PstPassword.exe', 'pstpassword.exe']\nOriginal name: PstPassword\nMicrosoft: HackTool:Win32/Passview\nClamAV: Win.Virus.Sality-6832741-0\nVT Total Detection: 48/74\nFirst Seen In The Wild: 2017-03-13T20:24:03+00:00\nFirst Submission: 2017-01-30T05:41:30+00:00\nLast Submission: 2026-07-15T14:10:20+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "creation-time", "timestamp": "1784368049", "to_ids": false, "type": "datetime", "uuid": "2e9292a5-16fc-41ee-9954-d2626d46e03c", "value": "2017-01-27T13:02:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "ssdeep", "timestamp": "1784368049", "to_ids": true, "type": "ssdeep", "uuid": "ebdf4240-4cfd-4411-b87a-d99f67ce74e7", "value": "768:ysvCMsHAm3v6sWQL9Ea0awDkK6wnE1mjl9nXd4MQioxm/nUGad:yDMsHAOv9TlgP6t1unXWDUUGad" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368049", "to_ids": false, "type": "size-in-bytes", "uuid": "31129ec5-9969-4e36-a7df-d16cb0028d38", "value": "34816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "vhash", "timestamp": "1784368049", "to_ids": true, "type": "vhash", "uuid": "fba23d52-a068-4813-8063-871e360d0ba4", "value": "03403e0f7d10101011z11z601fz13z1fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2017-01-30T05:41:30+00:00", "last_seen": "2026-07-15T14:10:20+00:00", "object_relation": "filename", "timestamp": "1784368049", "to_ids": true, "type": "filename", "uuid": "78d269e0-81fe-46d0-94c6-1caca4149793", "value": "PstPassword" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408181", "uuid": "d990306b-d5e6-406d-813f-817ad6c84a71", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "md5", "timestamp": "1784408181", "to_ids": true, "type": "md5", "uuid": "b29475d5-dc16-45ff-b6b8-1cc6599068e4", "value": "0e47188b23d897ede0fe8fac05cb3263", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "sha1", "timestamp": "1784408181", "to_ids": true, "type": "sha1", "uuid": "2e1111a7-a147-4541-927f-6fd095eb2b36", "value": "cab798294be00a94ba8ebf9ccb7443e837835d05", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "sha256", "timestamp": "1784408181", "to_ids": true, "type": "sha256", "uuid": "156e90e0-b1b6-4214-9f52-98dc667be114", "value": "8e4b218bdbd8e098fff749fe5e5bbf00275d21f398b34216a573224e192094b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "text", "timestamp": "1784368070", "to_ids": false, "type": "text", "uuid": "c490dcc4-4f45-4b61-bf0b-58f8c273ff54", "value": "Type Description: Win32 EXE\nFile distributed by: ['Nir Sofer']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['OperaPassView.exe']\nOriginal name: OperaPassView.exe\nMicrosoft: HackTool:Win32/OperaPassView\nClamAV: None\nVT Total Detection: 47/74\nFirst Seen In The Wild: 2013-12-08T02:56:59+00:00\nFirst Submission: 2013-06-04T11:54:42+00:00\nLast Submission: 2026-05-31T02:23:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "creation-time", "timestamp": "1784368070", "to_ids": false, "type": "datetime", "uuid": "9b6fd04d-0521-4a87-b4c2-1ae648ca065f", "value": "2013-06-04T05:42:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "ssdeep", "timestamp": "1784368070", "to_ids": true, "type": "ssdeep", "uuid": "d635880d-b0f1-43d4-af46-3349932edeb8", "value": "768:L6XidqPeIGxQ6bqKswKMnfzvl5gOKX2+C4W9wS1mwJIxdwZqq:2XiEFKzTz7T+C4W97mwJIxdgqq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368070", "to_ids": false, "type": "size-in-bytes", "uuid": "154c474a-3ff0-432c-900c-ad2c8da70099", "value": "40960" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "vhash", "timestamp": "1784368070", "to_ids": true, "type": "vhash", "uuid": "e8babe06-95aa-450a-b056-ebbb4d4c850f", "value": "04403e0f7d10101011z11z6015z17z13z101dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2013-06-04T11:54:42+00:00", "last_seen": "2026-05-31T02:23:49+00:00", "object_relation": "filename", "timestamp": "1784368070", "to_ids": true, "type": "filename", "uuid": "bd49f791-70c0-497b-900a-2fc74855e90b", "value": "OperaPassView.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408214", "uuid": "3f20d124-ae74-44cc-909a-80de8538e36e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "md5", "timestamp": "1784408213", "to_ids": true, "type": "md5", "uuid": "24ae1141-4653-4091-973f-a0c6ad268ffe", "value": "b68e5f362582d15b2c904133f80bdfa6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "sha1", "timestamp": "1784408213", "to_ids": true, "type": "sha1", "uuid": "cff8ec9a-3b19-44b0-ba62-7ec8a707e450", "value": "6638e718501de489649a5a3a7fcd62a92fd7cdc1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "sha256", "timestamp": "1784408214", "to_ids": true, "type": "sha256", "uuid": "83e7d6d8-dd80-4152-b0e0-c5583767a649", "value": "c92580318be4effdb37aa67145748826f6a9e285bc2426410dc280e61e3c7620", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "text", "timestamp": "1784368092", "to_ids": false, "type": "text", "uuid": "c9f2d7c6-9bf6-4ed0-b201-fcda9113f422", "value": "Type