{ "Event": { "analysis": "1", "date": "2026-07-02", "extends_uuid": "", "info": "[Threat Intel] PamStealer: a Rust-based macOS infostealer that validates credentials through PAM", "protected": false, "publish_timestamp": "1784200132", "published": true, "threat_level_id": "3", "timestamp": "1784200132", "uuid": "97cf8884-7330-4590-9cfe-a58b17a8e1ac", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"macOS\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783076431", "to_ids": false, "type": "link", "uuid": "9a33e1a3-b4e4-4bb8-911c-b35ec1d1b789", "value": "https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/", "Tag": [ { "colour": "#6b003a", "local": true, "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783076431", "to_ids": false, "type": "text", "uuid": "5fb18437-96e0-4489-b006-9694275e650f", "value": "PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands. The second stage is a Rust-based Mach-O binary that validates stolen credentials through PAM before harvesting, reads browser databases directly using bundled SQLite, captures clipboard contents repeatedly via pbpaste, and exfiltrates encrypted data using ChaCha20-Poly1305. It establishes persistence through both modern and legacy login item APIs, masquerades as Finder or System Settings, and tricks victims into granting Full Disk Access through counterfeit alerts. The stealer contacts Ethereum RPC endpoints and employs region-based exclusions targeting Apple silicon systems while avoiding Commonwealth of Independent States countries." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783076431", "to_ids": false, "type": "text", "uuid": "041e605e-e2ad-407d-86f2-2981232491b3", "value": "Name: PamStealer: a Rust-based macOS infostealer that validates credentials through PAM\nAuthor: AlienVault\nAdversary: \nTags: [\"clipboard stealer\", \"applescript dropper\", \"fake maccy\", \"pam authentication\", \"jxa downloader\", \"browser data theft\", \"pamstealer\", \"rust-based\", \"macos infostealer\", \"credential theft\"]\nTgtd countries: []\nMlwr families: [\"PamStealer\"]\nAttack_ids: []\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157159", "to_ids": true, "type": "domain", "uuid": "9acda217-fec5-416d-a138-be2e15121b8e", "value": "avenger-sync.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157182", "to_ids": true, "type": "hostname", "uuid": "ed6ec6dd-11ee-467d-a629-6eb7222530a4", "value": "api.sync-master.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 16/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784154181", "to_ids": true, "type": "sha256", "uuid": "3589425b-00bf-4c83-9444-c0bd2fec0cc0", "value": "ca7f5c0668f1a871523d485e42884c3b98910117d7ca17c8b3c3b3744a936e0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157203", "to_ids": true, "type": "url", "uuid": "c9f85437-ec43-4824-ae5b-e932eb8aa1fe", "value": "http://api.live-updates.online/v1", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157224", "to_ids": true, "type": "url", "uuid": "5ca44a66-931e-458a-9068-0761e72f7fef", "value": "http://api.live-updates.online/v2", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157245", "to_ids": true, "type": "url", "uuid": "5988e926-6ae3-4609-b672-e3e319816de1", "value": "http://api.sync-master.online/v1", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157266", "to_ids": true, "type": "url", "uuid": "8ab02311-677c-4d37-a265-7072c4668c52", "value": "http://api.sync-master.online/v3", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157287", "to_ids": true, "type": "url", "uuid": "ba62680d-83f0-4ebb-a1ac-a2a72f978af6", "value": "http://avenger-sync.live/api/sync", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157309", "to_ids": true, "type": "url", "uuid": "720777ee-d861-4f8b-98a2-36f2a1a962e5", "value": "https://api.live-updates.online/v1", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157330", "to_ids": true, "type": "url", "uuid": "a347d72a-55c0-4b42-9f6b-969e0ee0d0a7", "value": "https://api.live-updates.online/v2", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157352", "to_ids": true, "type": "url", "uuid": "ee881f61-5530-4c67-a2c4-8b834e8dbaa8", "value": "https://api.sync-master.online/v1", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157373", "to_ids": true, "type": "url", "uuid": "39765764-ee56-4b05-8e6a-942081510c66", "value": "https://api.sync-master.online/v3", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157394", "to_ids": true, "type": "url", "uuid": "f90ff5ac-3640-4af8-9ce8-70faf23aa1ba", "value": "https://avenger-sync.live/api/sync", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157415", "to_ids": true, "type": "url", "uuid": "ba881d69-25be-4a87-8d11-56432771489c", "value": "https://maccyapp.