{ "Event": { "analysis": "1", "date": "2026-05-27", "extends_uuid": "", "info": "[Threat Intel] A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure", "protected": false, "publish_timestamp": "1780377443", "published": true, "threat_level_id": "3", "timestamp": "1780377443", "uuid": "9672f16b-c5cd-4c1f-82fa-488daf2773c3", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#52774b", "local": false, "name": "misp-galaxy:producer=\"Wiz Blog\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#1a0065", "local": false, "name": "rectifyq:topic=\"crypto-related\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780023613", "to_ids": false, "type": "link", "uuid": "cc1a3b0e-327c-4a5d-84fe-dd89635fee93", "value": "https://www.wiz.io/blog/threat-actors-target-crypto-orgs" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780023613", "to_ids": false, "type": "text", "uuid": "5f5eefe2-7683-488b-b60f-89ebaefb3d9b", "value": "JINX-0164, a financially motivated threat actor active since mid-2025, has been conducting sophisticated campaigns against cryptocurrency organizations. The actor employs LinkedIn-based social engineering, posing as recruiters or business partners to deliver custom macOS malware including AUDIOFIX (a Python-based infostealer and RAT) and MINIRAT (a lightweight Go backdoor). Their operations focus on compromising developer endpoints to steal cryptocurrency wallet credentials, cloud secrets, and GitHub tokens. The attackers then pivot to CI/CD infrastructure, injecting malicious code into repositories to enable lateral movement. In April 2026, they executed a supply chain attack by trojanizing the npm package @velora-dex/sdk. The group masks activity using VPN services and demonstrates advanced capabilities including credential harvesting from password managers, browser extensions, and development tools." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780023613", "to_ids": false, "type": "text", "uuid": "87042fbb-21e5-477e-b0c1-0bd881485005", "value": "Name: A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure\nAuthor: AlienVault\nAdversary: JINX-0164\nTags: [\"supply chain attack\", \"social engineering\", \"audiofix\", \"npm trojan\", \"linkedin phishing\", \"macos\", \"cryptocurrency\", \"ci/cd hijacking\", \"minirat\", \"developer targeting\"]\nTgtd countries: []\nMlwr families: [\"AUDIOFIX\", \"MINIRAT\"]\nAttack_ids: []\nIndustries: [\"Technology\", \"Finance\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1780203905", "to_ids": false, "type": "threat-actor", "uuid": "2ece8e74-9fa6-4aca-9bbe-e3197a68196c", "value": "JINX-0164", "Tag": [ { "colour": "#52774b", "local": false, "name": "misp-galaxy:producer=\"Wiz Blog\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780370849", "to_ids": true, "type": "domain", "uuid": "04d9b228-9566-4190-b5bb-f813573e8107", "value": "driver-updater.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780370870", "to_ids": true, "type": "hostname", "uuid": "e4f3ba24-5620-47fe-95fe-fc17dd5b9580", "value": "login.teamicrosoft.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780370891", "to_ids": true, "type": "domain", "uuid": "b0857ba6-0dfb-438e-bdad-99b67e0b6d4c", "value": "live.ong", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780370915", "to_ids": true, "type": "url", "uuid": "521191a8-72ce-49fb-ab54-4463117f12ef", "value": "http://89.36.224.5/troubleshoot/mac/install.sh", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780370936", "to_ids": true, "type": "hostname", "uuid": "fa965593-2ab3-41aa-a2aa-13b43b3298f1", "value": "teams.live.us.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780370957", "to_ids": true, "type": "hostname", "uuid": "95220b17-159c-4e65-a908-ecfc95c4d835", "value": "www.driver-updater.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780370978", "to_ids": true, "type": "hostname", "uuid": "63f71b28-6b6a-45dd-9e55-b468f690ec46", "value": "www.live.us.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780370999", "to_ids": true, "type": "hostname", "uuid": "d945e3cd-15ba-4fd8-9900-9408f98b8936", "value": "teams.retesta.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371021", "to_ids": true, "type": "hostname", "uuid": "6528654f-8632-4b26-b8b5-105bc304134b", "value": "www.drvstore.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371043", "to_ids": true, "type": "hostname", "uuid": "14c9b7fe-d01f-4b04-bbf4-019d87e601a9", "value": "www.retesta.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371065", "to_ids": true, "type": "hostname", "uuid": "f33067c0-db03-4752-8d9a-3b0a030b172b", "value": "login.retesta.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371086", "to_ids": true, "type": "hostname", "uuid": "b80c5e52-9245-4a07-b129-269f7377ac13", "value": "learn.retesta.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371108", "to_ids": true, "type": "domain", "uuid": "cfbc38c7-606c-4b0a-ad51-5e7fe01942df", "value": "driver-store.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371130", "to_ids": true, "type": "hostname", "uuid": "6c9c5f43-f099-4683-9492-77fdba39bea6", "value": "apple.driver-store.