Description: Win32 EXE\nFile distributed by: ['Nir Sofer']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['SniffPass.exe', 'sniffpass.exe']\nOriginal name: SniffPass\nMicrosoft: None\nClamAV: Win.Trojan.PassSniffer-10025610-0\nVT Total Detection: 34/74\nFirst Seen In The Wild: 2019-11-04T20:43:24+00:00\nFirst Submission: 2014-09-18T05:49:58+00:00\nLast Submission: 2026-06-20T01:55:44+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "creation-time", "timestamp": "1784368092", "to_ids": false, "type": "datetime", "uuid": "773ad993-2233-4ceb-885d-5c1cefe2b0cb", "value": "2014-09-17T11:30:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "ssdeep", "timestamp": "1784368092", "to_ids": true, "type": "ssdeep", "uuid": "054727aa-28e4-4dbe-a6e3-dd0e5298e9b5", "value": "1536:8Ho/j4yWLUVJk8KosYokbsGEKeNsCexwppFxWVyDNDzx3tQimRwJ+Kbs71a:go/j4yWoHOYowsGELsCnbxWVeNnXyuI8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368092", "to_ids": false, "type": "size-in-bytes", "uuid": "df264d0c-5dd0-4fcc-a7f4-911306b21922", "value": "98304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "vhash", "timestamp": "1784368092", "to_ids": true, "type": "vhash", "uuid": "bae28e43-94e6-45ff-99ff-68eda6f1e9f5", "value": "094056655d155510507031z8002c285z3025z12z4f5zf7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2014-09-18T05:49:58+00:00", "last_seen": "2026-06-20T01:55:44+00:00", "object_relation": "filename", "timestamp": "1784368092", "to_ids": true, "type": "filename", "uuid": "49f6f6ec-1fc5-4846-babd-533e89d0e96c", "value": "SniffPass" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408246", "uuid": "8b64b002-eb87-4607-9ffe-7a5b8d684548", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "md5", "timestamp": "1784408245", "to_ids": true, "type": "md5", "uuid": "bc1502c3-3c46-408b-960e-e7d1951d503c", "value": "a3cb3b02a683275f7e0a0f8a9a5c9e07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "sha1", "timestamp": "1784408245", "to_ids": true, "type": "sha1", "uuid": "b04945e1-8931-49c9-bcbd-3c50296ce649", "value": "d241df7b9d2ec0b8194751cd5ce153e27cc40fa4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "sha256", "timestamp": "1784408246", "to_ids": true, "type": "sha256", "uuid": "9618de53-c151-40f8-b52f-e7aabfac0e5c", "value": "31eb1de7e840a342fd468e558e5ab627bcb4c542a8fe01aec4d5ba01d539a0fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "text", "timestamp": "1784368114", "to_ids": false, "type": "text", "uuid": "a73b21f0-f0dd-436f-93f1-8014a2a2db6d", "value": "Type Description: Win32 EXE\nOriginal name: mimikatz.exe\nVerified: Signed\nSigning date: 05:19 PM 09/18/2020\nSigners: Open Source Developer, Benjamin Delpy; Certum Code Signing CA SHA2; Certum Trusted Network CA\nMicrosoft: HackTool:Win32/Mimikatz!pz\nClamAV: Win.Tool.Mimikatz-9862700-0\nVT Total Detection: 62/74\nFirst Seen In The Wild: 2020-09-28T15:11:52+00:00\nFirst Submission: 2020-09-19T03:38:47+00:00\nLast Submission: 2026-06-24T00:57:11+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "creation-time", "timestamp": "1784368115", "to_ids": false, "type": "datetime", "uuid": "1250cdc6-0d1a-4953-83f2-5d4989575d63", "value": "2020-09-18T17:18:50+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "ssdeep", "timestamp": "1784368114", "to_ids": true, "type": "ssdeep", "uuid": "c45a20ef-4010-40ab-9b50-b664853f68e1", "value": "24576:XOzE5EJgB1alEruZrnnDGgMsnPjKesPbqJgUe8MAm4rCNG/:XOSwrDzLj5O2JgUe8M0n/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368114", "to_ids": false, "type": "size-in-bytes", "uuid": "17ec1451-9631-4e3d-9c11-2dd19994e088", "value": "1309448" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "vhash", "timestamp": "1784368114", "to_ids": true, "type": "vhash", "uuid": "0c90d626-ad3e-429a-8fa0-d8435358b536", "value": "016066651d15556515f2z1a2z8c4d0922z40300280c0105001303dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2020-09-19T03:38:47+00:00", "last_seen": "2026-06-24T00:57:11+00:00", "object_relation": "filename", "timestamp": "1784368114", "to_ids": true, "type": "filename", "uuid": "f9e8614a-45b1-4edf-af2f-94d10f980286", "value": "mimikatz.