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157436", "to_ids": true, "type": "domain", "uuid": "e6587304-8c06-4b8c-9f2f-928e80e8ed0e", "value": "maccyapp.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157457", "to_ids": true, "type": "hostname", "uuid": "b67cda57-d2fa-4328-8b31-f71426a4385d", "value": "api.live-updates.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157479", "to_ids": true, "type": "domain", "uuid": "e3986b52-3428-4fa6-8dec-378132ec223e", "value": "maccy.app", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157500", "to_ids": true, "type": "url", "uuid": "07da6593-b271-4606-b5dc-003f557e95c1", "value": "api.sync-master.online/v1", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157521", "to_ids": true, "type": "url", "uuid": "39c35e38-bdcd-4a4c-a22d-4b5cc657f989", "value": "com.apple.finder.core/Finder.app/Contents/MacOS/77617EA0", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157542", "to_ids": true, "type": "url", "uuid": "81a5313f-d771-4390-8c30-06d7f9295870", "value": "com.apple.finder.core/Finder.app", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157563", "to_ids": true, "type": "url", "uuid": "a1aecff2-d268-4e02-a390-5e2b476bcc34", "value": "api.live-updates.online/v2", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157583", "to_ids": true, "type": "url", "uuid": "5f4843b3-ec56-41b6-9e85-52f317ed5a0e", "value": "com.apple.finder.monitor/Finder.app/Contents/MacOS/F8C06C86", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157604", "to_ids": true, "type": "url", "uuid": "238fdbe2-4c5b-4c42-a866-5a08eddb50bb", "value": "avngr.netlify.app/api", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157625", "to_ids": true, "type": "url", "uuid": "c164cac7-6b46-409e-9283-1e7baa03b5af", "value": "com.apple.softwareupdated/SoftwareUpdateD", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157646", "to_ids": true, "type": "url", "uuid": "e74bfac1-9fa1-42dc-8102-7c0961ffb9dc", "value": "api.sync-master.online/v3", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157668", "to_ids": true, "type": "url", "uuid": "cb4f98ea-ef2f-4f8c-a93f-b9ca40f5e69d", "value": "com.apple.security.daemon/Software", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157690", "to_ids": true, "type": "url", "uuid": "4807da6c-b2d9-4500-86b7-834f105a109e", "value": "Update.app/Contents/MacOS/B34C4B75", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157710", "to_ids": true, "type": "url", "uuid": "59483aa1-9562-4c45-b2b4-fce401e1d647", "value": "api.live-updates.online/v1", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157732", "to_ids": true, "type": "url", "uuid": "105d5493-4791-46b3-8f69-3614f4b5cf04", "value": "https://avngr.netlify.app/api", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784157753", "to_ids": true, "type": "url", "uuid": "ba4d246f-e9c4-44fb-bfd6-e5924fc3567a", "value": "avenger-sync.live/api/sync", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157774", "uuid": "71958cdd-530f-4990-b395-c05de85980ef", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "object_relation": "md5", "timestamp": "1784157774", "to_ids": true, "type": "md5", "uuid": "0755414e-944c-44ac-9063-1c3aab4e17d1", "value": "bae0005a0bf0d467a672600833eeed92", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "object_relation": "sha1", "timestamp": "1784154169", "to_ids": true, "type": "sha1", "uuid": "495a1d20-47cc-410c-a172-b6c7cde86eef", "value": "e291f991d4bd616203b291a36121dc8b0c15f509", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "object_relation": "sha256", "timestamp": "1784154169", "to_ids": true, "type": "sha256", "uuid": "6345f298-420f-444c-b464-117e6e14257d", "value": "36d46ac7123e0cef04f179d88e590891c7e7c64ec5a77df4512cb485e40286da", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "object_relation": "text", "timestamp": "1784153705", "to_ids": false, "type": "text", "uuid": "59873333-4c90-45aa-ae8a-6b9434a1c63a", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 