{ "Event": { "analysis": "1", "date": "2026-06-26", "extends_uuid": "", "info": "[Threat Intel] Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment", "protected": false, "publish_timestamp": "1782558466", "published": true, "threat_level_id": "2", "timestamp": "1782558465", "uuid": "99cf3b2b-342f-4093-81d0-a886a99bc34b", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#57356b", "local": false, "name": "misp-galaxy:producer=\"Seqrite\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#d74cce", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Bypass User Account Control - T1548.002\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5c57c8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#17c030", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Window Discovery - T1010\"", "relationship_type": "" }, { "colour": "#bf6f24", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Dynamic Resolution - T1568\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#62f4c1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Discovery - T1057\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#e12cbc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#013748", "local": false, "name": "misp-galaxy:target-information=\"India\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"DCRat\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529207", "to_ids": false, "type": "link", "uuid": "2ce69a4d-3de9-4d3e-9a46-49bad8877c33", "value": "https://www.seqrite.com/blog/operation-dragonreturn-china-nexus-cyber-espionage-campaign-targeting-govt-of-india-mof-tax-infrastructure-via-multi-stage-dcrat-deployment/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782529207", "to_ids": false, "type": "text", "uuid": "2c0527c3-0596-42f7-9cf1-e9715c3b6a00", "value": "A sophisticated China-aligned cyber espionage campaign targeting India's tax infrastructure was identified between May and June 2026. The operation impersonates the Income Tax Department, Ministry of Finance, exploiting the AY2026-27 ITR filing season to target corporate entities, tax professionals, chartered accountants, and taxpayers. The attack employs spear-phishing emails with malicious attachments mimicking legitimate government utilities. The multi-stage infection chain deploys DcRAT through steganographic payload concealment, fileless .NET execution, AMSI bypass, and Windows service persistence. The threat actor demonstrates operational maturity through active payload rotation achieving 0/66 detection rates, encrypted TLS-based C2 communications, and infrastructure hosted across multiple ASNs linked to China. The campaign shows overlaps with the China-nexus threat actor Silver Fox, featuring screen capture capabilities, data exfiltration, and systematic intelligence collection from high-value India..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782529207", "to_ids": false, "type": "text", "uuid": "f30cd85d-a56f-41a6-a826-b0c255a17e6c", "value": "Name: Operation DragonReturn: China-Nexus Cyber Espionage Campaign Targeting Govt. of India/MoF Tax Infrastructure via Multi-Stage DcRAT Deployment\nAuthor: AlienVault\nAdversary: Void Arachne\nTags: [\"china-nexus\", \"income tax impersonation\", \"spear-phishing\", \"steganography\", \"tax infrastructure\", \"fileless execution\", \"operation dragonreturn\", \"dcrat\", \"india targeting\"]\nTgtd countries: [\"British Indian Ocean Territory\", \"India\"]\nMlwr families: [\"DcRAT\"]\nAttack_ids: [\"T1113\", \"T1033\", \"T1548.002\", \"T1204.002\", \"T1543.003\", \"T1566.002\", \"T1566.001\", \"T1082\", \"T1106\", \"T1005\", \"T1140\", \"T1036\", \"T1055\", \"T1010\", \"T1568\", \"T1497\", \"T1057\", \"T1041\", \"T1547.001\", \"T1562.001\", \"T1027\", \"T1573\", \"T1095\", \"T1518.001\", \"T1059.003\", \"T1071.001\"]\nIndustries: [\"Government\", \"Finance\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1782529207", "to_ids": false, "type": "threat-actor", "uuid": "dd2860d5-c388-4312-81bb-05b5e9196fdd", "value": "Void Arachne" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549775", "to_ids": true, "type": "ip-dst", "uuid": "cfc367c4-3885-47b1-883a-ab233d2820aa", "value": "27.50.54.191", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549796", "to_ids": true, "type": "ip-dst", "uuid": "a6d807d8-542f-459a-816b-54cc2f077e4c", "value": "117.44.201.119", "Tag": [ { "colour": "#9ef9a4", "local": false, "name": "asn:asn=\"4134\"", "relationship_type": "" }, { "colour": "#2f9c31", "local": false, "name": "asn:as-owner=\"CHINANET-BACKBONE No.31,Jin-rong Street\"", "relationship_type": "" }, { "colour": "#9256df", "local": false, "name": "asn:as-country=\"CN\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549817", "to_ids": true, "type": "ip-dst", "uuid": "52c38500-433b-42c1-b9ae-5fdfb825ab52", "value": "118.107.0.197", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549838", "to_ids": true, "type": "ip-dst", "uuid": "47620c5f-d08f-4abc-a9a9-5248783363f4", "value": "204.194.48.250", "Tag": [ { "colour": "#4d8803", "local": false, "name": "asn:asn=\"140869\"", "relationship_type": "" }, { "colour": "#313ec0", "local": false, "name": "asn:as-owner=\"TGL-AS-AP Turing Group Limited\"", "relationship_type": "" }, { "colour": "#f36d1b", "local": false, "name": "asn:as-country=\"NZ\"", "relationship_type": "" }, { "colour": "#4f8d3e", "local": false, "name": "misp-galaxy:country=\"new zealand\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549859", "to_ids": true, "type": "ip-dst", "uuid": "8bd9062f-af3a-4b70-a170-0c66fcdab736", "value": "223.26.63.40", "Tag": [ { "colour": "#dd0399", "local": false, "name": "asn:asn=\"152194\"", "relationship_type": "" }, { "colour": "#8c0628", "local": false, "name": "asn:as-owner=\"CTGSERVERLIMITED-AS-AP CTG Server Limited\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549880", "to_ids": true, "type": "url", "uuid": "960aa535-2969-4723-83c2-f093af4f31ac", "value": "http://govtop.one/incometax", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549901", "to_ids": true, "type": "domain", "uuid": "4a603578-09bc-4f1c-802b-4d84cc3f61a7", "value": "1kkkkddd.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549922", "to_ids": true, "type": "domain", "uuid": "cde70cee-1445-4432-84a9-b478c15404dc", "value": "govtop.one", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549944", "to_ids": true, "type": "domain", "uuid": "c8c325eb-0894-4863-adc7-80d62c373359", "value": "ikkkkddd.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549965", "to_ids": true, "type": "domain", "uuid": "6077d616-af8b-4ef4-a9f0-7dcf899bbdd5", "value": "jiayingjing.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782549986", "to_ids": true, "type": "domain", "uuid": "4888653e-f81b-468b-b145-97e30a3fd2f1", "value": "kkxqbh.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782550007", "to_ids": true, "type": "domain", "uuid": "46dec36b-d225-4faa-af53-d61f4ae5dba3", "value": "simaqz.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550028", "uuid": "2d68bdc7-2c9c-47b2-89b8-db3c6f7a610c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550028", "to_ids": true, "type": "md5", "uuid": "3bb69d0e-f374-46b9-8027-7ad38792f097", "value": "7ec462f138432f4da43d942488d3d428", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546557", "to_ids": true, "type": "sha1", "uuid": "5ab61d83-c145-4c12-b591-c85247091606", "value": "5260ac8e82c1280950425bb12ddfb5435ff20539", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546557", "to_ids": true, "type": "sha256", "uuid": "6a497a5f-f186-45de-8740-4244ccf94caf", "value": "c6fc06db6a1318152c09200352b40c8fa794f1089988835c1df92174347be8ec", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540081", "to_ids": true, "type": "ssdeep", "uuid": "d6375678-e1bc-4b05-8090-a74e31a82965", "value": "6144:IszYiZkyHLNomjEOqjTTBE8TIEYOBz476LF6tP8o:I5i2ILPjEOqkr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540081", "to_ids": false, "type": "size-in-bytes", "uuid": "480493d0-72df-4054-bcea-59c15f9b749c", "value": "205824" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540081", "to_ids": true, "type": "vhash", "uuid": "1c9f5527-ce12-4887-92d3-5248989bf11e", "value": "12503e7f5d6\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540081", "to_ids": true, "type": "filename", "uuid": "570380e5-353a-46fb-9afd-c5883aa6f656", "value": "q9qnod.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540081", "to_ids": false, "type": "text", "uuid": "d1dacc02-1163-4fe8-acf8-8818fbff0890", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:27/71\nFirst Submission:2025-12-05T15:30:41.000000+00:00\nLast Submission:2025-12-05T15:30:41.