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408278", "uuid": "dc3bac82-6227-4d90-8353-aa7975b4218c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "md5", "timestamp": "1784408277", "to_ids": true, "type": "md5", "uuid": "27d701d8-c2f8-4727-8efb-68536fe7837b", "value": "2a624bddd0296c8f1cfe69951afd2b54", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "sha1", "timestamp": "1784408278", "to_ids": true, "type": "sha1", "uuid": "9790e5ed-95a5-4800-a0b4-3936c92e58f8", "value": "da7b704794cfc2e1e410c1c6fbf3094541881c1d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "sha256", "timestamp": "1784408278", "to_ids": true, "type": "sha256", "uuid": "0f5aeb73-df31-4bd0-b458-6c7ab8c106f6", "value": "faca9e856c369b63d6698c74b1d59b062a9a8d9fe84b8f753c299c9961026395", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "text", "timestamp": "1784368136", "to_ids": false, "type": "text", "uuid": "601d257d-081f-4e4c-87b2-1497d1e25471", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:Win32/PasswordRecovery\nClamAV: None\nVT Total Detection: 50/74\nFirst Seen In The Wild: 2023-03-01T00:27:53+00:00\nFirst Submission: 2021-04-17T17:01:02+00:00\nLast Submission: 2026-06-10T09:03:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "creation-time", "timestamp": "1784368137", "to_ids": false, "type": "datetime", "uuid": "7a61ae86-bfb4-47c6-8ca0-1f5a2d755b06", "value": "2020-12-17T10:35:47+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "ssdeep", "timestamp": "1784368136", "to_ids": true, "type": "ssdeep", "uuid": "a6944ab0-a329-49d5-b527-ca34874a244d", "value": "12288:VzdklAl6doyG8mW8zxOKBPrXZcjVby8J/EgINA0I:Aq6Kp8mW8zMKNrSjVO8hMNA0I" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368136", "to_ids": false, "type": "size-in-bytes", "uuid": "f82f8d81-9ace-43ed-8d11-b423c8c89e5f", "value": "502272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "vhash", "timestamp": "1784368136", "to_ids": true, "type": "vhash", "uuid": "b6d79cb1-e8de-4d5c-a630-cb1e9ba9c751", "value": "055056655d155550607021z900592a5z27z52z4ffz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2021-04-17T17:01:02+00:00", "last_seen": "2026-06-10T09:03:09+00:00", "object_relation": "filename", "timestamp": "1784368136", "to_ids": true, "type": "filename", "uuid": "9f61f8fe-be56-462d-a5f0-82631c923d5a", "value": "passwordfox.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408310", "uuid": "ce09e879-98e1-4dca-b879-78a152a6318d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "md5", "timestamp": "1784408309", "to_ids": true, "type": "md5", "uuid": "ad5db649-dac7-476b-88cc-caa74cd652f2", "value": "863fa58aa1fe8a88626625b191d4722e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "sha1", "timestamp": "1784408310", "to_ids": true, "type": "sha1", "uuid": "ec7ad362-44af-4f77-a5b4-c10e2d992f43", "value": "e7fb4bf69be5ac4583c0c02e26a17bd3cdef4c02", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "sha256", "timestamp": "1784408310", "to_ids": true, "type": "sha256", "uuid": "3df63ee4-45b0-4629-ac78-3060eb36f162", "value": "45126297c07c6ef56b51440cd0dc30acf7b3b938e2e9e656334886fe2f81f220", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "text", "timestamp": "1784368158", "to_ids": false, "type": "text", "uuid": "81a7d4a4-0e6f-4236-87dc-7917f0990f3d", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 10:50 AM 03/28/2024\nSigners: AnyDesk Software GmbH; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2024-03-28T17:51:25+00:00\nFirst Submission: 2024-03-28T15:10:22+00:00\nLast Submission: 2026-07-15T12:00:11+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "creation-time", "timestamp": "1784368158", "to_ids": false, "type": "datetime", "uuid": "b6ca0c8a-43eb-4729-8f69-a3713daacef9", "value": "2024-03-28T10:30:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "ssdeep", "timestamp": "1784368158", "to_ids": true, "type": "ssdeep", "uuid": "c8278964-e7e6-48ea-82ec-50c097d78dd5", "value": "98304:m73/fXBy7vaQfw2Tx9ygyzn00+IQFikLo7ANSDkatVVoj9dU5UywL:AHXk7yQpxy0LEAADkahowULL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368158", "to_ids": false, "type": "size-in-bytes", "uuid": "bb8ffc98-b5ce-4cf0-965e-7ad86efc0d05", "value": "5323592" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "vhash", "timestamp": "1784368158", "to_ids": true, "type": "vhash", "uuid": "ad73e59f-db39-45a6-886f-84193ba88428", "value": "0560666c055d75651\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-03-28T15:10:22+00:00", "last_seen": "2026-07-15T12:00:11+00:00", "object_relation": "filename", "timestamp": "1784368158", "to_ids": true, "type": "filename", "uuid": "df39babf-a1f9-4189-a9d8-b0f95942fc52", "value": "AnyDesk.