23/74\nFirst Seen In The Wild: 2026-07-06T16:04:49+00:00\nFirst Submission: 2026-06-29T23:58:20+00:00\nLast Submission: 2026-07-01T14:57:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "object_relation": "ssdeep", "timestamp": "1784153705", "to_ids": true, "type": "ssdeep", "uuid": "95ebf8be-20ff-4ebc-940f-758ec68fc4f6", "value": "6144:lOmVyRe8g3bTTpKywFg+AeiToXmfTivCq+vWhPV7MMLTgtbTTVXB34:lGe8glKgTQmfUsvWxg94" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153705", "to_ids": false, "type": "size-in-bytes", "uuid": "bf671274-9088-4d83-9997-5f82452c689d", "value": "310024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "object_relation": "vhash", "timestamp": "1784153705", "to_ids": true, "type": "vhash", "uuid": "71c144fd-2c76-4eac-b255-1c5aaad32762", "value": "7a9b4e702ff083a5f5ef27c912d2f5f5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-29T23:58:20+00:00", "last_seen": "2026-07-01T14:57:51+00:00", "object_relation": "filename", "timestamp": "1784153705", "to_ids": true, "type": "filename", "uuid": "8da0d470-3114-4366-9a3a-2d43855dcac0", "value": "Maccy.dmg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157795", "uuid": "2d71f774-966e-4cf9-8722-d5da49e3aab0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "object_relation": "md5", "timestamp": "1784157795", "to_ids": true, "type": "md5", "uuid": "d1086b7a-315d-445e-bdce-a4b2a84aad61", "value": "65ddfaf0b2b012392eb14cede6649a60", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "object_relation": "sha1", "timestamp": "1784154170", "to_ids": true, "type": "sha1", "uuid": "44593548-7a12-4f91-a80d-dc6733fdff98", "value": "95bf914caed674d7db6600b9750af2b6c6ae0dfb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "object_relation": "sha256", "timestamp": "1784154170", "to_ids": true, "type": "sha256", "uuid": "b89879e9-ce30-486e-a78f-a831aafb3194", "value": "06fdd1d97df1105c542ddb881d751b659d555b5522c266f6364dae9f350fcfd0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 13/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "object_relation": "text", "timestamp": "1784153726", "to_ids": false, "type": "text", "uuid": "4fea46ab-4cfe-4cc1-90f7-0d7379dded00", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-07-02T13:50:31+00:00\nLast Submission: 2026-07-02T13:52:26+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "object_relation": "ssdeep", "timestamp": "1784153726", "to_ids": true, "type": "ssdeep", "uuid": "818ed158-25de-4439-957f-2d508f1172d7", "value": "24576:GUCIJuKeGNwTS9TRtIWOhVbbap/nzJU/Sk3KvX65gDpx8:1teGNZtIWOhVnEfzJ63Kvq5gDpx8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153726", "to_ids": false, "type": "size-in-bytes", "uuid": "26cba6fb-2ded-4981-a663-a79131c92d99", "value": "942880" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "object_relation": "vhash", "timestamp": "1784153726", "to_ids": true, "type": "vhash", "uuid": "4480ec0e-31c3-4616-9e92-bc59db67c46c", "value": "9f10572adc57c413ab0ac77d5bf7c685" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T13:50:31+00:00", "last_seen": "2026-07-02T13:52:26+00:00", "object_relation": "filename", "timestamp": "1784153726", "to_ids": true, "type": "filename", "uuid": "03b2b444-63fc-4421-a0bb-d000ba978994", "value": "avenger_agent-bacc7f3ef1dfcbdb" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157816", "uuid": "281fb1a9-e32a-4463-9ffe-edb267c109bb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "object_relation": "md5", "timestamp": "1784157816", "to_ids": true, "type": "md5", "uuid": "f19c1361-98a3-47fb-9338-b50409550b21", "value": "838a584b298e8670f70607c6001bc8d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "object_relation": "sha1", "timestamp": "1784154171", "to_ids": true, "type": "sha1", "uuid": "0bef4002-42a3-4f9d-a610-d99e06012a0f", "value": "d2978ffbfd1cc320e19f6c4fa636b814a0ada9cd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "object_relation": "sha256", "timestamp": "1784154171", "to_ids": true, "type": "sha256", "uuid": "a36798ff-2cc6-478a-94a9-e73c31853313", "value": "2b512f6c393edad89a89ecafe26cd23b71cfdd271c10522f8dba98997ebf39bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "object_relation": "text", "timestamp": "1784153748", "to_ids": false, "type": "text", "uuid": "7e7bd04d-ece9-4e86-b688-99984a2328ec", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 