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371151", "to_ids": true, "type": "hostname", "uuid": "9a61f7aa-4b51-4ea3-86a3-7bd96d53f64c", "value": "windows.driver-store.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371172", "to_ids": true, "type": "domain", "uuid": "92ad96ec-a3b8-4427-a6cd-ac2b868a305c", "value": "driver-hub.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371193", "to_ids": true, "type": "hostname", "uuid": "526612f8-dd6e-40d8-b152-bc37d3d36bc3", "value": "apple.drvstore.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371214", "to_ids": true, "type": "hostname", "uuid": "737f6a87-7e4f-48b5-9aa6-8a444caba820", "value": "www.live.ong", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371235", "to_ids": true, "type": "hostname", "uuid": "cccd4dba-69cb-4371-a174-fbe5884fbb37", "value": "www.driver-store.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371256", "to_ids": true, "type": "hostname", "uuid": "a5d25810-df22-42c0-b5d7-d26e7e42e6fe", "value": "teams.live.ong", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371278", "to_ids": true, "type": "hostname", "uuid": "d0a1c4cd-5cac-448c-bf77-9ac5f85b36e9", "value": "windows.drvstore.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371299", "to_ids": true, "type": "domain", "uuid": "66b532fd-a74c-4b93-86fb-f88aae3b030e", "value": "drvstore.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371321", "to_ids": true, "type": "hostname", "uuid": "6bb75e7f-bcff-43f7-836a-89d23675a51e", "value": "learn.teams.us.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371344", "to_ids": true, "type": "hostname", "uuid": "0e2a2238-59c1-4643-8c37-400bdbe36034", "value": "learn.live.ong", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371366", "to_ids": true, "type": "hostname", "uuid": "e4eb55de-9718-4d64-a0d5-139a04175cd2", "value": "www.driver-hub.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371387", "to_ids": true, "type": "hostname", "uuid": "e71c19da-51f2-4a3c-965a-a838ca55c580", "value": "team.live.us.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371408", "to_ids": true, "type": "hostname", "uuid": "1df96be3-a4e7-411f-a191-823696f46915", "value": "login.live.ong", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371429", "to_ids": true, "type": "domain", "uuid": "b0392a54-0f06-450f-ac47-4cec33b2a212", "value": "byte-io.us", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371450", "to_ids": true, "type": "domain", "uuid": "a43d2f48-da32-47ab-a00a-5c0c0ad73177", "value": "cloud-sync.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371471", "to_ids": true, "type": "domain", "uuid": "b64a52ff-d736-4933-9139-3111fa327cab", "value": "datahub.ink", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371494", "to_ids": true, "type": "ip-dst", "uuid": "4de2f2e1-5d47-46eb-aad0-605f1388a9d4", "value": "185.100.85.250", "Tag": [ { "colour": "#5d4ed6", "local": false, "name": "asn:asn=\"200651\"", "relationship_type": "" }, { "colour": "#fa141a", "local": false, "name": "asn:as-owner=\"FLOKINET\"", "relationship_type": "" }, { "colour": "#19ad3d", "local": false, "name": "asn:as-country=\"IS\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iceland\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371515", "to_ids": true, "type": "ip-dst", "uuid": "c6a68fa3-27f0-4664-b5ce-b8153b07f257", "value": "185.100.85.98", "Tag": [ { "colour": "#5d4ed6", "local": false, "name": "asn:asn=\"200651\"", "relationship_type": "" }, { "colour": "#fa141a", "local": false, "name": "asn:as-owner=\"FLOKINET\"", "relationship_type": "" }, { "colour": "#19ad3d", "local": false, "name": "asn:as-country=\"IS\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"iceland\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371536", "to_ids": true, "type": "url", "uuid": "4c3624e9-f007-4f99-8af2-f5e0330f395b", "value": "http://alibaba.xyz/minirat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371557", "to_ids": true, "type": "url", "uuid": "fc63747f-3f13-4fa1-af5e-865e3b82c0c2", "value": "https://apple.driver-store.com/mac/arm/driver/coreaudiod", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371580", "to_ids": true, "type": "url", "uuid": "4a362705-861a-40ad-baed-b328276ebf1e", "value": "https://apple.driver-store.com/mac/intel/driver/coreaudiod", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371601", "to_ids": true, "type": "url", "uuid": "ecbf199d-01fa-4332-bfab-774d58f5ce95", "value": "https://apple.driver-update.io/troubleshoot/mac/audio-issue-fix.sh", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371622", "to_ids": true, "type": "url", "uuid": "00d22654-e1a1-45f4-9534-930ebfa0bf29", "value": "https://learn.bitget-meeting.com/en-us/troubleshoot/microsoftteams/teams-on-mac/teams-audio-issue-mac", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371644", "to_ids": true, "type": "url", "uuid": "aea9184a-4b94-417d-9807-a1a2653f8f26", "value": "https://www.iru.com/blog/minirat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371665", "to_ids": true, "type": "domain", "uuid": "8e030fff-bb7f-4fcc-9565-2b9a3a7411db", "value": "alibaba.