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550049", "uuid": "fc7fffd3-4f55-4476-8fa0-89d5ca59ea33", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550049", "to_ids": true, "type": "md5", "uuid": "f5d21ea6-84e9-4c6d-ac3b-9f4226fd578b", "value": "b26c01dfcc0cdcb30f4a9058f880fb80", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546559", "to_ids": true, "type": "sha1", "uuid": "eab081e1-09f4-4ff2-ad96-18c4002bebce", "value": "7d06bac0114e4c1e9a300d6310a29cf92956c933", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546559", "to_ids": true, "type": "sha256", "uuid": "8d5f2207-a732-46bb-972c-b0b7e3528798", "value": "19ca5fe04ca45a18c5bad9658ff73a8f39fe20ced78f690595f1b4c5a90af324", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540102", "to_ids": true, "type": "ssdeep", "uuid": "5622cca1-347f-4e49-b942-82d2ab3fec64", "value": "1536:Sk9BNdqJ76LF6tP8QaM2D70gpQjRcvka1NPA/Nv4yLY8DgkpGA3GKaRV43hZvWlg:9BNdqJ76LF6tP8RZ0LcDyLY8DgkpG0GE" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540102", "to_ids": false, "type": "size-in-bytes", "uuid": "034aa7fc-8d42-458e-ba06-e66460fbdfdb", "value": "95232" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540102", "to_ids": true, "type": "vhash", "uuid": "087c2642-f2de-4dec-9304-e3063b8a47c2", "value": "19403e6f6d5\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540102", "to_ids": true, "type": "filename", "uuid": "ef00c8de-84ed-46d5-924e-1ea54660bb9e", "value": "4m31t4.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540102", "to_ids": false, "type": "text", "uuid": "e2739484-b0b4-41db-a3aa-fc2e452ff3f7", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:32/71\nFirst Submission:2025-12-05T15:30:34.000000+00:00\nLast Submission:2025-12-05T15:30:34.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550070", "uuid": "83340160-c907-445d-85f0-49c6f306c774", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550070", "to_ids": true, "type": "md5", "uuid": "97587e07-cbd2-4f6d-acb6-fbcc51e8f368", "value": "dda082a12bb43eb34b9b37bf9e62d5f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546560", "to_ids": true, "type": "sha1", "uuid": "c30a9371-129f-4d23-9835-8ae04023c132", "value": "ac2eeef05f568ad36bdcd807159313862a84387d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546560", "to_ids": true, "type": "sha256", "uuid": "47a499e0-3285-4a2b-843e-1a53ab91fbd5", "value": "fc17d5b4d64cb61a5aa8fb6bbe1e94885f129b2bf8ee91bca1ccca2b537f6616", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540124", "to_ids": true, "type": "ssdeep", "uuid": "3d8ba919-892d-4d9c-bf7d-30bc1c8b22f4", "value": "24576:v93JhahXyQg7ZSV8RL6Z5WGc4DYsHQDy6g3P0zAk79oOHp73:Bahc7ZSO56Z5WGc4DYsHQDy6g3P0zAk1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540124", "to_ids": false, "type": "size-in-bytes", "uuid": "d0a8b387-0b81-4b78-8da0-c6d6d8168e23", "value": "915456" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540124", "to_ids": true, "type": "vhash", "uuid": "48091564-d5aa-4807-814d-0d6ede11a818", "value": "1950966d5d155d0d15151088z6c&z109" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540124", "to_ids": true, "type": "filename", "uuid": "c44745d8-7a12-41e5-9bf5-a28f4a236034", "value": "gk28i0no8.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540124", "to_ids": false, "type": "text", "uuid": "3dd9004f-89e8-4d6b-85da-0988f3970728", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:39/71\nFirst Submission:2026-05-25T16:12:05.000000+00:00\nLast Submission:2026-05-25T16:12:05.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550091", "uuid": "820c28c9-18e9-4751-9d71-f272a28fcc7d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550091", "to_ids": true, "type": "md5", "uuid": "5040a360-bca7-49bd-9444-2f5960d5294f", "value": "66ba999063252ab03ea77d4628ec4ad7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546562", "to_ids": true, "type": "sha1", "uuid": "6d5583c2-cb1f-4b1f-b6a1-ed68647f2450", "value": "209f6f7e1aabe0b0ebdf97f7bfc3d413036f1850", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546562", "to_ids": true, "type": "sha256", "uuid": "ff6f1f5f-5306-4bbf-80c8-8844b12fb4ed", "value": "2f2f8f92af86fb962c30c4c1c9d673f9d94886373d0fcf78f8d105c051ffc643", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540145", "to_ids": true, "type": "ssdeep