25/74\nFirst Seen In The Wild: 2026-07-06T16:04:49+00:00\nFirst Submission: 2026-06-03T11:00:18+00:00\nLast Submission: 2026-06-30T20:13:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "object_relation": "ssdeep", "timestamp": "1784153748", "to_ids": true, "type": "ssdeep", "uuid": "b1ffa07d-fa33-4e56-ae24-3c5349a97fe1", "value": "6144:rOmVyRe8g3bTTpKywFg+AeiToXmfT5rw+3ON+Tg3bTFeMLTg3lTTVXLj:rGe8glKgTQmfGiONYg97gXj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153748", "to_ids": false, "type": "size-in-bytes", "uuid": "cf5afdeb-da85-4ec9-9220-a6c201c8ff3c", "value": "307332" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "object_relation": "vhash", "timestamp": "1784153748", "to_ids": true, "type": "vhash", "uuid": "6225985d-879c-45af-9d01-9638a160b02d", "value": "ee35ffc7b9bc3d989b14350109e9ef98" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T11:00:18+00:00", "last_seen": "2026-06-30T20:13:19+00:00", "object_relation": "filename", "timestamp": "1784153748", "to_ids": true, "type": "filename", "uuid": "23975f58-6d7b-4630-ad07-f1bf076ec56c", "value": "838a584b298e8670f70607c6001bc8d9___1b19c7e4-de90-496a-bafb-2acd82318c89.dmg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157837", "uuid": "bb42e1ea-fa65-4181-8c13-decda3e1e785", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "object_relation": "md5", "timestamp": "1784157837", "to_ids": true, "type": "md5", "uuid": "0a7d0691-ac80-4aee-af44-2d43da74c72f", "value": "498ae52519092e2a89ec409abd909898", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "object_relation": "sha1", "timestamp": "1784154172", "to_ids": true, "type": "sha1", "uuid": "6a4e8144-511d-4983-ac0a-b9dc60acda7b", "value": "6a2ce8c6ea56bf8dc3f7d6125bc47c5b0a22accf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "object_relation": "sha256", "timestamp": "1784154172", "to_ids": true, "type": "sha256", "uuid": "67a2f5d9-48f5-42bf-b7c6-81ef03c7ca87", "value": "60df952153696d46a09774e44ca602393c6829f9e2c2ec4f95d571f9846242a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 13/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "object_relation": "text", "timestamp": "1784153769", "to_ids": false, "type": "text", "uuid": "e6479a71-dd68-475f-98f3-954d8d4d930d", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-06-02T18:10:16+00:00\nLast Submission: 2026-06-02T18:10:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "object_relation": "ssdeep", "timestamp": "1784153769", "to_ids": true, "type": "ssdeep", "uuid": "6a041ef4-854c-46fa-bde8-21c9d6d5a88f", "value": "6144:wOmVyRe8g3bTTpKywFg+AeiToXmfTzrCO9UTg3bTD11MLTg3PTTVXv+2:wGe8glKgTQmfb/qgpqgx+2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153769", "to_ids": false, "type": "size-in-bytes", "uuid": "78c0716f-b89f-4e7e-9d6b-a0d7d1ae8609", "value": "307510" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "object_relation": "vhash", "timestamp": "1784153769", "to_ids": true, "type": "vhash", "uuid": "345554fb-b653-4fca-a795-5a9c1d6860a6", "value": "ee35ffc7b9bc3d989b14350109e9ef98" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T18:10:16+00:00", "last_seen": "2026-06-02T18:10:16+00:00", "object_relation": "filename", "timestamp": "1784153769", "to_ids": true, "type": "filename", "uuid": "153344a6-dd45-43ae-8781-2dd874cf3233", "value": "Maccy.dmg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157859", "uuid": "ac8999af-9941-405e-8af8-ba1599310e58", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "object_relation": "md5", "timestamp": "1784157859", "to_ids": true, "type": "md5", "uuid": "00b8e9a3-89f0-4253-9a51-8524bba0ab18", "value": "7dcd21e8d95e741f161d559b5db61323", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "object_relation": "sha1", "timestamp": "1784154174", "to_ids": true, "type": "sha1", "uuid": "2181b05a-c867-47c7-904b-57ac66c5fe37", "value": "9c614046af9ba4b6b08439b5aa382b1ba9d4ac6b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "object_relation": "sha256", "timestamp": "1784154174", "to_ids": true, "type": "sha256", "uuid": "fd75954a-cd3c-427f-9e79-7b8b10a01987", "value": "96c8ad78f6ccdf83d3dcabfd33ba563f7995f7237fe825de1eefd340821abdf3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 