{ "Event": { "analysis": "1", "date": "2026-07-20", "extends_uuid": "", "info": "[Threat Intel] Unpacking \"Cruciferra\": An Analysis of a Sophisticated Crypter Service", "protected": false, "publish_timestamp": "1785033921", "published": true, "threat_level_id": "2", "timestamp": "1785033921", "uuid": "98639f54-0a85-47ff-8c8e-9f3c9a089fcd", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#2d8ee7", "local": false, "name": "misp-galaxy:producer=\"Proofpoint\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#91ee5f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Rootkit - T1014\"", "relationship_type": "" }, { "colour": "#d74cce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#c8f8ef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Binary Proxy Execution - T1218\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#e74146", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Doppelg\u00e4nging - T1055.013\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#4bc785", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Hollowing - T1055.012\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"", "relationship_type": "" }, { "colour": "#fdd85e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Access Token Manipulation - T1134\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003f", "local": false, "name": "rectifyq:sub-category=\"tool-profile\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"404 Keylogger\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Agent Tesla\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"AsyncRAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"DarkCloud Stealer\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Formbook\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Remcos\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"ValleyRAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"XWorm\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Xloader\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"zgRAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"PuTTY\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"TA4922\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784545207", "to_ids": false, "type": "link", "uuid": "e69b9e04-6567-4f53-a6e5-821c4eb1e0d5", "value": "https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784545207", "to_ids": false, "type": "text", "uuid": "b6aa0596-dcf2-4eb7-b4bb-af5fbb8fed4f", "value": "Cruciferra is a sophisticated crypter service utilized by multiple unrelated cybercriminal threat clusters to deliver remote access trojans and infostealers. Written in Mono, it employs extensive defense-evasion capabilities including indirect system calls, API unhooking, BYOVD-based EDR tampering, privilege escalation, and customized Process Ghosting for payload execution. The service features over 90 variations of cryptographic functions to obfuscate data and payloads, complicating static analysis and signature-based detection. Cruciferra was first advertised in fall 2025 with pricing tiers ranging from $450 to $2000 monthly. It has been observed in campaigns delivering various malware families including zgRAT, AgentTesla, AsyncRAT, XLoader, XWorm, Phantom Stealer, Formbook, and Remcos, primarily targeting financial services, healthcare, and government entities through opportunistic email-based attacks." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784545207", "to_ids": false, "type": "text", "uuid": "285b16b5-a485-447e-8821-15d0107d938c", "value": "Name: Unpacking \"Cruciferra\": An Analysis of a Sophisticated Crypter Service\nAuthor: AlienVault\nAdversary: TA4922\nTags: [\"adaptixc2\", \"defense-evasion\", \"darkcloud stealer\", \"malware-as-a-service\", \"formbook\", \"winos4.0\", \"crypter-service\", \"xworm\", \"byovd\", \"dcrat\", \"process-ghosting\", \"snake keylogger\", \"phantom stealer\", \"edr-tampering\", \"dll-sideloading\", \"asyncrat\", \"xloader\", \"agenttesla\", \"remcos\", \"valleyrat\", \"cruciferra\", \"zgrat\"]\nTgtd countries: []\nMlwr families: [\"Cruciferra\", \"zgRAT\", \"AgentTesla\", \"AsyncRAT\", \"XLoader\", \"XWorm\", \"Phantom Stealer\", \"Formbook\", \"Remcos\", \"DarkCloud Stealer\", \"DCRAT\", \"Snake Keylogger\", \"ValleyRAT\", \"Winos4.0\", \"AdaptixC2\"]\nAttack_ids: [\"T1014\", \"T1548.002\", \"T1204.002\", \"T1566.001\", \"T1106\", \"T1140\", \"T1036\", \"T1055\", \"T1218\", \"T1112\", \"T1055.013\", \"T1497\", \"T1059.001\", \"T1547.001\", \"T1562.001\", \"T1055.012\", \"T1027\", \"T1564.003\", \"T1134\", \"T1574.002\"]\nIndustries: [\"Finance\", \"Healthcare\", \"Government\", \"Hospitality\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784545207", "to_ids": false, "type": "threat-actor", "uuid": "ba658525-a350-44e0-8bff-4f13b96b349a", "value": "TA4922" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900068", "to_ids": true, "type": "domain", "uuid": "2440fadb-f059-4778-a630-83d41a49e1f2", "value": "almacensantangel.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "XWorm C2", "deleted": false, "disable_correlation": false, "timestamp": "1784900090", "to_ids": true, "type": "hostname", "uuid": "7d83a831-31a2-439d-b2db-b0267d8134dc", "value": "gatuso.duckdns.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900111", "to_ids": true, "type": "url", "uuid": "487c6f93-d7f9-4613-951c-0d146b4b2f68", "value": "https://almacensantangel.com/wp-includes/assets/YourSSA_Documents_0000000676152_05_187_2026_Document_0000000676152.rar", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "zgRAT C2", "deleted": false, "disable_correlation": false, "timestamp": "1784900132", "to_ids": true, "type": "domain", "uuid": "3b37fbd7-3b86-4b66-8346-028946f7bb75", "value": "0zbqnac1t4dv2t2wuodv1m.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900154", "to_ids": true, "type": "domain", "uuid": "91dfe064-108f-4c15-bc2b-4981f7e36956", "value": "digital-magicians.