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371686", "to_ids": true, "type": "domain", "uuid": "ae58e492-bf99-45cc-a364-9dc85c8a4e47", "value": "bitget-meeting.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371707", "to_ids": true, "type": "domain", "uuid": "9a8a4413-7df4-4a6c-8a18-330477c6e816", "value": "driver-update.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371731", "to_ids": true, "type": "domain", "uuid": "5758bb38-a8b3-435a-8239-83c127a6b790", "value": "live.org.mx", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371752", "to_ids": true, "type": "domain", "uuid": "0c1f4fdb-1b77-495e-a5e3-38fdf0709924", "value": "slktest.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371775", "to_ids": true, "type": "domain", "uuid": "505c69db-c862-4ad8-9144-ed03430323dd", "value": "teamicrosoft.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371796", "to_ids": true, "type": "domain", "uuid": "260c192e-cdf5-4067-8d4d-c574f2cca3c7", "value": "teams.cam", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371817", "to_ids": true, "type": "domain", "uuid": "211c22f0-6834-4e23-b5d6-d18a7d8e7957", "value": "us03-slack.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371838", "to_ids": true, "type": "hostname", "uuid": "62be4ea1-ed00-4de4-84dd-8d6b35432e50", "value": "app.us03-slack.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371859", "to_ids": true, "type": "hostname", "uuid": "49a72171-c43e-4eeb-a65b-9a41aa7bdc2c", "value": "apple.driver-hub.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371882", "to_ids": true, "type": "hostname", "uuid": "81a0866a-a43b-4542-b3cc-52f7cd2d2477", "value": "apple.driver-update.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371902", "to_ids": true, "type": "hostname", "uuid": "9116b8c9-baf3-47b8-9910-f596293c6727", "value": "learn.bitget-meeting.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371923", "to_ids": true, "type": "hostname", "uuid": "745c6fb1-8c37-4ec6-85ff-1d6c95b009c0", "value": "learn.teamicrosoft.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371945", "to_ids": true, "type": "hostname", "uuid": "4b367187-0bf6-499c-b24b-5a550645d1b3", "value": "learn.teams.cam", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371966", "to_ids": true, "type": "hostname", "uuid": "3bc71fdb-79b7-42f8-a822-efc5d72d0d4f", "value": "live.teams.cam", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780371987", "to_ids": true, "type": "hostname", "uuid": "c8294662-a4e9-4f36-bac1-54dda3bd6cbc", "value": "login.bitget-meeting.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372008", "to_ids": true, "type": "hostname", "uuid": "9df228b8-a740-4fda-97e1-31cdfb049642", "value": "login.teams.cam", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372029", "to_ids": true, "type": "hostname", "uuid": "8ad255e4-2fa9-4d95-927f-9a14f045b165", "value": "my-home-company-group.slktest.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372050", "to_ids": true, "type": "hostname", "uuid": "a4973bf9-cf8a-4d02-bddd-11bdde2e60df", "value": "my-home-company-group.us03-slack.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372071", "to_ids": true, "type": "hostname", "uuid": "d6024576-74b2-497b-8dc1-3d027ceba96c", "value": "resource.bitget-meeting.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372092", "to_ids": true, "type": "hostname", "uuid": "1b24cdbd-3b76-4318-91fc-1f91c951ea47", "value": "resource.teamicrosoft.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372114", "to_ids": true, "type": "hostname", "uuid": "f9d501d3-5d5c-4a27-9eb5-2cb4bc42d0b1", "value": "sitemaps.driver-store.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372135", "to_ids": true, "type": "hostname", "uuid": "3ebfd594-127c-489e-a0de-76b2e4f26df0", "value": "teams.live.org.mx", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372156", "to_ids": true, "type": "hostname", "uuid": "58edbcfa-b685-4eae-b256-2ee1847a892c", "value": "windows.driver-hub.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372177", "to_ids": true, "type": "hostname", "uuid": "0a67672f-c9d3-447b-bb60-322925833712", "value": "windows.driver-update.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372198", "to_ids": true, "type": "hostname", "uuid": "42cb202d-a5f1-468e-ad6b-e17a82c00234", "value": "www.bitget-meeting.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372219", "to_ids": true, "type": "hostname", "uuid": "73e09022-e507-4555-a7c4-133684dec0d0", "value": "www.driver-update.io", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372240", "to_ids": true, "type": "hostname", "uuid": "f93f9798-6abf-413f-90c4-4ed925373a4f", "value": "www.slktest.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372262", "to_ids": true, "type": "hostname", "uuid": "e10371bf-e1fc-4cea-acb5-23d66d9d1cae", "value": "www.teamicrosoft.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372283", "to_ids": true, "type": "hostname", "uuid": "89443d87-8107-4949-a3a1-0b91a5306829", "value": "www.teams.cam", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372304", "to_ids": true, "type": "hostname", "uuid": "5f0fc2e1-8e58-4d63-839d-0469d8ffcfb6", "value": "www.us03-slack.