13/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "object_relation": "text", "timestamp": "1784153790", "to_ids": false, "type": "text", "uuid": "6af6b5dd-97db-4d56-8d52-e52586a19c58", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2026-06-26T06:07:27+00:00\nLast Submission: 2026-06-26T09:33:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "object_relation": "ssdeep", "timestamp": "1784153790", "to_ids": true, "type": "ssdeep", "uuid": "f6c9cf1b-636f-4a09-84c6-24aded14c148", "value": "6144:5OmVyRe8g3bTTpKywFg+AeiToXmfTOe/gG1ZIGHRKsbuMMLTgDbTTVXA42:5Ge8glKgTQmfae/g2Z94gu42" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153790", "to_ids": false, "type": "size-in-bytes", "uuid": "1a01bf81-d2c8-483f-9864-af3d7428d5bc", "value": "309966" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "object_relation": "vhash", "timestamp": "1784153790", "to_ids": true, "type": "vhash", "uuid": "73b12cb3-c554-4f37-a948-7f67da4a7fc5", "value": "7a9b4e702ff083a5f5ef27c912d2f5f5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-26T06:07:27+00:00", "last_seen": "2026-06-26T09:33:31+00:00", "object_relation": "filename", "timestamp": "1784153790", "to_ids": true, "type": "filename", "uuid": "52b355bb-68bc-4289-aacd-1a4a18acc088", "value": "Maccy1.dmg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157881", "uuid": "e92a6912-fe52-411a-995f-39e58bfcc2ee", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "object_relation": "md5", "timestamp": "1784157881", "to_ids": true, "type": "md5", "uuid": "5e64825d-b414-49c3-84de-c7a015a32f3b", "value": "6184909e67e57d5a44680121090d6ed7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "object_relation": "sha1", "timestamp": "1784154175", "to_ids": true, "type": "sha1", "uuid": "c0d43068-b702-494c-92ba-8d36bb5eb248", "value": "ada806d5dadd023f71967767cf2860a484a850d0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "object_relation": "sha256", "timestamp": "1784154175", "to_ids": true, "type": "sha256", "uuid": "ae8f5ee8-7b99-4558-b802-724e5a53abc2", "value": "ab3a14096851cc18a253c1cd1c25df74f2cf23eb29051784ce47f9fc318f0f22", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 09/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "object_relation": "text", "timestamp": "1784153812", "to_ids": false, "type": "text", "uuid": "dbc8f953-6c06-4e0b-b795-003252f02aa7", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 25/73\nFirst Seen In The Wild: 2026-06-01T06:53:41+00:00\nFirst Submission: 2026-05-18T21:10:19+00:00\nLast Submission: 2026-07-08T07:20:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "object_relation": "ssdeep", "timestamp": "1784153812", "to_ids": true, "type": "ssdeep", "uuid": "ad10e52c-3ae9-405f-bfbb-7866d36ae08e", "value": "6144:0OmVyRe8g3bTTpKywFg+AeiToXmfTvkTyQYiUFxtTg3bTSFUWDSTTVX5v:0Ge8glKgTQmfrkTyESfgnWDGv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153812", "to_ids": false, "type": "size-in-bytes", "uuid": "cf6349d5-9c94-477a-b608-8d367d6ea4dc", "value": "305888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "object_relation": "vhash", "timestamp": "1784153812", "to_ids": true, "type": "vhash", "uuid": "715a7fd9-f141-41d0-bbd6-c70d5ad47430", "value": "ee35ffc7b9bc3d989b14350109e9ef98" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-18T21:10:19+00:00", "last_seen": "2026-07-08T07:20:02+00:00", "object_relation": "filename", "timestamp": "1784153812", "to_ids": true, "type": "filename", "uuid": "c7a87865-e6aa-4b7a-9e0f-d169e033a354", "value": "Maccy.dmg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157902", "uuid": "d63c814d-2acc-46b2-9b0e-fb049ca4c682", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "object_relation": "md5", "timestamp": "1784157902", "to_ids": true, "type": "md5", "uuid": "241f8667-6ad6-4791-8fb5-f2f884d56174", "value": "2af0eef9642a9fcb3629171b46287e82", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "object_relation": "sha1", "timestamp": "1784154176", "to_ids": true, "type": "sha1", "uuid": "94004c30-a5cc-4945-ae22-12183ce28fad", "value": "ac4eff497d0a70f8279f569cde07d04621672bb8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "object_relation": "sha256", "timestamp": "1784154176", "to_ids": true, "type": "sha256", "uuid": "2a1d1e45-a206-4624-b1c6-852e04d5f82a", "value": "bb01f3c36110d2cc31ae51c4ff2f17be19bea625755b5339680431fab98616df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 