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900175", "to_ids": true, "type": "domain", "uuid": "8d6eabc1-c05f-40b4-b688-2a7d283ac472", "value": "fiusyevr.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "zgRAT C2", "deleted": false, "disable_correlation": false, "timestamp": "1784900197", "to_ids": true, "type": "ip-dst", "uuid": "a54f94c2-b58b-4a97-a249-caa0d2281a14", "value": "89.34.90.99", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900218", "to_ids": true, "type": "domain", "uuid": "3c81d125-5e1a-4c1f-b86d-91a992ec7047", "value": "fvxcuvuyte.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899492", "to_ids": true, "type": "sha256", "uuid": "cae8cfc1-444a-4782-b5b2-234e888f4e47", "value": "59ad96dd3b4d5f10a5c53bbd465446e52dc7701a4ac633632f762bf1336d3347", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899494", "to_ids": true, "type": "sha256", "uuid": "9bac08b6-28d8-49d2-95fc-e7120bb97721", "value": "66dbe675480dc229e5b3ab8ad74207f73486e64e57805074f784bb2e01bcb865", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900240", "to_ids": true, "type": "url", "uuid": "35d17df9-a25f-4f1d-8ac9-55d671bc2daf", "value": "http://faeytrdeaw.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900261", "to_ids": true, "type": "url", "uuid": "76bd093b-c8ff-4543-98b9-5277fc052051", "value": "http://figyuyrqwr.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900282", "to_ids": true, "type": "url", "uuid": "caffd877-5a10-474e-ac4e-3435d5b03889", "value": "http://fiusyevr.live", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900303", "to_ids": true, "type": "url", "uuid": "38bf9969-d6ac-4b2e-b265-53246552503d", "value": "http://fuaytrwese.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900324", "to_ids": true, "type": "url", "uuid": "d67fdee0-5937-4132-bde8-e9795ed9a558", "value": "http://hfyuayustrv.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900346", "to_ids": true, "type": "url", "uuid": "e93df565-7751-4d5c-989d-885e17870dc7", "value": "http://hsahyteiows.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900367", "to_ids": true, "type": "url", "uuid": "f325d3bd-2904-445b-a669-2844ef251fc6", "value": "http://jaiydteds.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900389", "to_ids": true, "type": "url", "uuid": "2ade3e32-7e3b-4712-b2fb-5d2c67c1856a", "value": "http://jsiruytrawey.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900410", "to_ids": true, "type": "url", "uuid": "cb98779e-2993-406c-a720-aaee1b14c2ab", "value": "http://kawosyetw.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900431", "to_ids": true, "type": "url", "uuid": "01c4da3f-9e2c-4372-ba4e-86b9dd3c6464", "value": "http://kawuuterta.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900452", "to_ids": true, "type": "url", "uuid": "54a5486b-d7f5-49bd-ac92-23685865b52c", "value": "http://laiwutrencr.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900473", "to_ids": true, "type": "url", "uuid": "2bc67fe8-b358-4c40-97c3-9800e4717ccd", "value": "http://lasiduutfe.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900494", "to_ids": true, "type": "url", "uuid": "254977d1-ec8f-4701-9269-afd66e659382", "value": "http://lisiutegrm.live", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900515", "to_ids": true, "type": "url", "uuid": "c737dc12-73fc-4d70-992c-639c2a9dcd06", "value": "http://maisytawe.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900536", "to_ids": true, "type": "url", "uuid": "74871c1c-e708-4c05-a7b4-7e360273a452", "value": "http://mksfuuerwo.live", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900557", "to_ids": true, "type": "url", "uuid": "e65545af-8143-4e9d-b070-41176739f901", "value": "http://ncduuyese.live", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900579", "to_ids": true, "type": "url", "uuid": "40cc4d0a-c6e5-4656-b863-6db0804de64c", "value": "http://nciyeyrawoe.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900600", "to_ids": true, "type": "url", "uuid": "43a05180-62b8-45ae-a5f7-91df6e8d1989", "value": "http://nviuawusye.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900621", "to_ids": true, "type": "url", "uuid": "1bdbfd55-6e03-4dff-a95f-35b29fe1788d", "value": "http://nvsieyrrawe.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900642", "to_ids": true, "type": "url", "uuid": "f821e38e-74a5-4e6f-b4a9-836ecca833a7", "value": "http://paiwudyea.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900663", "to_ids": true, "type": "url", "uuid": "cc4fdb1b-f5ef-4c6c-bf76-865c2cdc3918", "value": "http://pmcjsuyraw.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900685", "to_ids": true, "type": "url", "uuid": "3b4e1698-9a88-4a2e-8eea-c15812582216", "value": "http://qeuasytua.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900706", "to_ids": true, "type": "url", "uuid": "fc213532-5430-422e-b8c2-c7cc298ee6a8", "value": "http://svuatwea.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900727", "to_ids": true, "type": "url", "uuid": "f9bdcc7f-92eb-4de6-8a2b-1d794e0e6824", "value": "http://syfiaydytea.live", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900748", "to_ids": true, "type": "url", "uuid": "1511bb42-cdb5-43ab-b708-348d4c498226", "value": "http://viuyeyrwqs.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900769", "to_ids": true, "type": "url", "uuid": "06d3aed2-e930-497c-b19f-41cc6e23c492", "value": "http://vusuydryt.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900791", "to_ids": true, "type": "url", "uuid": "1b4b2137-518b-4002-9fde-7c6dab6b777a", "value": "http://xkcifgieusr.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900812", "to_ids": true, "type": "url", "uuid": "193a3566-5f7c-40cc-a56c-06de26c0451d", "value": "http://xnbscuya.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900834", "to_ids": true, "type": "url", "uuid": "e498a31c-901b-4fc3-86f8-4c2e84e7d230", "value": "http://xuastyrdqk.