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372325", "to_ids": true, "type": "ip-dst", "uuid": "5cbc7705-375a-4293-a012-e6dbbf1bb229", "value": "89.36.224.5", "Tag": [ { "colour": "#64bed2", "local": false, "name": "asn:asn=\"9009\"", "relationship_type": "" }, { "colour": "#41c276", "local": false, "name": "asn:as-owner=\"M247\"", "relationship_type": "" }, { "colour": "#26f3a1", "local": false, "name": "asn:as-country=\"RO\"", "relationship_type": "" }, { "colour": "#026417", "local": false, "name": "misp-galaxy:country=\"romania\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372347", "to_ids": true, "type": "hostname", "uuid": "c6794ecd-518a-46af-8c10-aae8c9da8c9f", "value": "live.us.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372368", "to_ids": true, "type": "ip-dst", "uuid": "04729779-deb6-4d28-9830-50e7865f7e04", "value": "84.32.83.250", "Tag": [ { "colour": "#5b03f5", "local": false, "name": "asn:asn=\"43350\"", "relationship_type": "" }, { "colour": "#9d72b4", "local": false, "name": "asn:as-owner=\"NFORCE\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372389", "to_ids": true, "type": "ip-dst", "uuid": "a94c643e-96b2-4e99-ab2f-c115d3336c1c", "value": "163.172.53.20", "Tag": [ { "colour": "#1b1d15", "local": false, "name": "asn:asn=\"12876\"", "relationship_type": "" }, { "colour": "#0d8e69", "local": false, "name": "asn:as-owner=\"Online SAS\"", "relationship_type": "" }, { "colour": "#93736f", "local": false, "name": "asn:as-country=\"FR\"", "relationship_type": "" }, { "colour": "#f6cea1", "local": false, "name": "misp-galaxy:country=\"france\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372409", "to_ids": true, "type": "hostname", "uuid": "30f28983-4f9c-43a9-aeec-1a17b84e63d1", "value": "live.org.mx", "Tag": [ { "colour": "#669ae5", "local": false, "name": "AlreadyExistsError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372433", "to_ids": true, "type": "ip-dst", "uuid": "f9cb7110-4a7e-41b1-963e-77a112cde5fb", "value": "153.92.126.84", "Tag": [ { "colour": "#4eba1f", "local": false, "name": "asn:asn=\"63473\"", "relationship_type": "" }, { "colour": "#f7847f", "local": false, "name": "asn:as-owner=\"HOSTHATCH\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372454", "to_ids": true, "type": "hostname", "uuid": "5e1c6c88-0e4b-4d8b-83ac-1d018efbfb60", "value": "app.slktest.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372475", "to_ids": true, "type": "ip-dst", "uuid": "d9afe8c1-fc60-4b80-a741-e1e8699c70ab", "value": "45.45.217.242", "Tag": [ { "colour": "#4eba1f", "local": false, "name": "asn:asn=\"63473\"", "relationship_type": "" }, { "colour": "#f7847f", "local": false, "name": "asn:as-owner=\"HOSTHATCH\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372496", "to_ids": true, "type": "hostname", "uuid": "af845f55-443b-485e-af86-b137d6289021", "value": "teams.us.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372517", "to_ids": true, "type": "hostname", "uuid": "16c1860a-91f2-4d15-a113-c9cc584893ca", "value": "lives.us.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372538", "to_ids": true, "type": "domain", "uuid": "cb05c237-b75c-402a-81d6-4c4ebd230509", "value": "retesta.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372559", "to_ids": true, "type": "ip-dst", "uuid": "e9f5c720-b1cc-4980-b93c-9b68a3f0d7df", "value": "208.115.220.17", "Tag": [ { "colour": "#04669b", "local": false, "name": "asn:asn=\"46475\"", "relationship_type": "" }, { "colour": "#633002", "local": false, "name": "asn:as-owner=\"LIMESTONENETWORKS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780372581", "to_ids": true, "type": "ip-dst", "uuid": "8fbf616a-abb5-4a15-9a94-4741899b1884", "value": "185.175.59.85", "Tag": [ { "colour": "#4eba1f", "local": false, "name": "asn:asn=\"63473\"", "relationship_type": "" }, { "colour": "#f7847f", "local": false, "name": "asn:as-owner=\"HOSTHATCH\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372602", "uuid": "68eec73a-530f-4332-87cc-7eba280a95bd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372602", "to_ids": true, "type": "md5", "uuid": "17a7d1ad-b046-4e54-89b9-5d03a334664e", "value": "ce9da8845b153c5ba50281304b77969b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370696", "to_ids": true, "type": "sha1", "uuid": "e767fe8e-36a8-4346-91bf-13228b4d62d8", "value": "d068b346169ced2ed677e1d4d75becf84829017f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370696", "to_ids": true, "type": "sha256", "uuid": "29afe15d-3a0b-4004-a7cb-643cc3769c74", "value": "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368555", "to_ids": true, "type": "ssdeep", "uuid": "605a97f6-3129-4eba-b46f-a9e28e0216f9", "value": "48:95UMB7LmcSKTSk0LQKtzd9tK0Io1+BubKJKt3liKluaRDtFKO+EN+h/Fcq:Hmcv+ZvyI8LkDl1MV/aq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368555", "to_ids": false, "type": "size-in-bytes", "uuid": "4caf5323-c62a-4e65-a19e-9a3624cfe1a4", "value": "3250" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368555", "to_ids": true, "type": "filename", "uuid": "a69f5037-08f6-482f-a788-71768f91c62f", "value": "audio-issue-fix.sh" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368555", "to_ids": false, "type": "text", "uuid": "6928931d-86c4-4535-8eba-813f3e1282f8", "value": "Type Description: Shell script\nMicrosoft: None\nVT Total Detection:26/61\nFirst Submission:2026-04-15T15:13:07.000000+00:00\nLast Submission:2026-04-15T15:13:07.