11/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "object_relation": "text", "timestamp": "1784153833", "to_ids": false, "type": "text", "uuid": "3aa2a419-d61f-43d1-98d4-fe0bce1a4740", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-06-07T06:03:16+00:00\nLast Submission: 2026-06-07T06:03:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "object_relation": "ssdeep", "timestamp": "1784153833", "to_ids": true, "type": "ssdeep", "uuid": "3df0ad31-42e4-4a16-89e2-8d01b6c204e0", "value": "6144:SOmVyRe8g3bTTpKywFg+AeiToXmfTRchlqiO6Tg3bTN19MLTg3NTTVXwv:SGe8glKgTQmflgqiOsgXygMv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153833", "to_ids": false, "type": "size-in-bytes", "uuid": "6c09b7e3-97c6-4863-a7ef-677628d7c143", "value": "307498" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "object_relation": "vhash", "timestamp": "1784153833", "to_ids": true, "type": "vhash", "uuid": "7b9c1a0c-3c55-435f-a87c-21ea7e327b4e", "value": "ee35ffc7b9bc3d989b14350109e9ef98" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T06:03:16+00:00", "last_seen": "2026-06-07T06:03:16+00:00", "object_relation": "filename", "timestamp": "1784153833", "to_ids": true, "type": "filename", "uuid": "444a8c44-1696-458a-b882-32883000866a", "value": "Maccy.dmg" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157923", "uuid": "0d3ec916-4a40-46f1-8dbb-1f06d35df2ec", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "object_relation": "md5", "timestamp": "1784157923", "to_ids": true, "type": "md5", "uuid": "11e2231b-af57-4774-a274-f74411104ac4", "value": "d67b1aff165b8cadca8dc30732c79bca", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "object_relation": "sha1", "timestamp": "1784154178", "to_ids": true, "type": "sha1", "uuid": "21b8d924-7549-474c-b691-49111db7950f", "value": "3c49b4872c5c01891fb0263990d4d8083f2a0bf5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "object_relation": "sha256", "timestamp": "1784154178", "to_ids": true, "type": "sha256", "uuid": "6210566b-442f-4d61-9ffb-980345394d05", "value": "e8b18c420669deb8fc6f69e74146e499057c3c77436ac6ca54af37befa9ddaa5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 08/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "object_relation": "text", "timestamp": "1784153876", "to_ids": false, "type": "text", "uuid": "ab9894d4-f382-4ed4-92c0-05b1b69d61ab", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 20/73\nFirst Submission: 2026-06-23T17:16:14+00:00\nLast Submission: 2026-07-08T07:17:06+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "object_relation": "ssdeep", "timestamp": "1784153876", "to_ids": true, "type": "ssdeep", "uuid": "99d99d9a-2038-4cf3-be67-32a9b23e85a2", "value": "6144:eOmVyRe8g3bTTpKywFg+AeiToXmfTTcZWyKtzqD2xMMLTgNbTTVXD4:eGe8glKgTQmfSWxGqg/4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153876", "to_ids": false, "type": "size-in-bytes", "uuid": "680ee86c-2fe4-49ee-8eea-35fe4874a4df", "value": "310659" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "object_relation": "vhash", "timestamp": "1784153876", "to_ids": true, "type": "vhash", "uuid": "d00638c0-7424-4158-8d21-6dfd94bc1780", "value": "7a9b4e702ff083a5f5ef27c912d2f5f5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-23T17:16:14+00:00", "last_seen": "2026-07-08T07:17:06+00:00", "object_relation": "filename", "timestamp": "1784153876", "to_ids": true, "type": "filename", "uuid": "927bb70a-7cbb-4a38-8e43-b555aeb91299", "value": "e8b18c420669deb8fc6f69e74146e499057c3c77436ac6ca54af37befa9ddaa5.dmg.sample" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157944", "uuid": "ff7bb2e6-8bbc-4460-a911-b1eecca8d234", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "object_relation": "md5", "timestamp": "1784157944", "to_ids": true, "type": "md5", "uuid": "fc0b9200-69a5-4120-a1d9-a06bd7703d26", "value": "27eb0122cccb09f5cce00176b2a6b7c9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "object_relation": "sha1", "timestamp": "1784154179", "to_ids": true, "type": "sha1", "uuid": "f23ded56-8e7a-4769-ac3c-d0a9fd033016", "value": "7304e620322c42528275f409329f2bc79e1f1ceb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "object_relation": "sha256", "timestamp": "1784154179", "to_ids": true, "type": "sha256", "uuid": "47e8420e-dcd3-461c-b140-72f54bfa4694", "value": "f48b69e4b7fb4d53de25b4c9be8e8dbe0999c10d5306e01aa08e1761fc3dedbe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "object_relation": "text", "timestamp": "1784153897", "to_ids": false, "type": "text", "uuid": "fe15595c-0924-4270-8902-0f89f9a83989", "value": "Type Description: Mach-O\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-07-02T13:53:02+00:00\nLast Submission: 2026-07-02T13:53:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "object_relation": "ssdeep", "timestamp": "1784153897", "to_ids": true, "type": "ssdeep", "uuid": "3d81f468-2980-421e-b9d1-9f5d1ed87ac7", "value": "24576:IejuePIp1OQShF4WwryUJSG7zKr3tvX45g/pxF:IBdShSWAyUJKr3tvI5g/pxF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153897", "to_ids": false, "type": "size-in-bytes", "uuid": "41cdccb1-b498-4762-9362-d02905f3b964", "value": "926416" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "object_relation": "vhash", "timestamp": "1784153897", "to_ids": true, "type": "vhash", "uuid": "3727cbbb-f3c4-4fe8-81dc-4bb6ae30e95e", "value": "9f10572adc57c413ab0ac77d5bf7c685" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-02T13:53:02+00:00", "last_seen": "2026-07-02T13:53:02+00:00", "object_relation": "filename", "timestamp": "1784153897", "to_ids": true, "type": "filename", "uuid": "d7df702f-2720-4e57-b3ff-cc48a7551036", "value": "avenger_agent-bacc7f3ef1dfcbdb" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784157965", "uuid": "76e2112d-fd4f-454a-96c7-41436f6e0ff4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "object_relation": "md5", "timestamp": "1784157965", "to_ids": true, "type": "md5", "uuid": "f5b19348-c0af-4cb9-bca8-eee98436722b", "value": "4a7fdf00b186bc9c33667ee647c27081", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "object_relation": "sha1", "timestamp": "1784154180", "to_ids": true, "type": "sha1", "uuid": "62bafcaf-dab7-487a-a728-3b2f9b4df989", "value": "57982d7b62ceb87d96ea74d44d7550ad1f60d291", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "object_relation": "sha256", "timestamp": "1784154180", "to_ids": true, "type": "sha256", "uuid": "f58e7005-bfdf-45ee-8e63-25b7e60ad4ee", "value": "ff20b429cb1c89e1cdb6734b00cc8cf021d2d13fd686bbc70709b3dd549285d2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 13/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "object_relation": "text", "timestamp": "1784153919", "to_ids": false, "type": "text", "uuid": "3f9ee37c-ab87-4269-991f-c12689fc9dd6", "value": "Type Description: Macintosh Disk Image\nMicrosoft: Trojan:MacOS/Multiverze!rfn\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2026-06-07T20:50:28+00:00\nLast Submission: 2026-06-07T20:50:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "object_relation": "ssdeep", "timestamp": "1784153919", "to_ids": true, "type": "ssdeep", "uuid": "dc2497ee-a478-49ec-949b-6328d2c2ac13", "value": "6144:dOmVyRe8g3bTTpKywFg+AeiToXmfT9250ZTg3bTNnZxyTTVXI6:dGe8glKgTQmfJRgVnPD6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153919", "to_ids": false, "type": "size-in-bytes", "uuid": "ab9c5db0-188f-4602-a39c-582272feadb8", "value": "306156" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "object_relation": "vhash", "timestamp": "1784153919", "to_ids": true, "type": "vhash", "uuid": "c2160c1d-4182-426f-ba84-d6e6308ef97d", "value": "ee35ffc7b9bc3d989b14350109e9ef98" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-07T20:50:28+00:00", "last_seen": "2026-06-07T20:50:28+00:00", "object_relation": "filename", "timestamp": "1784153919", "to_ids": true, "type": "filename", "uuid": "d89c723b-840b-4a8b-b818-dea1943ed268", "value": "Maccy.dmg" } ] } ] } }