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900855", "to_ids": true, "type": "url", "uuid": "821b97b3-d663-4093-98f2-af271ac7e680", "value": "http://yicoweytcbtw.gu.cc", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900876", "to_ids": true, "type": "url", "uuid": "077fa74c-b254-4707-9d28-594d144ef98c", "value": "https://digital-magicians.com/photo295825092412.zip?_r=ea623202", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900898", "to_ids": true, "type": "url", "uuid": "dc3c2c64-27b2-4cf3-969a-869cf0d0f0eb", "value": "https://fvxcuvuyte.live", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900919", "to_ids": true, "type": "url", "uuid": "d5687e95-326b-4d07-9812-4f288aa442be", "value": "https://hsauyeet.live", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900940", "to_ids": true, "type": "url", "uuid": "f391aed6-3786-49a3-ba30-2a8fb52e9f03", "value": "https://kdsuyrse.live", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900961", "to_ids": true, "type": "url", "uuid": "a3f0d651-115f-48d1-8cf8-eb3d4f47892e", "value": "https://oakwusya.love", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784900982", "to_ids": true, "type": "domain", "uuid": "4d580ac8-48a1-43e8-a727-0844a7dacdb1", "value": "fuaytrwese.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901004", "to_ids": true, "type": "domain", "uuid": "7ad485e5-2628-400c-af97-34aeb45b97da", "value": "hsauyeet.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901025", "to_ids": true, "type": "domain", "uuid": "cd571fc8-5769-4708-a26a-e4ad27977852", "value": "jaiydteds.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901046", "to_ids": true, "type": "domain", "uuid": "b21b283f-b7c4-4555-b21e-60529f271224", "value": "kdsuyrse.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901068", "to_ids": true, "type": "domain", "uuid": "f250dcf9-cf29-4338-a50e-0bddb965381e", "value": "lisiutegrm.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901089", "to_ids": true, "type": "domain", "uuid": "1c974507-312c-4f96-9309-9159a5edfabe", "value": "mksfuuerwo.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901111", "to_ids": true, "type": "domain", "uuid": "f238df92-6518-4131-889e-cae301a42f46", "value": "ncduuyese.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901133", "to_ids": true, "type": "domain", "uuid": "b3e1914f-ccb5-4a2a-8437-88b786816213", "value": "oakwusya.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901154", "to_ids": true, "type": "domain", "uuid": "aa7384a3-5f91-4a73-9208-098fdd94c956", "value": "paiwudyea.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901177", "to_ids": true, "type": "domain", "uuid": "383bd226-ceef-4bb9-bcdf-66aea24e7ed3", "value": "qeuasytua.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901199", "to_ids": true, "type": "domain", "uuid": "035b0bc2-4340-438d-91ca-f5d432f4d5be", "value": "svuatwea.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901220", "to_ids": true, "type": "domain", "uuid": "42b2c28f-0032-4690-b7e2-1a5b6c767701", "value": "syfiaydytea.live", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901242", "to_ids": true, "type": "domain", "uuid": "f01800df-79c9-46ba-adf7-c80b884303f4", "value": "vusuydryt.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901264", "to_ids": true, "type": "domain", "uuid": "0e6709a6-0d27-4bec-8daa-159930ffa632", "value": "xnbscuya.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784901286", "to_ids": true, "type": "domain", "uuid": "da105029-1aaf-465c-ba26-8e18d609f681", "value": "xuastyrdqk.love", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901307", "to_ids": true, "type": "domain", "uuid": "5361ebe6-2af4-42b7-a2c2-a28e3ff897c1", "value": "hsahyteiows.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901329", "to_ids": true, "type": "domain", "uuid": "88a6e801-f889-4260-a273-e0d3549305f7", "value": "yicoweytcbtw.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901350", "to_ids": true, "type": "domain", "uuid": "9ba5438b-4b36-4061-928e-949c2feb13bf", "value": "nciyeyrawoe.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901371", "to_ids": true, "type": "domain", "uuid": "c990ddbf-eb6a-4a34-a7e9-aa516a6ac42b", "value": "lasiduutfe.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901393", "to_ids": true, "type": "domain", "uuid": "d5134b7a-45af-4d31-96f7-e3ca4e4a50e9", "value": "xkcifgieusr.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901414", "to_ids": true, "type": "domain", "uuid": "bed07af4-d648-4510-8328-bc2132ebd402", "value": "viuyeyrwqs.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901435", "to_ids": true, "type": "domain", "uuid": "b8b1b608-a1aa-47a1-9bbe-21ff91a311fa", "value": "pmcjsuyraw.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901457", "to_ids": true, "type": "domain", "uuid": "44106c3e-8199-4227-90d7-39f9908d4217", "value": "laiwutrencr.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901478", "to_ids": true, "type": "domain", "uuid": "0834d781-e136-4a38-8980-7b13afb874ac", "value": "maisytawe.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901500", "to_ids": true, "type": "domain", "uuid": "0983ff24-03e6-490a-98e9-6fd5f927d824", "value": "kawosyetw.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901521", "to_ids": true, "type": "domain", "uuid": "6aa3a7dd-d20c-4c41-8467-985262665076", "value": "nviuawusye.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901542", "to_ids": true, "type": "domain", "uuid": "4ed4617e-5152-4b0e-91e2-18596d40c9d8", "value": "faeytrdeaw.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901564", "to_ids": true, "type": "domain", "uuid": "22054a2c-d408-4be7-8d38-ae33022e79a6", "value": "figyuyrqwr.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901585", "to_ids": true, "type": "domain", "uuid": "d8e7179a-9c33-4173-8b42-6d00cc30eaea", "value": "hfyuayustrv.