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372623", "uuid": "bb56c9a1-336d-49e0-af88-b4b5e9fd50d1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372623", "to_ids": true, "type": "md5", "uuid": "5f54f60a-18a7-4400-8542-b854cab8ef16", "value": "7bd3201946ef8b8a836bc2f951923adc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370697", "to_ids": true, "type": "sha1", "uuid": "a86e49d9-31b4-45cc-863f-942eb7d2cdad", "value": "db077e20e429b93d9b1187cf09869544d83dbe02", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370698", "to_ids": true, "type": "sha256", "uuid": "bec141cf-cc71-4c44-bf72-cfd36f016ae0", "value": "0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368577", "to_ids": true, "type": "ssdeep", "uuid": "c454fc42-cc31-4e59-a388-8012d3e9a301", "value": "49152:yUqZRvEFx7nIhqLg+Eo6+IFVXX/itd64AmqQ235EoqM:yUqZaFxLwqLg+2+IFxigmgEoqM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368577", "to_ids": false, "type": "size-in-bytes", "uuid": "faa2bc4f-9e58-468a-9116-604514e02ee5", "value": "5830370" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780368577", "to_ids": true, "type": "vhash", "uuid": "7586e4dc-8ddc-4c16-bc6d-93f58ec59bbb", "value": "5ec1315c81eda7419ee2cdd7ac6193aa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368577", "to_ids": true, "type": "filename", "uuid": "a254390b-b538-46e0-a0cf-03ee003b418e", "value": "a.out" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368577", "to_ids": false, "type": "text", "uuid": "dceae9a6-4b57-4474-a806-ba46306a0ae4", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/MiniRat.DA!MTB\nVT Total Detection:35/63\nFirst Submission:2026-04-07T22:14:08.000000+00:00\nLast Submission:2026-04-15T04:59:17.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372644", "uuid": "255d4ceb-2fa6-41cb-9d3d-c22b6c7a2076", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372644", "to_ids": true, "type": "md5", "uuid": "b2e21fca-c64a-4807-bb8d-fb6fc918f13e", "value": "860ef29773cf680ed765cb08ac3072cb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370698", "to_ids": true, "type": "sha1", "uuid": "5e321e37-1fe8-410f-9f51-98ef35a037af", "value": "6ca184cb838a989220254ff1914313d774e65712", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370698", "to_ids": true, "type": "sha256", "uuid": "a624a692-8c40-4616-b3ca-7e14c9ce884e", "value": "0b028b781950641818800fee2b4bf68e4ef2bcee53fe71a21755275ba108783d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368599", "to_ids": true, "type": "ssdeep", "uuid": "f05bf5e1-951c-430d-a0c5-ead1532360db", "value": "98304:hBjL6vNoEuahOqzTArIHwZBzR9ulaE4bBF:hRTEphOsdHcylHu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368599", "to_ids": false, "type": "size-in-bytes", "uuid": "1063c57c-894f-45b6-8805-7fb723554ff4", "value": "6252240" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780368599", "to_ids": true, "type": "vhash", "uuid": "b10fa2c2-91c8-4d23-a74a-8872b4e98067", "value": "9867bdb55fb272eb43d498fd977819a9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368599", "to_ids": true, "type": "filename", "uuid": "2ec8b42a-ec31-48fc-8a48-a157efebf994", "value": "0b028b781950641818800fee2b4bf68e4ef2bcee53fe71a21755275ba108783d.macho" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368599", "to_ids": false, "type": "text", "uuid": "ec19b5ec-f0a0-4af4-8fcf-bd35dab83b81", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/MiniRat.DA!MTB\nVT Total Detection:35/63\nFirst Submission:2026-04-07T23:17:49.000000+00:00\nLast Submission:2026-04-15T05:02:11.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372665", "uuid": "12d41338-a31a-4ef7-baf8-f65b984dc626", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372665", "to_ids": true, "type": "md5", "uuid": "381d8bb4-c20f-4fd2-8a53-42172890415a", "value": "3318c614fa7d74b71c81f0e5532cc27e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370709", "to_ids": true, "type": "sha1", "uuid": "6d986f2d-a388-4238-b8ea-e81333202953", "value": "0614fe623f6014bccae634e15e3c883a41aa89ee", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370709", "to_ids": true, "type": "sha256", "uuid": "74c864e2-c938-44ef-ba58-967a64609d41", "value": "a35d2b67fa478a7174e308b43ce30bf69b3bc6f44fa76197fdf95fc2fbc1cf5b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368620", "to_ids": true, "type": "ssdeep", "uuid": "10533410-4f96-4adf-b6f8-f2ddede88139", "value": "49152:aquDOvPckI1//4NDCWN0L+nfvl+r/ys/i9i64AmRS35EliK5:aquDAckI1nIDRN0L+nF+rLiNmOEliK5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368620", "to_ids": false, "type": "size-in-bytes", "uuid": "3e23b6f3-6f99-43af-ba7e-eda81bafe311", "value": "5830322" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780368620", "to_ids": true, "type": "vhash", "uuid": "6746fc95-2fb9-40fb-9a4b-4e60c238931c", "value": "5ec1315c81eda7419ee2cdd7ac6193aa" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368620", "to_ids": true, "type": "filename", "uuid": "899cd66d-8765-43be-a4c9-60e2c5676684", "value": "a.out" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368620", "to_ids": false, "type": "text", "uuid": "8a0c1177-74db-453f-9c98-3c854b4765cf", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/MiniRat.DA!MTB\nVT Total Detection:33/63\nFirst Submission:2026-05-08T08:06:50.000000+00:00\nLast Submission:2026-05-08T08:06:50.