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408343", "uuid": "7fd8179e-bf83-4c02-9407-95a0a6cb9c54", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "md5", "timestamp": "1784408342", "to_ids": true, "type": "md5", "uuid": "4baf1158-d778-407e-85d0-5a4fb883135a", "value": "fc3b93e042de5fa569a8379d46bce506", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "sha1", "timestamp": "1784408342", "to_ids": true, "type": "sha1", "uuid": "ac15d11f-c4eb-447e-983e-85dd015a4596", "value": "1ba499bafaa369be58e795a150403c8729ef5d95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "sha256", "timestamp": "1784408343", "to_ids": true, "type": "sha256", "uuid": "3f7ed04f-3fca-44d1-802d-24eb67ae974c", "value": "5be325905df8aab7089ab2348d89343f55a2f88dadd75de8f382e8fa026451bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "text", "timestamp": "1784368180", "to_ids": false, "type": "text", "uuid": "3fae4c34-7aea-4be6-9731-4598085316e7", "value": "Type Description: Win32 EXE\nFile distributed by: ['Nir Sofer']\nData sources: ['National Software Reference Library (NSRL)']\nVerdict filename: ['mailpv.exe']\nMicrosoft: HackTool:Win32/Passview!MTB\nClamAV: None\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2022-04-18T23:15:26+00:00\nFirst Submission: 2021-07-04T22:28:48+00:00\nLast Submission: 2026-07-17T07:04:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "creation-time", "timestamp": "1784368180", "to_ids": false, "type": "datetime", "uuid": "8885e163-fe96-400a-a19d-1317510f44f2", "value": "2021-07-04T13:36:25+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "ssdeep", "timestamp": "1784368180", "to_ids": true, "type": "ssdeep", "uuid": "24beb183-d4b6-417c-ad95-e52b16734f01", "value": "12288:hKEbpRc5EKKppUIkZLCchAaVSO6H0Miqpm/m4CynFOHmt9e:h3dRc94puFmaQH0Miqom41nFOHmq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368180", "to_ids": false, "type": "size-in-bytes", "uuid": "9e0c53b4-f550-4015-bc04-c46fba11fc34", "value": "510976" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "vhash", "timestamp": "1784368180", "to_ids": true, "type": "vhash", "uuid": "b9373174-cdea-4c57-9725-a5bb97cbf1cf", "value": "055046656d1510807031z80064355z33z11z42z5gz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2021-07-04T22:28:48+00:00", "last_seen": "2026-07-17T07:04:06+00:00", "object_relation": "filename", "timestamp": "1784368180", "to_ids": true, "type": "filename", "uuid": "d3d21748-6262-482b-85a5-ee9bdc7e15d0", "value": "mailpv.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408375", "uuid": "c4799e9b-95f8-4c0f-b6f4-2b11a2ec109b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "md5", "timestamp": "1784408374", "to_ids": true, "type": "md5", "uuid": "a6afafa0-2a68-409c-9380-63477526f847", "value": "e736229e890a138ccf7810e00a6bb50d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "sha1", "timestamp": "1784408375", "to_ids": true, "type": "sha1", "uuid": "7f016223-dcd2-42d4-b970-f27213567d5e", "value": "10955a02ef3fd3f80f20062c401bf7960ff6ce94", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "sha256", "timestamp": "1784408375", "to_ids": true, "type": "sha256", "uuid": "4b7e2b56-0ade-4e82-8604-08d67d8e7450", "value": "17fb52476016677db5a93505c4a1c356984bc1f6a4456870f920ac90a7846180", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "text", "timestamp": "1784368202", "to_ids": false, "type": "text", "uuid": "e2202747-05fa-445d-a8ea-8ad8dde02646", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: None\nVT Total Detection: 46/74\nFirst Seen In The Wild: 2024-04-15T04:00:00+00:00\nFirst Submission: 2024-01-16T19:00:37+00:00\nLast Submission: 2026-07-16T11:13:51+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "creation-time", "timestamp": "1784368203", "to_ids": false, "type": "datetime", "uuid": "ff51d98c-bf64-47dd-8d97-c9aea7c5e157", "value": "2024-01-16T11:30:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "ssdeep", "timestamp": "1784368202", "to_ids": true, "type": "ssdeep", "uuid": "e7b9a05c-5635-4714-86fb-25c9b86b5b3d", "value": "3072:N3OzejfU9BTm3NGw30IquiYo00T33rHiZ2S9k2pMmexQEf:lO6jsHmFpquwuZ2S9k3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368202", "to_ids": false, "type": "size-in-bytes", "uuid": "9400d8e5-dcd6-4008-8ed6-9c7e639c4ff3", "value": "140800" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "vhash", "timestamp": "1784368202", "to_ids": true, "type": "vhash", "uuid": "e9344a83-1ef6-4421-a9eb-62959b22d2c3", "value": "015056655d155510907021z9003b2a5z27z42z4cfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2024-01-16T19:00:37+00:00", "last_seen": "2026-07-16T11:13:51+00:00", "object_relation": "filename", "timestamp": "1784368202", "to_ids": true, "type": "filename", "uuid": "131e0150-69a1-4d15-b975-1f02426f2a99", "value": "netpass.