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901608", "to_ids": true, "type": "domain", "uuid": "c3dd9ade-ac06-4b3f-ac2d-458cfbeea9ab", "value": "jsiruytrawey.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901629", "to_ids": true, "type": "domain", "uuid": "12ac22b3-15cf-4d66-8c1c-e708c2cc17d2", "value": "kawuuterta.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "TA4922 Cruciferra / AsyncRAT Payload URL", "deleted": false, "disable_correlation": false, "timestamp": "1784901651", "to_ids": true, "type": "domain", "uuid": "94baa5c5-b415-4706-8dc2-7a732b9aa673", "value": "nvsieyrrawe.gu.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901673", "uuid": "e0a05399-162f-478d-9306-891f25ffff98", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "md5", "timestamp": "1784901673", "to_ids": true, "type": "md5", "uuid": "fb317290-a834-4721-a293-b2f1e8115e1b", "value": "6126065af2fc2639473d12ee3c0c198e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "sha1", "timestamp": "1784899472", "to_ids": true, "type": "sha1", "uuid": "579a4842-a49e-4aaa-8497-98902c281d8f", "value": "d7e8aef8c8feb87ce722c0b9abf34a7e6bab6eb4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "sha256", "timestamp": "1784899472", "to_ids": true, "type": "sha256", "uuid": "2d866457-3352-4d7f-8417-e5a7e980bc2a", "value": "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 21/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "text", "timestamp": "1784898018", "to_ids": false, "type": "text", "uuid": "9a4592dc-1531-45c1-a9e3-abd1ba639c1e", "value": "Type Description: Win32 EXE\nOriginal name: NTIOLib_X64.sys\nVerified: Signed\nSigning date: 07:07 AM 04/12/2016\nSigners: MICRO-STAR INTERNATIONAL CO., LTD.; GlobalSign CodeSigning CA - G2; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2016-04-12T02:04:16+00:00\nFirst Submission: 2016-07-12T15:23:23+00:00\nLast Submission: 2026-07-09T14:26:24+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "creation-time", "timestamp": "1784898018", "to_ids": false, "type": "datetime", "uuid": "f5f10c88-fe83-40fc-8f25-e934cfaa1f33", "value": "2016-04-12T07:04:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "ssdeep", "timestamp": "1784898018", "to_ids": true, "type": "ssdeep", "uuid": "bc6701df-ce18-423b-9fc4-7273da3d0972", "value": "192:08gm7Be2jNrCzksxtnVTgBxe1HCjWe+PjPssxxmRhpml0idEmk9QRwLP:0MxjNrCzksxtn2KtPLjYRhpm5dEmAP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898018", "to_ids": false, "type": "size-in-bytes", "uuid": "78701ae7-5ee7-4bad-b659-bf90f95eef22", "value": "13776" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "vhash", "timestamp": "1784898018", "to_ids": true, "type": "vhash", "uuid": "97934ab0-c954-44cc-8863-4c31f2e00187", "value": "014066551d151e1519z27zaxz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2016-07-12T15:23:23+00:00", "last_seen": "2026-07-09T14:26:24+00:00", "object_relation": "filename", "timestamp": "1784898018", "to_ids": true, "type": "filename", "uuid": "28d8e905-cc99-4504-a0a6-d9dd7e8c9061", "value": "NTIOLib_X64.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901695", "uuid": "897159c8-f510-4986-8eed-0663c9555d45", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "md5", "timestamp": "1784901695", "to_ids": true, "type": "md5", "uuid": "1c953850-f18e-4444-ad87-802499333d21", "value": "5761bd63da03686fc480245da7bd1e9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "sha1", "timestamp": "1784899474", "to_ids": true, "type": "sha1", "uuid": "cbbd92fe-a472-4446-82cb-047a9d4adbfe", "value": "68fec379f2ae76c3d2ce913f7be650cea1d06990", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "sha256", "timestamp": "1784899474", "to_ids": true, "type": "sha256", "uuid": "fa0840a9-5afb-4b97-943b-f5df17d0591f", "value": "5b4f59236a9b950bcd5191b35d19125f60cfb9e1a1e1aa2e4f914b6745dde9df", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "text", "timestamp": "1784898040", "to_ids": false, "type": "text", "uuid": "38452d60-a532-49dd-8d27-ad866aa3a629", "value": "Type Description: Win32 EXE\nOriginal name: ProcessMonitorDriver\nVerified: Signed\nSigning date: 08:00 PM 02/04/2026\nSigners: Microsoft Windows Hardware Compatibility Publisher; Microsoft Windows Third Party Component CA 2012; Microsoft Root Certificate Authority 2010\nMicrosoft: None\nClamAV: None\nVT Total Detection: 5/74\nFirst Submission: 2026-02-06T07:33:16+00:00\nLast Submission: 2026-07-01T12:09:09+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "creation-time", "timestamp": "1784898041", "to_ids": false, "type": "datetime", "uuid": "253b2a3e-b2dc-43a6-a7d5-ad6625ae7521", "value": "2026-02-04T19:24:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "ssdeep", "timestamp": "1784898040", "to_ids": true, "type": "ssdeep", "uuid": "2a8cced8-78e2-4105-9d81-591ef1b399cf", "value": "768:4QcpKO3Eb4IF/He7ItmhcK6OpW5ONb8Cf9zuk:wwOjIdHe7ItmhcK6OpFNb8ozj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898040", "to_ids": false, "type": "size-in-bytes", "uuid": "e8ae3a01-551a-4f8a-be40-6a236c0bbb90", "value": "37456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "vhash", "timestamp": "1784898040", "to_ids": true, "type": "vhash", "uuid": "b579b2e4-653f-4091-bea5-0f893b3c6784", "value": "034086651d15151615151iz2fwz1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-06T07:33:16+00:00", "last_seen": "2026-07-01T12:09:09+00:00", "object_relation": "filename", "timestamp": "1784898040", "to_ids": true, "type": "filename", "uuid": "f275176d-c60e-42de-a066-c7a506e1606d", "value": "ProcessMonitorDriver" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901717", "uuid": "48ba75da-f965-4dc3-bda1-a70789c65c82", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "md5", "timestamp": "1784901717", "to_ids": true, "type": "md5", "uuid": "56acefc6-bf47-4749-a9f4-1da53d9581a0", "value": "4f1773a1228e2c009cbcf61e9e550e01", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "sha1", "timestamp": "1784899476", "to_ids": true, "type": "sha1", "uuid": "732e33ca-a62e-4b88-90ba-a94963fab556", "value": "2aa47fb23074e8ae776a369f9e28d1a2f6e70739", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "sha256", "timestamp": "1784899476", "to_ids": true, "type": "sha256", "uuid": "4cc6d1f1-d8b8-4cff-abe2-bb23cc534a21", "value": "17aae57cf6255c7eb169bf62ea67376d9708976eb7831f8cdd0ea38bdcb37dc4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "text", "timestamp": "1784898062", "to_ids": false, "type": "text", "uuid": "10d33a03-1e9b-4ea2-a8be-c9719f72b650", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 