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372686", "uuid": "fcc7146e-5e3c-4249-a616-d1ad3bffed6e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372686", "to_ids": true, "type": "md5", "uuid": "81033ce9-f379-4a18-b807-d3fbd491bec5", "value": "425dbed05e53394a719c6e0986a9ce87", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370710", "to_ids": true, "type": "sha1", "uuid": "c8a5ada0-b1e9-4e01-9336-967e2e56c825", "value": "e581b38c6d4e659742839f3025a2add0a7e3fe60", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370710", "to_ids": true, "type": "sha256", "uuid": "8b28e889-1d7a-410d-9f57-2be7ffdc8d09", "value": "9c2ce925133a3bf5a924063bbef8df49918d5b7258695c1894cd18c75970157a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368642", "to_ids": true, "type": "ssdeep", "uuid": "72b9d145-8035-49db-95b6-6c7bc2c2ee95", "value": "48:95UMB7LmcSKTSk0LQKtzd9tK0Io1+BubKJKt3liKluasvFKO+EN+h/Fcq:Hmcv+ZvyI8LkDl1swV/aq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368642", "to_ids": false, "type": "size-in-bytes", "uuid": "150cbf07-1c45-470e-8473-a09aa59bb428", "value": "3258" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368642", "to_ids": false, "type": "text", "uuid": "4ddaa8f7-35b8-448c-89ee-c32abbfc24a4", "value": "Type Description: Shell script\nMicrosoft: None\nVT Total Detection:25/61\nFirst Submission:2026-04-14T18:40:23.000000+00:00\nLast Submission:2026-04-14T18:40:23.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372707", "uuid": "3e79bf64-139c-4110-b09d-77b02e046590", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372707", "to_ids": true, "type": "md5", "uuid": "b4c058cd-e80f-42e2-9ae1-7d16dadec15e", "value": "5fa825564b4ede126005a88ba9efbb54", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370711", "to_ids": true, "type": "sha1", "uuid": "12d1e42b-135c-465f-93ea-76dd60053a42", "value": "2e763321936858b8a566eaadcaf5a7ce064bbad0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370711", "to_ids": true, "type": "sha256", "uuid": "6a0c6c9c-eb7c-4e69-b232-fb97126b93c5", "value": "2a10ffe0367bb1b26ba2c3bc600892c21074725c0b8c9dc9161e6ceb33915460", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368664", "to_ids": true, "type": "ssdeep", "uuid": "b11ccc65-33fe-44b7-af22-17af514ef61d", "value": "12:JMxwKuMPazNpDmvOKu3WDHFUpOKu3W3RIZOKuzXIQOKuT:u2rEMWOr3WjkOr3W3RIZOrzDOrT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368664", "to_ids": false, "type": "size-in-bytes", "uuid": "5aa34c17-bb6a-415f-8bb5-c1138e7279dd", "value": "463" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368664", "to_ids": true, "type": "filename", "uuid": "73bde65c-3523-4f25-9ac1-a5c93352df73", "value": "2a10ffe0367bb1b26ba2c3bc600892c21074725c0b8c9dc9161e6ceb33915460.sh" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368664", "to_ids": false, "type": "text", "uuid": "ced60878-3004-499d-83a2-a78a667353e6", "value": "Type Description: Shell script\nMicrosoft: None\nVT Total Detection:20/62\nFirst Submission:2026-04-07T23:15:17.000000+00:00\nLast Submission:2026-04-07T23:15:17.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372728", "uuid": "ca4aa362-67a1-40fe-92fd-6b70f3faa66b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372728", "to_ids": true, "type": "md5", "uuid": "3fb9d3f6-d105-4425-9089-700d19861360", "value": "863c576f70be9dd7a5d817f4dcd0323f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370712", "to_ids": true, "type": "sha1", "uuid": "bb9f2efe-c2bf-418a-a58e-5804848b9f04", "value": "c12fa4c606f4cb34c65debe1fb81f5e59576bf14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370713", "to_ids": true, "type": "sha256", "uuid": "61f61a74-2e9c-4e1b-b98d-02d30129aac0", "value": "0b1a36a31b952341a534fe24890f1ed2921ee259773cff46e4f6273b8c4d5d21", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368686", "to_ids": true, "type": "ssdeep", "uuid": "c2595f7d-efae-43cf-b826-70043bc49654", "value": "393216:i7Ov3jxaq5GHaRv9T4TFk+yTO9/UlkSaBVa:kVq5G6RvxUe+ka/NSaV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368686", "to_ids": false, "type": "size-in-bytes", "uuid": "8d83852d-de50-4dab-ae73-c66ce9db39a4", "value": "13826720" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780368686", "to_ids": true, "type": "vhash", "uuid": "7445cb3e-45e4-463d-9f5f-4a7bb294e17a", "value": "14c7540f5ed88e1e309ce678d7781bc9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368686", "to_ids": true, "type": "filename", "uuid": "b5cdae5f-3013-4297-8a4a-120ee53e2429", "value": "exec-55554944759bb9a8ca5b9ef3326ce51fac69c1e5" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368686", "to_ids": false, "type": "text", "uuid": "97e81f37-d24b-4348-839b-c729efbb7623", "value": "Type Description: Mach-O\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:7/63\nFirst