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408402", "uuid": "a36cee87-fc25-4be0-92dc-f549daafc251", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "md5", "timestamp": "1784408400", "to_ids": true, "type": "md5", "uuid": "9a3c6c93-6b00-4274-8743-d778612b9c73", "value": "07e9f0b8627a95960e79e930fb099e84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "sha1", "timestamp": "1784408400", "to_ids": true, "type": "sha1", "uuid": "b47101b7-352a-4e43-bfe5-35dfdeceffac", "value": "56bee9df5833a637f5c54d5911df98b0812fe643", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "sha256", "timestamp": "1784408402", "to_ids": true, "type": "sha256", "uuid": "017c2e44-0c14-432e-ad27-6a2ffe7803c7", "value": "2d91a78e739891c9854c254f5b2a6b84c0e167dfa253466cbccd2cdd1c20145d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "text", "timestamp": "1784368225", "to_ids": false, "type": "text", "uuid": "2699b4ae-92a4-480f-b79e-4fee140b7110", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 05:27 PM 03/25/2025\nSigners: Microsoft Windows Hardware Compatibility Publisher; Microsoft Windows Third Party Component CA 2014; Microsoft Root Certificate Authority 2010\nMicrosoft: Trojan:Win64/Rootkit!MSR\nClamAV: None\nVT Total Detection: 39/74\nFirst Seen In The Wild: 2026-04-22T10:12:20+00:00\nFirst Submission: 2026-04-21T20:15:15+00:00\nLast Submission: 2026-05-01T06:42:40+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "creation-time", "timestamp": "1784368225", "to_ids": false, "type": "datetime", "uuid": "c629ab47-c277-4dcd-a000-b58e03fa2ca7", "value": "2025-03-24T03:53:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "ssdeep", "timestamp": "1784368225", "to_ids": true, "type": "ssdeep", "uuid": "5b65cbb9-46c7-4e7b-b226-69a23693ec39", "value": "192:NNp/y5vzVXpWlVHMEc+Pbp5GBe1VfNEwm1ahYCydn2O8xYqD0cSX01k9z3AT/ipe:NN85rVXcLr7GBJ1ah3yqvDyR9za/io" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368225", "to_ids": false, "type": "size-in-bytes", "uuid": "842c0332-015e-4284-97be-9211029a0fe4", "value": "19672" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "vhash", "timestamp": "1784368225", "to_ids": true, "type": "vhash", "uuid": "77879982-a0c0-4fa3-a907-62694f4538aa", "value": "014066551d1516151iz13xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-21T20:15:15+00:00", "last_seen": "2026-05-01T06:42:40+00:00", "object_relation": "filename", "timestamp": "1784368225", "to_ids": true, "type": "filename", "uuid": "ba4921f2-d880-4518-9364-34512bc552f1", "value": "g11.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408427", "uuid": "a4245a38-3cd4-4416-90cd-eb5aef563f50", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "md5", "timestamp": "1784408426", "to_ids": true, "type": "md5", "uuid": "29af4e4f-fb89-4765-a236-a062db8bef7c", "value": "233b795102dd9cd630aebddfe3c15bbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "sha1", "timestamp": "1784408427", "to_ids": true, "type": "sha1", "uuid": "c730e4f4-acb0-47c5-b96f-1085c9894f1d", "value": "d29670e684e40ddc89b47010c37cbc96737035b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "sha256", "timestamp": "1784408427", "to_ids": true, "type": "sha256", "uuid": "d8d79ea2-e6cc-467e-8e1e-c3574e76609f", "value": "b29f91a440527fb621d106a2048f6379fff3263c60aeda9c82ff8c1d5ae880a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "text", "timestamp": "1784368246", "to_ids": false, "type": "text", "uuid": "118fa6ff-0804-448b-8f58-e25ff119aa4b", "value": "Type Description: Win32 EXE\nVerified: The digital signature of the object did not verify.\nSigning date: 04:25 PM 05/23/2025\nSigners: Symantec Corporation; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: Trojan:Win64/KillAV!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Submission: 2026-06-19T13:25:42+00:00\nLast Submission: 2026-06-19T13:25:42+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "creation-time", "timestamp": "1784368246", "to_ids": false, "type": "datetime", "uuid": "fe0eea8e-1f1d-4288-8b7a-ae59637a31b2", "value": "2025-05-24T01:37:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "ssdeep", "timestamp": "1784368246", "to_ids": true, "type": "ssdeep", "uuid": "464ba89a-3c58-456b-8f8e-7c63dc6dcc11", "value": "49152:RkBFt2PWLdU6bbyuS4TiYgqKGLasbCQaiYGk6Dj0Szi7syBDlZRybbq0LTxqH0Fp:RkVlCL6vzC8vgS6sy/ybmqCFC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368246", "to_ids": false, "type": "size-in-bytes", "uuid": "b6ad519b-18f9-4435-893d-f57f801cdd52", "value": "3546816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "vhash", "timestamp": "1784368246", "to_ids": true, "type": "vhash", "uuid": "e743b199-c465-4371-8d67-09e7c1753966", "value": "0360cf7f7f7f0f5c0f1f1015z11z4015z1015z13z101dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-19T13:25:42+00:00", "last_seen": "2026-06-19T13:25:42+00:00", "object_relation": "filename", "timestamp": "1784368246", "to_ids": true, "type": "filename", "uuid": "b51f5d63-032e-4da0-b84f-68d7292b3d49", "value": "ynehfng.