06:31 AM 01/19/2025\nSigners: Microsoft Windows Hardware Compatibility Publisher; Microsoft Windows Third Party Component CA 2014; Microsoft Root Certificate Authority 2010\nMicrosoft: VulnerableDriver:Win32/RootkitDrv\nClamAV: None\nVT Total Detection: 38/74\nFirst Submission: 2025-02-21T05:04:12+00:00\nLast Submission: 2026-06-13T20:05:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "creation-time", "timestamp": "1784898063", "to_ids": false, "type": "datetime", "uuid": "15edca89-a3fd-4da0-819f-264a040713e2", "value": "2025-01-19T05:25:03+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "ssdeep", "timestamp": "1784898062", "to_ids": true, "type": "ssdeep", "uuid": "e89fd9d9-954b-4888-b90e-44d2d5d6c7ec", "value": "192:PqMVhPghXDEwXEhYCPzWYHnsTX01k9z3AkFH8W0u:PqMVKyh3LWYMTR9zhFTr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898063", "to_ids": false, "type": "size-in-bytes", "uuid": "ca026723-fb9f-4e12-8ce2-27bf285b5a53", "value": "14528" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "vhash", "timestamp": "1784898063", "to_ids": true, "type": "vhash", "uuid": "15ed3732-38d5-4fc6-a133-fd628940df3e", "value": "014056551d051d1jzaxz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-02-21T05:04:12+00:00", "last_seen": "2026-06-13T20:05:25+00:00", "object_relation": "filename", "timestamp": "1784898063", "to_ids": true, "type": "filename", "uuid": "512007da-3d94-4efc-a379-b5f4197ec113", "value": "Core64.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901739", "uuid": "5df6e772-5d7f-4c5b-bd66-1cdd548eb18a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "md5", "timestamp": "1784901739", "to_ids": true, "type": "md5", "uuid": "45377f4e-b8a8-4060-a72e-81e6109659bb", "value": "26b2da88cb95b98b46bb985f67f76154", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "sha1", "timestamp": "1784899478", "to_ids": true, "type": "sha1", "uuid": "7eb565af-5e52-405e-9e0d-945435e3e039", "value": "bc61ef6d7ad9ee878028f24d50e9dcf6d7d88bf2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "sha256", "timestamp": "1784899478", "to_ids": true, "type": "sha256", "uuid": "32f507e3-0bd7-49c7-8e1f-cf39a3f032e0", "value": "2fdfdd13a0c548bb68c9d5aa8599a9265d4659da3e237fe7a42ac6ac06b9a06a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "text", "timestamp": "1784898086", "to_ids": false, "type": "text", "uuid": "2f5d492f-65c3-40a5-b16c-ac84ff7f6ab8", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 10:38 AM 07/29/2019\nSigners: \u5357\u4eac\u5072\u8a00\u777f\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8; GlobalSign CodeSigning CA - G3; GlobalSign Root CA - R1\nMicrosoft: None\nClamAV: None\nVT Total Detection: 12/74\nFirst Seen In The Wild: 2019-08-01T15:06:19+00:00\nFirst Submission: 2019-08-03T03:35:25+00:00\nLast Submission: 2026-07-18T06:59:38+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "creation-time", "timestamp": "1784898086", "to_ids": false, "type": "datetime", "uuid": "a9b917fa-ca41-4f68-b10d-0a9c08ece941", "value": "2019-07-25T17:41:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "ssdeep", "timestamp": "1784898086", "to_ids": true, "type": "ssdeep", "uuid": "6701666b-6035-41e9-a5ec-0c1d834925fc", "value": "1536:4mLYx/2ICC4z9rjbGr6y4Q/7ZZrZ4llfvX0osF9AUYPccv6CKHGv3h5u:4RuICRZ/CLrZ4Hv+9AUYPccvpGGDu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898086", "to_ids": false, "type": "size-in-bytes", "uuid": "ab638b54-2590-4a42-9c6b-9b57d26b0e05", "value": "132088" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "vhash", "timestamp": "1784898086", "to_ids": true, "type": "vhash", "uuid": "ab8ef069-b2fa-455a-8e96-d98471af963b", "value": "015066555d1556551iz45xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2019-08-03T03:35:25+00:00", "last_seen": "2026-07-18T06:59:38+00:00", "object_relation": "filename", "timestamp": "1784898086", "to_ids": true, "type": "filename", "uuid": "15c1808a-5fc7-4ed5-a278-d0ad2664c473", "value": "GoFly64.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901761", "uuid": "abe1fb80-f970-433e-80a5-47342aee9caa", "Attribute": [ { "category": "Payload delivery", "comment": "TA4922 Cruciferra / AsyncRAT", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "object_relation": "md5", "timestamp": "1784901761", "to_ids": true, "type": "md5", "uuid": "ced197cf-feec-4e6e-b54f-48148f390b76", "value": "892c4fe5f33f77b850c8419f450d1745", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TA4922 Cruciferra / AsyncRAT", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "object_relation": "sha1", "timestamp": "1784899480", "to_ids": true, "type": "sha1", "uuid": "1c6e3a2e-ff19-4be3-9ec6-f65b2226e540", "value": "490e76dfbe99a5931cbd3baae5756d6e1e89c69a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TA4922 Cruciferra / AsyncRAT", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "object_relation": "sha256", "timestamp": "1784899480", "to_ids": true, "type": "sha256", "uuid": "372bd1d7-5ede-4d76-a687-b095d855cf16", "value": "3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "object_relation": "text", "timestamp": "1784898107", "to_ids": false, "type": "text", "uuid": "d3f486e6-620b-429b-8880-65f83a45a294", "value": "TA4922 