Submission:2026-04-15T15:18:02.000000+00:00\nLast Submission:2026-04-15T15:18:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372749", "uuid": "58b74ed3-0913-4c82-ac04-88a6f217425c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372749", "to_ids": true, "type": "md5", "uuid": "789f896b-5798-4ed2-b833-3cdda225f37e", "value": "d4477df4b05a1778579df133d115fd2f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370714", "to_ids": true, "type": "sha1", "uuid": "4d207ed4-8c16-4896-bb8f-aa12d1b86dfd", "value": "a1ecd906dec4191666f09d59478ceb39cbf15fbb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370714", "to_ids": true, "type": "sha256", "uuid": "5c3570de-d4fe-4d5b-a1a5-2fb916e4be14", "value": "3e3901519c2305fbe9d5483b7234c25c6d2b562512916481d96f26b849c39fdb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368708", "to_ids": true, "type": "ssdeep", "uuid": "50dd09cb-5307-4008-8258-3cf84fbd3f84", "value": "196608:0LuN1/+a55t4GZ6eqTv62kTzSJ4qiuXF7GnaPvX/VeJuXcImPtz2xyZ1MACv4Cd1:zN1vt4VXTG4Hia/PvtmZ5tzCxNdqymd" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368708", "to_ids": false, "type": "size-in-bytes", "uuid": "37880219-1f13-43b8-9ef7-e7628f3a8840", "value": "15166752" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780368708", "to_ids": true, "type": "vhash", "uuid": "367566a2-5223-4ac8-bf60-c10e685395e4", "value": "25269e0a909cea20c0e64087ca64dc22" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368708", "to_ids": true, "type": "filename", "uuid": "de731016-a239-4457-a9e8-6466f0ebf256", "value": "rat-5555494484120d47f88d39cd9b03064d7cd73ca8" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368708", "to_ids": false, "type": "text", "uuid": "bdf6451b-406e-4ba1-960e-d1c78d0729c6", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nVT Total Detection:12/63\nFirst Submission:2026-01-31T17:21:10.000000+00:00\nLast Submission:2026-01-31T17:21:10.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372771", "uuid": "7c84a709-1f66-4138-b1fc-8e8c4dec276f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372771", "to_ids": true, "type": "md5", "uuid": "e0a3f4c0-e6ed-4c8c-b853-9b92d464e922", "value": "886478774149b61bb7a8d3c7699a3fa8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370715", "to_ids": true, "type": "sha1", "uuid": "3fafb069-9ee2-40bf-878c-f98c36bd9cbe", "value": "7e5f2e54b178ec5cb4d9f2adb23181a1a659ce5d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370715", "to_ids": true, "type": "sha256", "uuid": "681800d4-7f95-48c2-a105-848142bc9e19", "value": "402625ec79e3573a80b6de9b33fc1e503e3c7803603cd958ddd515fb0549007c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368729", "to_ids": true, "type": "ssdeep", "uuid": "1ddb3006-b363-4d37-8a1e-d9d6426e9a44", "value": "48:95UMB7LmcSKTSk0LQKtzd9tK0Io1+BubKJKt3liKluasVFKO+EN+h/Fcq:Hmcv+ZvyI8LkDl1sOV/aq" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368729", "to_ids": false, "type": "size-in-bytes", "uuid": "873c18a2-36f4-4cb0-91a0-1672c2eed4f4", "value": "3258" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368729", "to_ids": true, "type": "filename", "uuid": "c89dc8ec-88e0-4ce7-933f-86abc8883b2e", "value": "lzi6wbn.exe" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368729", "to_ids": false, "type": "text", "uuid": "25750cce-1d8b-4d86-a888-4bd7cea0c1b9", "value": "Type Description: Shell script\nMicrosoft: None\nVT Total Detection:28/61\nFirst Submission:2026-04-16T19:45:17.000000+00:00\nLast Submission:2026-04-16T19:45:17.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372792", "uuid": "05bf8712-fd76-44e6-8a1e-f02f5a923490", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372792", "to_ids": true, "type": "md5", "uuid": "d7f048bc-d53e-4280-8ada-0642243bec58", "value": "98f9101bdd25da3a54da1891ae57f3dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370717", "to_ids": true, "type": "sha1", "uuid": "00db46d4-a0cd-4628-8367-2c1f53594d36", "value": "891538df76d7525375d68f445685e93873281c32", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370717", "to_ids": true, "type": "sha256", "uuid": "adc598de-ca15-46ad-89c1-0e31b60635d6", "value": "65cba741fe30fa4799fb9002ea8de6d96042a59159dd7c3419c766af24c835e6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368751", "to_ids": true, "type": "ssdeep", "uuid": "7b8dde54-d704-4a7c-8361-143f48470ea0", "value": "196608:aEbWhiE80pZnL5CH3OiPZqbAKkcWFU8ZwTSLzZoHHbRMiDe3FBO9WNyxjpTFbm:RWh/pxL5khsPklFYWLz+rUBO9fxlx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368751", "to_ids": false, "type": "size-in-bytes", "uuid": "cfc8c78f-9b6d-455a-b2bd-64df94471ba9", "value": "12284992" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780368751", "to_ids": true, "type": "vhash", "uuid": "7beb2515-517b-478b-b62c-7062f65e233e", "value": "77485f0907917337a72c6267d5d3f79b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368751", "to_ids": true, "type": "filename", "uuid": "638fbd27-0789-476e-99e9-ccc8e4b46d51", "value": "exec-55554944eaaa5bc7b7d4d781ac6f58160acc5800" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368751", "to_ids": false, "type": "text", "uuid": "c2b597fd-0d4d-44dd-a283-5b814f759c26", "value": "Type Description: Mach-O\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:20/63\nFirst Submission:2026-04-14T18:38:18.000000+00:00\nLast Submission:2026-04-14T18:38:18.