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408453", "uuid": "79722b64-de00-429c-9d45-bfdde5c9e63f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "md5", "timestamp": "1784408453", "to_ids": true, "type": "md5", "uuid": "4a8da7b1-f8ca-42b3-bd45-1e5891a58415", "value": "4277a6be9b121a30564aca6ba32db272", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "sha1", "timestamp": "1784408453", "to_ids": true, "type": "sha1", "uuid": "dcedd004-0860-4a3d-bb24-90e06dc82c7a", "value": "7b01f64b7818d315ef7a2485c4ce2a5d6896cb58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "sha256", "timestamp": "1784408453", "to_ids": true, "type": "sha256", "uuid": "d6adb778-64ab-42c9-af0a-074986cbc4ce", "value": "8ff1c1967841a595d996a649c8134b7a5970dcf94624b237d1b089e7c6266167", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "text", "timestamp": "1784368268", "to_ids": false, "type": "text", "uuid": "de14f43c-6910-4973-b40e-9e0bbd4519e3", "value": "Type Description: Win32 EXE\nMicrosoft: None\nClamAV: Win.Tool.WebBrowserPassView-9831120-0\nVT Total Detection: 51/74\nFirst Seen In The Wild: 2025-06-20T00:00:00+00:00\nFirst Submission: 2025-06-08T12:08:42+00:00\nLast Submission: 2026-01-25T17:13:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "creation-time", "timestamp": "1784368268", "to_ids": false, "type": "datetime", "uuid": "ab123c8e-7d89-4cb6-8813-a40cfe29b4ae", "value": "2025-06-07T07:29:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "ssdeep", "timestamp": "1784368268", "to_ids": true, "type": "ssdeep", "uuid": "3db06a3e-30da-43e2-b186-eaabfcd2fc23", "value": "12288:AK5QGsqK90Fgwq8zb3A4SBDau76FpqahlcEEOifkFT:AK5Qz0Fbq8zb5Spau76DqahlcbiT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368268", "to_ids": false, "type": "size-in-bytes", "uuid": "d07a9e0a-cf0a-4939-aaf7-cbb92f8eb701", "value": "487936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "vhash", "timestamp": "1784368268", "to_ids": true, "type": "vhash", "uuid": "f1796d62-5315-421f-b2a7-b7002526d6d6", "value": "045046655d155080803001100602f5z47z62z570303bz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-08T12:08:42+00:00", "last_seen": "2026-01-25T17:13:06+00:00", "object_relation": "filename", "timestamp": "1784368268", "to_ids": true, "type": "filename", "uuid": "7008b42f-412f-4ac9-9a13-714581e39de9", "value": "Web Browser Pass View" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408486", "uuid": "4c262bcc-fd3f-439a-9672-08ec6f3b9917", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "md5", "timestamp": "1784408486", "to_ids": true, "type": "md5", "uuid": "e8074e2e-b233-4be1-ad4a-417252afe059", "value": "8e776dbb71eb8f42dffd3020175edef5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "sha1", "timestamp": "1784408486", "to_ids": true, "type": "sha1", "uuid": "79558e11-ee78-48d1-b6b0-fce885e21236", "value": "7d33e173819ecd502f790bf6d3da260a82dedfa2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "sha256", "timestamp": "1784408486", "to_ids": true, "type": "sha256", "uuid": "e6b5062d-89b8-4e04-a186-79f5daa33c44", "value": "5c4c98d774eb100f9a89ae4e984c27a4f532e58c7cf8c87046dc87db5a065404", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "text", "timestamp": "1784368290", "to_ids": false, "type": "text", "uuid": "885a351e-20d8-4002-aecf-04eb169161d0", "value": "Type Description: Win32 EXE\nOriginal name: ChromePass\nMicrosoft: Trojan:Win32/Malgent!MTB\nClamAV: None\nVT Total Detection: 44/74\nFirst Seen In The Wild: 2025-09-25T03:33:40+00:00\nFirst Submission: 2025-06-05T15:40:45+00:00\nLast Submission: 2026-04-27T18:04:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "creation-time", "timestamp": "1784368290", "to_ids": false, "type": "datetime", "uuid": "e1ff02b7-a4fd-437a-be50-4fa7992a528e", "value": "2025-06-05T11:13:49+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "ssdeep", "timestamp": "1784368290", "to_ids": true, "type": "ssdeep", "uuid": "1b35441c-0989-44d4-a18e-adfe4845ebf3", "value": "6144:FUXyq9Uvo+BtSJO7v1W+koVDWgm278IquCb/vaFgQAwXu5W9N9H3ckO:FoQDBrkcDWUY7F3cgR7mJ3ckO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368290", "to_ids": false, "type": "size-in-bytes", "uuid": "fd0d203c-bd61-4f79-8a80-134cabbd39c8", "value": "366080" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "vhash", "timestamp": "1784368290", "to_ids": true, "type": "vhash", "uuid": "cd558e02-49df-4f72-9502-13deb801ebb9", "value": "035046655d1510507021z9004e2f5z37z62z4bfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-05T15:40:45+00:00", "last_seen": "2026-04-27T18:04:28+00:00", "object_relation": "filename", "timestamp": "1784368290", "to_ids": true, "type": "filename", "uuid": "e99d52b1-6103-47a5-b450-f831d55a924a", "