Cruciferra / AsyncRAT\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-04-30T05:18:55+00:00\nLast Submission: 2026-05-02T02:42:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "object_relation": "ssdeep", "timestamp": "1784898107", "to_ids": true, "type": "ssdeep", "uuid": "76aa83e0-8186-451b-9ed4-169eeff7e493", "value": "98304:1Ve/Sb1DHcZv7bNNFEtBnHNS5thUOwwbZXdHJ04EJZ:nUSeR7bnCnn85thBJbh0LL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898107", "to_ids": false, "type": "size-in-bytes", "uuid": "8ff57a16-1894-4fdd-8acd-61534bea5b3d", "value": "4786181" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "object_relation": "vhash", "timestamp": "1784898107", "to_ids": true, "type": "vhash", "uuid": "d79f3cfc-546c-4e48-b242-7d7d206bcc37", "value": "44cbacfdb289876e90ab8bc9b533b0d6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T05:18:55+00:00", "last_seen": "2026-05-02T02:42:32+00:00", "object_relation": "filename", "timestamp": "1784898107", "to_ids": true, "type": "filename", "uuid": "e06ff6f3-37d5-479e-b7bf-6a9c12d32bec", "value": "3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901783", "uuid": "530e9be4-dd14-4043-b87f-c2c0a35c0fe9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "md5", "timestamp": "1784901783", "to_ids": true, "type": "md5", "uuid": "d224ac03-9c6a-4b9f-bd67-b07fd7cbdac3", "value": "63bfd6567f4c704e8ed6530f5cdd704e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "sha1", "timestamp": "1784899481", "to_ids": true, "type": "sha1", "uuid": "4ec6feec-8cc3-48d3-9c73-fb8f9f3d60af", "value": "080fdb73a6bbc99625c2190730257d1e54723952", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "sha256", "timestamp": "1784899481", "to_ids": true, "type": "sha256", "uuid": "4b42129f-c587-4229-ae28-92282bb477bb", "value": "c4e93449453cf67c5d5605bb8f425207a738a242fdb432d720acc32faa74926c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "text", "timestamp": "1784898129", "to_ids": false, "type": "text", "uuid": "6a6932fe-d225-499c-95fc-83ed33031962", "value": "Type Description: Win32 EXE\nOriginal name: HwOs2Ec.sys\nVerified: Signed\nSigning date: 03:02 AM 02/14/2023\nSigners: Huawei Device Co., Ltd.; GlobalSign GCC R45 CodeSigning CA 2020; GlobalSign Code Signing Root R45; GlobalSign Root CA - R3\nMicrosoft: None\nClamAV: None\nVT Total Detection: 1/74\nFirst Submission: 2025-10-11T17:22:51+00:00\nLast Submission: 2026-07-23T03:52:19+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "creation-time", "timestamp": "1784898129", "to_ids": false, "type": "datetime", "uuid": "3505004f-e09b-4894-aed8-74586cd66fde", "value": "2022-02-26T02:25:36+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "ssdeep", "timestamp": "1784898129", "to_ids": true, "type": "ssdeep", "uuid": "031f094c-6c3e-4b23-8da1-240916ed5485", "value": "768:83PoU3aHOtD/gMB8laFb4cT+D69yuaYi8KOA2te1rQ0EJPxITwsQNI7kh9zjJb:Gjal46En7KOpyUPxIvQusz5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898129", "to_ids": false, "type": "size-in-bytes", "uuid": "19d3818b-8ddc-44f1-b1d4-281511113baf", "value": "58504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "vhash", "timestamp": "1784898129", "to_ids": true, "type": "vhash", "uuid": "494eeefd-5f0f-4bc1-a7de-dcc4bd1d71e1", "value": "054086651d151666551519z16z4axz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-10-11T17:22:51+00:00", "last_seen": "2026-07-23T03:52:19+00:00", "object_relation": "filename", "timestamp": "1784898129", "to_ids": true, "type": "filename", "uuid": "8ccaf4d9-c9a9-4d3e-9fd3-a8faf8527c4e", "value": "HwOs2Ec.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901805", "uuid": "4a72236a-a206-458a-8fae-e0031c7014f0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "object_relation": "md5", "timestamp": "1784901805", "to_ids": true, "type": "md5", "uuid": "6c4a5bf8-98f4-477a-b549-3bbd1b16c930", "value": "43aa0d4c383ea3400d712c6dbca0f6a4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "object_relation": "sha1", "timestamp": "1784899483", "to_ids": true, "type": "sha1", "uuid": "7574967c-3803-40ab-a25f-40ddafa7e5bd", "value": "eff8429985f73ac1dd8826ea60d9db85a6ee148c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "object_relation": "sha256", "timestamp": "1784899483", "to_ids": true, "type": "sha256", "uuid": "a29f963e-5c6f-4074-ab42-2963f90a2035", "value": "3f31aee0948d16f8d64bf6bec69a4331099993e502b11bfc56b2c0112024489d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "object_relation": "text", "timestamp": "1784898151", "to_ids": false, "type": "text", "uuid": "b5a90541-cbb5-493e-8cd4-0bab415b8c8f", "value": "Type Description: ZIP\nMicrosoft: Trojan:Win32/Ravartar!rfn\nClamAV: None\nVT Total Detection: 37/74\nFirst Seen In The Wild: 2026-06-29T12:49:09+00:00\nFirst Submission: 2026-06-28T12:19:32+00:00\nLast Submission: 2026-06-29T12:39:53+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "object_relation": "ssdeep", "timestamp": "1784898151", "to_ids": true, "type": "ssdeep", "uuid": "9facbeff-909c-430b-9d63-a85b3827215d", "value": "24:99B6YXRXMcuw1fRYorO1+gD4iWcKqovr4IK3a9OQqwe9:9BMcnq5Or473a4Qk9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898151", "to_ids": false, "type": "size-in-bytes", "uuid": "82eeec38-dd7b-4e75-9ed4-289f933fedbe", "value": "840" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "object_relation": "vhash", "timestamp": "1784898151", "to_ids": true, "type": "vhash", "uuid": "0b5f359b-4072-454b-bf41-4e8b6ca38865", "value": "94588e4f5f5856c07768397fa6526ac5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-28T12:19:32+00:00", "last_seen": "2026-06-29T12:39:53+00:00", "object_relation": "filename", "timestamp": "1784898151", "to_ids": true, "type": "filename", "uuid": "2b732249-7e51-4fb3-b9fb-733d1e271027", "value": "d4fbfcv.