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372813", "uuid": "b3a88f82-f754-4724-a357-23c1cd7cd5aa", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372813", "to_ids": true, "type": "md5", "uuid": "22c5ce99-763b-4a98-b361-f621b6b67e86", "value": "72e594ead2413c093ef5b538f6d453aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370718", "to_ids": true, "type": "sha1", "uuid": "3d42beb4-f8cc-418f-aab6-4b6ee6048c60", "value": "634f4f6a10b76ea5699914cb8b1b65f272a5740e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370718", "to_ids": true, "type": "sha256", "uuid": "9329e0ab-97ba-4f25-8c2b-2a7eac638968", "value": "c6ef82d2864dfd26f117a1ef5602679153423f2742970a7949cec72722f0a01e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368772", "to_ids": true, "type": "ssdeep", "uuid": "fd301f61-1935-4b9e-a6d2-613a6f10323f", "value": "12:JMx5KuMPnNlDn4OKu3WDHV4OKu3W3R0OKuEXIQOKuT:u7rEj8Or3WjV4Or3W3R0OrEDOrT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368772", "to_ids": false, "type": "size-in-bytes", "uuid": "9a0b56d8-aa07-4631-aa82-17ee8f944bce", "value": "450" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368772", "to_ids": true, "type": "filename", "uuid": "fb850191-6f80-4a84-a8c3-e3dabb4707de", "value": "install.sh" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368772", "to_ids": false, "type": "text", "uuid": "7fe1db4c-79d0-4601-ba0f-72f9c6680f22", "value": "Type Description: Shell script\nMicrosoft: None\nVT Total Detection:22/61\nFirst Submission:2026-04-08T08:30:31.000000+00:00\nLast Submission:2026-04-08T08:30:31.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372834", "uuid": "501de4c1-8aa5-431d-bc3a-2290ff75c64e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372834", "to_ids": true, "type": "md5", "uuid": "392699a2-44bf-4765-bbb5-1a27a22f4eea", "value": "7508f1015bd4cf42e35ff7a94d4e3108", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370719", "to_ids": true, "type": "sha1", "uuid": "7d72da11-f15d-48b7-9461-ba266ebc5e72", "value": "be32e42b2b77a89c6434ca44dc7ceee113d3ebe8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370719", "to_ids": true, "type": "sha256", "uuid": "5d64a059-37f4-4e9d-8e39-157736f16764", "value": "d4e863f9818bfb2f1dd932df6441dff204e6142c3bdb55b298cb08dc7b6a0c62", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368794", "to_ids": true, "type": "ssdeep", "uuid": "4157b7c1-c973-41f5-afd6-549056ea8505", "value": "12:qGGY80APvn+YS3l7Dn5VZzGfnQej5VZzGfDqoyEIONt:qGGPkV7M9oD5t" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368794", "to_ids": false, "type": "size-in-bytes", "uuid": "e3bbe462-d447-4675-98c5-5ce2bc5e672b", "value": "698" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 02/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368794", "to_ids": false, "type": "text", "uuid": "1869b4fc-9623-42fa-834d-01eb9572e774", "value": "Type Description: Shell script\nMicrosoft: None\nVT Total Detection:25/61\nFirst Submission:2026-04-08T13:29:46.000000+00:00\nLast Submission:2026-04-08T13:29:46.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780372855", "uuid": "1c0f218e-147e-4494-940f-f4e721b4f8f4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780372855", "to_ids": true, "type": "md5", "uuid": "f2b369c2-26bc-46e0-9655-9e0077b24dae", "value": "0a3a9221e91bb978f79cfc1d55deadff", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780370720", "to_ids": true, "type": "sha1", "uuid": "f9698061-f843-40b7-9410-4da75b9fa54f", "value": "dd9097187cfc5c1e280cb1244a50c029a51c0bad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780370720", "to_ids": true, "type": "sha256", "uuid": "d0244451-9ded-4503-90ae-af40a0fc6009", "value": "e8ee6f5145c9d503c5130bfc6585567f6e19d409158c3c0ca0b259f1875b15f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780368816", "to_ids": true, "type": "ssdeep", "uuid": "c25649db-702b-467f-996e-01713a796a39", "value": "196608:NbWhiElCWO/yZABGBdLIQZ6edyoD+O5SfMBZnz2xyZ1/OQWdyxMnzmdmdpTFbA:FWhhCZBGBS8dKEvzxOQHxMCdmrx" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780368816", "to_ids": false, "type": "size-in-bytes", "uuid": "ee4afd0d-050f-4fa9-b92a-82d5a05d68b1", "value": "14446432" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780368816", "to_ids": true, "type": "vhash", "uuid": "6b75b4d2-f1dc-4141-af4a-0071a41aab0e", "value": "77485f0907917337a72c6267d5d3f79b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780368816", "to_ids": true, "type": "filename", "uuid": "26b4386a-db68-467f-aca4-ef385b198965", "value": "rat-555549446c52c3de266d838932c817f9068efd01" }, { "category": "Other", "comment": "Checked: 02/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780368816", "to_ids": false, "type": "text", "uuid": "49920ca5-8fcf-4546-9e6c-b3e012ee6b6f", "value": "Type Description: Mach-O\nMicrosoft: Trojan:Win32/Malgent\nVT Total Detection:20/63\nFirst Submission:2026-01-31T17:20:53.000000+00:00\nLast Submission:2026-02-09T09:49:33.000000+00:00" } ] } ] } }