value": "ChromePass" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408511", "uuid": "54e058e9-6c18-48fe-996a-4156d11575c1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "md5", "timestamp": "1784408510", "to_ids": true, "type": "md5", "uuid": "2d67afbb-f25a-44b4-89bd-f12d4bb4ccfa", "value": "075b3fe08047d78a8105f0c181452e6d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "sha1", "timestamp": "1784408511", "to_ids": true, "type": "sha1", "uuid": "51d3943d-9105-4e8b-8cc3-4f84f8e4452a", "value": "21b6d83b0bd4251e3f5d161bf8e1d206b884641c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "sha256", "timestamp": "1784408511", "to_ids": true, "type": "sha256", "uuid": "7ce85702-8ce3-4bdb-aa7a-996812ea2649", "value": "19bab15a34d5ad838ccf4d187eb40379c335fa56446d0f9621865b2767d4ac7d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "text", "timestamp": "1784368311", "to_ids": false, "type": "text", "uuid": "58c8a199-0e1b-4787-b123-d5bbd1131af0", "value": "Type Description: Win32 EXE\nMicrosoft: HackTool:Win64/Wirelesskeyview\nClamAV: None\nVT Total Detection: 42/74\nFirst Seen In The Wild: 2023-11-18T03:13:56+00:00\nFirst Submission: 2023-11-20T00:11:16+00:00\nLast Submission: 2026-07-17T10:08:26+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "creation-time", "timestamp": "1784368312", "to_ids": false, "type": "datetime", "uuid": "665e1d28-cb3e-48d1-b790-54f88dead39d", "value": "2023-11-18T09:13:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "ssdeep", "timestamp": "1784368311", "to_ids": true, "type": "ssdeep", "uuid": "85ec977b-6689-411f-ab7e-7ee0d7acf557", "value": "6144:a7MiYY7J0dVUima0J+RJIlrle0+2s1Ckr6ZOjnyLtBUl4:a7M+CdVOoRNF7r6coU6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368311", "to_ids": false, "type": "size-in-bytes", "uuid": "ba5e8be5-e732-49ec-8c79-987f5c9ccdc8", "value": "263168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "vhash", "timestamp": "1784368311", "to_ids": true, "type": "vhash", "uuid": "91bdace4-3f4b-4290-911a-3b8df2263368", "value": "025056655d15555060703001400777z27z42z53fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-11-20T00:11:16+00:00", "last_seen": "2026-07-17T10:08:26+00:00", "object_relation": "filename", "timestamp": "1784368311", "to_ids": true, "type": "filename", "uuid": "a72955e0-b877-4d40-b706-ab20b1c9ee66", "value": "WirelessKeyView.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408536", "uuid": "be1be76c-2a8e-44da-a5d9-456140467009", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "md5", "timestamp": "1784408535", "to_ids": true, "type": "md5", "uuid": "218eb054-292b-4385-ac36-28839096e596", "value": "a3a0e15ee3ea1dfa703ae53dae92f722", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "sha1", "timestamp": "1784408535", "to_ids": true, "type": "sha1", "uuid": "162d6ab3-dca0-437e-a6a1-7e29bbb0f314", "value": "5463f4140efd005a7bafa6fa0fa759bcfcf7da4a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "sha256", "timestamp": "1784408536", "to_ids": true, "type": "sha256", "uuid": "037cf15b-4e16-406e-ae02-5fc46aa6aa39", "value": "35296e7a34688ca3e3159bcdf92b4d60ba4173a2369aca531bb7bc959f68ed9c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "text", "timestamp": "1784368333", "to_ids": false, "type": "text", "uuid": "f8029792-e24a-48ea-9877-cbe42f55deec", "value": "Type Description: Win32 EXE\nOriginal name: CredentialsFileView.exe\nMicrosoft: None\nClamAV: None\nVT Total Detection: 37/74\nFirst Seen In The Wild: 2023-12-04T03:53:24+00:00\nFirst Submission: 2023-12-05T02:10:22+00:00\nLast Submission: 2026-07-16T04:02:27+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "creation-time", "timestamp": "1784368333", "to_ids": false, "type": "datetime", "uuid": "c6d019be-e650-44f0-933c-c69346fe7583", "value": "2023-12-04T10:53:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "ssdeep", "timestamp": "1784368333", "to_ids": true, "type": "ssdeep", "uuid": "2971eea6-53ba-43a2-aa21-959e566c0497", "value": "3072:KdBN2yudy/4yOhgKyxabqSDqNRVYZw8uW1anEl8yh7mk0h:KdBN2rryOGKydopyWkn/Xh" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368333", "to_ids": false, "type": "size-in-bytes", "uuid": "82979c61-3681-4481-90b2-303bdb0a9a62", "value": "177152" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "vhash", "timestamp": "1784368333", "to_ids": true, "type": "vhash", "uuid": "cc3c3fcd-1feb-4633-aa4e-7df0b2c6df58", "value": "015056655d155550a08020113004626fz42z5c03dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2023-12-05T02:10:22+00:00", "last_seen": "2026-07-16T04:02:27+00:00", "object_relation": "filename", "timestamp": "1784368333", "to_ids": true, "type": "filename", "uuid": "45190e0c-4bfd-45a9-8a07-c084c31a2c95", "value": "CredentialsFileView.