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-03T19:19:58+00:00", "last_seen": "2026-06-03T19:19:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901826", "uuid": "02367359-9a1f-48b4-a164-3bb87aa123d7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T19:19:58+00:00", "last_seen": "2026-06-03T19:19:58+00:00", "object_relation": "md5", "timestamp": "1784901826", "to_ids": true, "type": "md5", "uuid": "3e713eb7-15c5-4437-9921-c9d096e54b11", "value": "d096c353d4db122aa76402d5462d0f8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T19:19:58+00:00", "last_seen": "2026-06-03T19:19:58+00:00", "object_relation": "sha1", "timestamp": "1784899484", "to_ids": true, "type": "sha1", "uuid": "447b6f6e-f842-4abd-8e8b-1fb23cbbbf0c", "value": "7236aadee8af77bdd2d8bff64e57be97499cfab2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T19:19:58+00:00", "last_seen": "2026-06-03T19:19:58+00:00", "object_relation": "sha256", "timestamp": "1784899484", "to_ids": true, "type": "sha256", "uuid": "e74f4245-93aa-481c-9a35-a5875b604649", "value": "6dbd6f9f2fa636c16ac4fa81418b68a604424861b9650dd9c4f2b0ba6f67d6ac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T19:19:58+00:00", "last_seen": "2026-06-03T19:19:58+00:00", "object_relation": "text", "timestamp": "1784898215", "to_ids": false, "type": "text", "uuid": "3dcfea9a-74a0-4c15-a135-bad5e9bc1962", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 13/74\nFirst Submission: 2026-06-03T19:19:58+00:00\nLast Submission: 2026-06-03T19:19:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T19:19:58+00:00", "last_seen": "2026-06-03T19:19:58+00:00", "object_relation": "ssdeep", "timestamp": "1784898215", "to_ids": true, "type": "ssdeep", "uuid": "c4166b46-baa8-4cc9-97ed-573f77a96231", "value": "196608:9UE/LnfDPbeL8fvxPOZq9jyXrpwRQRSWCMoLgRpG82hatmLULTki:+E/OYxWZSusgpZG82hMnLYi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-03T19:19:58+00:00", "last_seen": "2026-06-03T19:19:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898215", "to_ids": false, "type": "size-in-bytes", "uuid": "bd3de127-5f78-44b9-ab26-8d1134fa82cb", "value": "9286635" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-03T19:19:58+00:00", "last_seen": "2026-06-03T19:19:58+00:00", "object_relation": "vhash", "timestamp": "1784898215", "to_ids": true, "type": "vhash", "uuid": "e4fe2291-364a-44ad-b8a7-037c9d7d7619", "value": "44cbacfdb289876e90ab8bc9b533b0d6" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901849", "uuid": "fb4c0292-c7aa-48ef-9c2c-791bd0167106", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "md5", "timestamp": "1784901849", "to_ids": true, "type": "md5", "uuid": "23b440e5-4146-4e62-b119-f7bd0407d2da", "value": "dab9d3d5aac2f6fb3f6e6d26347db63b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "sha1", "timestamp": "1784899486", "to_ids": true, "type": "sha1", "uuid": "e2275332-436c-4e06-8757-330a8d13d1d4", "value": "813dcf0a1624ad62a5239a79b13730ff2840e37e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "sha256", "timestamp": "1784899486", "to_ids": true, "type": "sha256", "uuid": "aaf7d649-4402-45e2-8d21-dbf06669fb46", "value": "7887e919555fb5948c217556ba149392a72982b1bc427d3db779db9dcbf09ee8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 21/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "text", "timestamp": "1784898238", "to_ids": false, "type": "text", "uuid": "788d5020-e49f-4f08-887a-bc08b35266ad", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 01:25 AM 10/14/2025\nSigners: Microsoft Windows Hardware Compatibility Publisher; Microsoft Windows Third Party Component CA 2014; Microsoft Root Certificate Authority 2010\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-02-07T00:21:24+00:00\nLast Submission: 2026-07-09T08:22:26+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "creation-time", "timestamp": "1784898238", "to_ids": false, "type": "datetime", "uuid": "bd936048-9b15-41f3-976c-76d86f5f287b", "value": "2025-10-14T01:12:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "ssdeep", "timestamp": "1784898238", "to_ids": true, "type": "ssdeep", "uuid": "c7e2c85e-4ab0-4a42-8086-836212644328", "value": "768:MNZ+QySDEqPmhnoHXhwkjLmz03JkC9zTZ:NPSDEqPmho3LOezt" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898238", "to_ids": false, "type": "size-in-bytes", "uuid": "56737320-855d-43d1-b8b5-457915b05212", "value": "29864" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "vhash", "timestamp": "1784898238", "to_ids": true, "type": "vhash", "uuid": "b09dfcea-d618-4848-a3d5-db4742fb5a58", "value": "024066651d1516151iz3yz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-07T00:21:24+00:00", "last_seen": "2026-07-09T08:22:26+00:00", "object_relation": "filename", "timestamp": "1784898238", "to_ids": true, "type": "filename", "uuid": "bef2bc2c-3b75-4bc3-902c-23b2b1b47f8c", "value": "MemoryInformer.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901871", "uuid": "3c0e36b3-c7f3-4105-9a9b-86189a11f80c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "object_relation": "md5", "timestamp": "1784901871", "to_ids": true, "type": "md5", "uuid": "7470b6b2-6fef-44aa-b282-d6d7657d06a3", "value": "1d2c4303ca9abebf548f2d552ecee05f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "object_relation": "sha1", "timestamp": "1784899487", "to_ids": true, "type": "sha1", "uuid": "41df1a28-b394-4a86-aa4d-59882dc00e98", "value": "2c226066c90b1d58e0a84971e3069a1aeeb39870", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "object_relation": "sha256", "timestamp": "1784899487", "to_ids": true, "type": "sha256", "uuid": "5f6a8cc3-877c-4553-b745-ce04abc92f7e", "value": "a6fb779be35592fb0ff624a8f8e12ab3cafe7bcfc312cd98263814db7fb01e02", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "object_relation": "text", "timestamp": "1784898261", "to_ids": false, "type": "text", "uuid": "d1c85786-005e-448f-8d9b-bf8c22b5d50c", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 14/74\nFirst Submission: 2026-05-28T18:51:23+00:00\nLast