", "uuid": "3ea80819-8508-4dd6-8bef-ad6cf634eaa5", "value": "6144:yNEg9F81ESxK9gJ1G7R8n3YrDNQTtJIHfxIhuGXULLo3VSJgj:REnGGN83YrMJIHfxIsGEXZY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540145", "to_ids": false, "type": "size-in-bytes", "uuid": "aecf9497-d432-4c38-a1cb-b9b3355e936c", "value": "504024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540145", "to_ids": true, "type": "vhash", "uuid": "0d293918-7cc1-4f28-87e6-a993d2ec3737", "value": "155096655d155d0d15151az5d=z73" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540145", "to_ids": true, "type": "filename", "uuid": "1a45ae14-fcee-479d-ac8e-5391a11e08e3", "value": "libEGL.dll" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540145", "to_ids": false, "type": "text", "uuid": "c8c7a75e-2999-4f4a-bfa8-b3230cdd5749", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:32/71\nFirst Submission:2026-05-18T14:23:28.000000+00:00\nLast Submission:2026-05-18T14:23:28.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550112", "uuid": "226a0cb2-04c9-4207-a4a8-5d10f90f6a22", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550112", "to_ids": true, "type": "md5", "uuid": "1f2b84fd-9a53-4d2d-a0fd-773aea03842e", "value": "e1d891ef6048dcae17203d5ea46f2e53", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546563", "to_ids": true, "type": "sha1", "uuid": "b178ad47-0f98-4437-840d-6676c8464423", "value": "321a549bcd43ad6abf828f715dcb0a613c0aa3f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546563", "to_ids": true, "type": "sha256", "uuid": "8e77ebf4-bb30-487e-bd3c-93c502c6420c", "value": "34d1231a3bf1e13a9b90daecb5c74d52aea94ca54427b203d77e1adc61a5c4f9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540167", "to_ids": true, "type": "ssdeep", "uuid": "1ea74c02-9df9-4aa9-99da-35f660a0b1c5", "value": "6144:yNEgz2i1ESxK99+zkrh6RT++bZW1F6OGXUrLO3SSJgj:yEn99h6RTBbZI6OGE3iY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540167", "to_ids": false, "type": "size-in-bytes", "uuid": "6ac73447-a129-4a8a-8b76-912a9074a9c2", "value": "504024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540167", "to_ids": true, "type": "vhash", "uuid": "43e4c70c-1921-40c9-a160-3df12da0699f", "value": "155096755d155d0d15151az5d=z73" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540167", "to_ids": true, "type": "filename", "uuid": "f678146f-f18f-4232-8c5d-4eb9ff19c266", "value": "libEGL.dll" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540167", "to_ids": false, "type": "text", "uuid": "ce81b7a5-d7db-4925-9802-887f4a8954df", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:1/71\nFirst Submission:2026-06-12T08:43:52.000000+00:00\nLast Submission:2026-06-24T07:26:07.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550133", "uuid": "8b0c38f7-36ea-480f-8ed2-5bd668f50fa5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550133", "to_ids": true, "type": "md5", "uuid": "9986168c-336b-42fe-a01d-678b3c697bfc", "value": "353e55b7bc462640267a68b28529c129", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546564", "to_ids": true, "type": "sha1", "uuid": "ecbe31c3-2df3-4920-a0c8-bd0ed50392fd", "value": "5f6c9c7125ef42a16d08a644fb73764c4e1c610f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546565", "to_ids": true, "type": "sha256", "uuid": "600f349f-e42c-4264-aaea-ae82c2c0f52e", "value": "4a040770fd81d0db9e04cb8dbd2e07e61969072962bb4e736b7c7001444cc2fa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540189", "to_ids": true, "type": "ssdeep", "uuid": "ce28a8c0-a615-42fd-a9bd-e639f1b8d630", "value": "24576:toSIIDJphILbEOq/c9F3uKb573eyOZCYMHT:torlLAODNPb5hICYU" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540189", "to_ids": false, "type": "size-in-bytes", "uuid": "18f8acad-ea16-4dfe-999c-2fa81bfbb38d", "value": "1125888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540189", "to_ids": true, "type": "vhash", "uuid": "bf4a1554-b4f5-4e1d-b8eb-a916dc27fd55", "value": "016076655d655d05555015z6006e7z27z32z1c5z46z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540189", "to_ids": true, "type": "filename", "uuid": "2153bf80-31a0-4074-a9fd-265ab38f7524", "value": "iw669r8x.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540189", "to_ids": false, "type": "text", "uuid": "06cf9975-932f-4b6e-b94d-fd98b24034e4", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nVT Total Detection:50/71\nFirst Submission:2026-03-17T05:47:47.000000+00:00\nLast Submission:2026-03-18T05:13:42.