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408564", "uuid": "6d6eb55c-d367-4b28-9dfe-171b419682a0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "md5", "timestamp": "1784408563", "to_ids": true, "type": "md5", "uuid": "8ed100f9-80ed-48a4-bedb-06e2dc690a5a", "value": "6cc4bd4cb2b185abdedb66afdccf9140", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "sha1", "timestamp": "1784408564", "to_ids": true, "type": "sha1", "uuid": "6e813cb7-fcb4-4f06-8ed7-018fea6b6dac", "value": "1bd217e80c12cfe350a8fe522c8b5b988d01aa7d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "sha256", "timestamp": "1784408564", "to_ids": true, "type": "sha256", "uuid": "ec70031b-43cb-4d3c-b0b9-9699a0b7badf", "value": "9fae3f15900e13ec3860a109555ecd33ca43d38907c63438c50a2d6d91bfee1d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "text", "timestamp": "1784368355", "to_ids": false, "type": "text", "uuid": "3c7b1eff-8b74-430a-aeed-8253be1b9d76", "value": "Type Description: Win32 EXE\nMicrosoft: Worm:Win32/NetWorm!rfn\nClamAV: None\nVT Total Detection: 17/74\nFirst Seen In The Wild: 2020-05-14T21:28:17+00:00\nFirst Submission: 2008-01-02T05:56:25+00:00\nLast Submission: 2026-04-08T13:33:37+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "creation-time", "timestamp": "1784368355", "to_ids": false, "type": "datetime", "uuid": "b39df786-c551-43a5-b739-ebf86f438679", "value": "1992-06-19T22:22:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "ssdeep", "timestamp": "1784368355", "to_ids": true, "type": "ssdeep", "uuid": "9f61ec2b-a917-4cca-9d74-3636f2c10718", "value": "12288:Tq7D4Ja7WYI9AQ540U7vCWMKBeXT7solV3Lgk9i2Rq5x:TqcAWYSnqDvluDAWlgk9i" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368355", "to_ids": false, "type": "size-in-bytes", "uuid": "5daacc62-eac8-442f-9035-1be563e5d7e8", "value": "646144" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "vhash", "timestamp": "1784368355", "to_ids": true, "type": "vhash", "uuid": "1412a803-6b6f-46e6-97c6-908f4d9a0c7b", "value": "0650ad7d7d0d7d0d1d0d70101011z11z37z1015z13z1011z19z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2008-01-02T05:56:25+00:00", "last_seen": "2026-04-08T13:33:37+00:00", "object_relation": "filename", "timestamp": "1784368355", "to_ids": true, "type": "filename", "uuid": "8ff1c8e9-16b7-47d3-8d2e-c0ee150da856", "value": "Network Scanner" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784408575", "uuid": "5a6007da-dadb-480f-af5f-ca7b241897ff", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "md5", "timestamp": "1784408574", "to_ids": true, "type": "md5", "uuid": "b82727a0-210e-44e1-80b3-85fe826d86e8", "value": "0d7c4dd2fb71b44df8d552126e6767df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "sha1", "timestamp": "1784408575", "to_ids": true, "type": "sha1", "uuid": "2f69ba11-5d47-4c4f-9aad-d4bd365cf897", "value": "6938178d4b61e183b3b0f779f36c6d368c443c53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "sha256", "timestamp": "1784408575", "to_ids": true, "type": "sha256", "uuid": "6c91619d-38c5-4946-a303-767b153d7173", "value": "ece33e4b7e2d26eeca8ad9db4439f9801a7a77e332611116156738b1b0316046", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "text", "timestamp": "1784368399", "to_ids": false, "type": "text", "uuid": "2f28bec5-a514-4595-8321-5377fb1eb83b", "value": "Type Description: Win32 EXE\nOriginal name: ExtPassword.exe\nMicrosoft: Trojan:Win32/Kepavll!rfn\nClamAV: None\nVT Total Detection: 44/74\nFirst Submission: 2025-04-22T17:18:18+00:00\nLast Submission: 2025-11-20T09:45:22+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "creation-time", "timestamp": "1784368399", "to_ids": false, "type": "datetime", "uuid": "3427abee-57b4-4d6d-a4b1-cbeaf036af8f", "value": "2025-04-22T09:21:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "ssdeep", "timestamp": "1784368399", "to_ids": true, "type": "ssdeep", "uuid": "de26eaa6-2506-452a-bdd6-923cb818b5cf", "value": "6144:3MmoqdKjY2UiXsVhEqqnsWCLw3oHcdnlAuhLU:8mpfpVhq99Ra8Q" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784368399", "to_ids": false, "type": "size-in-bytes", "uuid": "4f989e6f-5df1-4373-ad20-8b58da0e76d8", "value": "290304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "vhash", "timestamp": "1784368399", "to_ids": true, "type": "vhash", "uuid": "8f4a9477-fbc6-45f4-8339-cb98aac76fdd", "value": "02503e0f7d50101011z11z401fz13z101dz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-22T17:18:18+00:00", "last_seen": "2025-11-20T09:45:22+00:00", "object_relation": "filename", "timestamp": "1784368399", "to_ids": true, "type": "filename", "uuid": "070ca623-4b53-404e-bcd8-bb5c89e8abba", "value": "ExtPassword.exe" } ] } ] } }