Submission: 2026-05-28T18:51:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "object_relation": "ssdeep", "timestamp": "1784898261", "to_ids": true, "type": "ssdeep", "uuid": "58cb16ef-4128-494e-93dc-6a736b7082c7", "value": "196608:uNA5Qy9JkEBvSDhIzYdSyLnb9+7vl1nyryLNQpCyBz68iqL2KIKAv1pOe5m:6AlQEZS28vLZ0t1nyryLN8CyBtSrIWm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898261", "to_ids": false, "type": "size-in-bytes", "uuid": "9ccdb4a6-9c3e-4dc0-9072-493dc3414671", "value": "10267404" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "object_relation": "vhash", "timestamp": "1784898261", "to_ids": true, "type": "vhash", "uuid": "32798740-10f9-450c-8a71-6664507e2b56", "value": "44cbacfdb289876e90ab8bc9b533b0d6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-28T18:51:23+00:00", "last_seen": "2026-05-28T18:51:23+00:00", "object_relation": "filename", "timestamp": "1784898261", "to_ids": true, "type": "filename", "uuid": "43b78c6f-c40e-48b4-96bc-45d2dd4111fd", "value": "Tax-Number119863.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901894", "uuid": "7e5b2314-e1d4-42c0-87da-795417fbb9ca", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "md5", "timestamp": "1784901894", "to_ids": true, "type": "md5", "uuid": "7b544afc-9d0b-4ca1-91a1-64052f39d4df", "value": "2a98b3f54d6b945fc82f83bbd14e8485", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "sha1", "timestamp": "1784899489", "to_ids": true, "type": "sha1", "uuid": "d77633a2-2429-4d8e-a9ea-47a15220933b", "value": "f51fd9dfa5f1a9cbfaf2d2015696eaa2f534b572", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "sha256", "timestamp": "1784899489", "to_ids": true, "type": "sha256", "uuid": "fe282d54-ad8a-4948-b375-e8f9ea3979f7", "value": "c46e907886e2158cbc453e767183aecf07887b5ac8848f19684451883d69f5f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 21/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "text", "timestamp": "1784898288", "to_ids": false, "type": "text", "uuid": "cc9ae2b0-cb32-4203-84d9-70ad484d276f", "value": "Type Description: Win32 EXE\nOriginal name: selfprot.sys\nVerified: Signed\nSigning date: 02:12 AM 02/17/2016\nSigners: Hubei Century Network Technology Co.,Ltd; VeriSign Class 3 Code Signing 2010 CA; VeriSign\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2023-10-14T14:39:44+00:00\nFirst Submission: 2020-10-30T17:31:34+00:00\nLast Submission: 2026-06-15T12:13:25+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "creation-time", "timestamp": "1784898288", "to_ids": false, "type": "datetime", "uuid": "4dbcbdc7-8a82-4977-aad0-22b9498e9f55", "value": "2016-02-17T02:07:33+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "ssdeep", "timestamp": "1784898288", "to_ids": true, "type": "ssdeep", "uuid": "1712ebcb-dd10-4fad-bd2e-8dad656b2a38", "value": "192:3ffBga3+mVCY7w23rArLsiGZyBh1KUlNjtlANr82Mvr+vyXr9ZCspE+TMArMjZe4:3ffBgaD3rHiGZyBhQgUHMzyeMbL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898288", "to_ids": false, "type": "size-in-bytes", "uuid": "4348ac91-6fbf-4848-aa27-20d329184ac2", "value": "14760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "vhash", "timestamp": "1784898288", "to_ids": true, "type": "vhash", "uuid": "1b20ba71-5a2b-436f-a128-05ebe05856c2", "value": "014086551d15165e55151iz15xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2020-10-30T17:31:34+00:00", "last_seen": "2026-06-15T12:13:25+00:00", "object_relation": "filename", "timestamp": "1784898288", "to_ids": true, "type": "filename", "uuid": "c105e769-6ac5-4d65-a082-bf3edb119256", "value": "selfprot.sys" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784901915", "uuid": "e2aea687-d612-44b1-a6bf-2e41482bbeb4", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "md5", "timestamp": "1784901915", "to_ids": true, "type": "md5", "uuid": "d45fdb7c-a1b6-4855-8955-59820feeae96", "value": "5c2102169a1164a18b979225414f2578", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "sha1", "timestamp": "1784899491", "to_ids": true, "type": "sha1", "uuid": "01aa0c2f-3a41-40f6-b460-31e0d23a3da1", "value": "cf65db1b26ff8597396cc90d4a4d5f879a8176fc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "sha256", "timestamp": "1784899491", "to_ids": true, "type": "sha256", "uuid": "3a5dd091-471e-49bc-9cb8-45b8dc6aab7f", "value": "c5b1e9aafc8f2b4ab05effc00fd43f3114b9ef1d592a086c952793ac4e299809", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "text", "timestamp": "1784898310", "to_ids": false, "type": "text", "uuid": "cf64e176-4b03-4716-9cea-401017f29684", "value": "Type Description: Win32 EXE\nOriginal name: LnvMSRIO.sys\nVerified: Signed\nSigning date: 01:36 AM 09/12/2024\nSigners: Lenovo; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2025-06-08T14:43:45+00:00\nLast Submission: 2026-07-23T03:52:24+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "creation-time", "timestamp": "1784898310", "to_ids": false, "type": "datetime", "uuid": "19b5eae9-6e48-4d8b-b18a-bfb6fc103930", "value": "2024-09-12T01:15:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "ssdeep", "timestamp": "1784898310", "to_ids": true, "type": "ssdeep", "uuid": "21c70791-54e5-4dc8-83d1-72186120b259", "value": "768:vJXG7BaQuvQh/kJlICfU5Yi7AMxkEU2i9z8SJD:vJX4aQuvQh/Gh+77xA2+zll" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898310", "to_ids": false, "type": "size-in-bytes", "uuid": "ac463b52-0cd4-4787-8838-2e116f5b0a15", "value": "40328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "vhash", "timestamp": "1784898310", "to_ids": true, "type": "vhash", "uuid": "98b2b9d9-f70d-4fcd-9ddb-460ff2b950de", "value": "044076551d1516151519z26z13xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-08T14:43:45+00:00", "last_seen": "2026-07-23T03:52:24+00:00", "object_relation": "filename", "timestamp": "1784898310", "to_ids": true, "type": "filename", "uuid": "ecac53b6-2c6b-4bf9-8f48-81f890c3dbaf", "value": "LnvMSRIO.sys" } ] } ] } }