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550155", "uuid": "6f594562-26a5-4466-ab30-c0261ba9ee2c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550155", "to_ids": true, "type": "md5", "uuid": "0a765ec8-85b3-436c-8e19-9dc71513fc38", "value": "6bd03dbb7911ff82477ca3aee912b660", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546566", "to_ids": true, "type": "sha1", "uuid": "44422f81-765d-44e0-b981-1514c69fb8c6", "value": "9e25aca0817fdd4c0b645a8f41bbb9423d276493", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546566", "to_ids": true, "type": "sha256", "uuid": "f502b5c0-f055-413d-90d2-d2503f5781f4", "value": "589aa1f7252cae74538343cd35443c0a8f58ed280f2016918b6e539a0c09529a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540211", "to_ids": true, "type": "ssdeep", "uuid": "d8510d61-ab1b-4fac-8fc6-6990cfefef1b", "value": "24576:+Qu/fBCq/8dsX671O1RBz1kxqQCK2CJ/Y:bq5CcKsX67Gz1kxEK2mA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540211", "to_ids": false, "type": "size-in-bytes", "uuid": "2e5241ac-65ff-4698-a35a-e8f1a64480e5", "value": "1169990" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540211", "to_ids": true, "type": "vhash", "uuid": "12ba405c-e5b8-4ceb-9742-ae3447266e98", "value": "016076656d151505151\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540211", "to_ids": true, "type": "filename", "uuid": "744f6e2a-371d-4706-ad78-c7c9cf50b03f", "value": "r9jt7on3.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540211", "to_ids": false, "type": "text", "uuid": "3097ef1e-8a6e-41e7-98fe-0a430ce85db6", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:22/71\nFirst Submission:2026-06-09T09:43:22.000000+00:00\nLast Submission:2026-06-09T09:43:22.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550176", "uuid": "960b5f8d-b2a8-41ca-b0ba-54f5446bf6bc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550176", "to_ids": true, "type": "md5", "uuid": "b485d819-3e83-4905-ab5d-3f6872b9c9ce", "value": "96c22c45f4eafafac448627f5ef0750b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546567", "to_ids": true, "type": "sha1", "uuid": "e4a3b214-2318-44c0-90d1-5e6b5fd36893", "value": "5574a65932ec66a3e2fbc102f9681c9c9b118cdc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546567", "to_ids": true, "type": "sha256", "uuid": "72b92873-61d6-4cc1-844e-08f67da0864e", "value": "5a00485968679dc0ed6d80b659f48287603864c223e952918d2c2aaddfa2d280", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540233", "to_ids": true, "type": "ssdeep", "uuid": "f0093e60-0c5b-458b-a5f6-322308a8badf", "value": "3072:dMGk6vti+Os7HmBT4A8/VEQHOE/wcVCltWaUPzvnFpk:Sf6sTr8/SE/wcYTkbvnvk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540233", "to_ids": false, "type": "size-in-bytes", "uuid": "b00e628e-4588-4d01-9a40-e980f43670de", "value": "137223" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540233", "to_ids": true, "type": "vhash", "uuid": "c2934f48-52f1-449b-a644-d3aebb26c54b", "value": "115036076d5\"z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540233", "to_ids": true, "type": "filename", "uuid": "6e5877f3-d70b-4e10-ae43-38529bac80db", "value": "hbxasi398.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540233", "to_ids": false, "type": "text", "uuid": "8122a264-5cf6-4795-9b73-0510e95d0f57", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:6/71\nFirst Submission:2026-05-27T11:16:54.000000+00:00\nLast Submission:2026-05-27T11:16:54.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550197", "uuid": "0fce2a1b-3068-4893-8699-d27675595169", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550197", "to_ids": true, "type": "md5", "uuid": "1754b830-1564-40c1-aa0b-da77b1c1f417", "value": "3fdceb0353c8671ae35a1be1438a8b3b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546569", "to_ids": true, "type": "sha1", "uuid": "4b204039-660b-4c70-8e02-e34bb6b009e1", "value": "02b24296b4f2bbd4d19e5e09ac7d8d8902c32214", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546569", "to_ids": true, "type": "sha256", "uuid": "8fb2c708-2747-4dc2-a257-05a91bd6dbdc", "value": "5e97f7c17bf0466355be0438c7cc3e2e4d125e31368f2fbcb8e1d79cb97f137a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540254", "to_ids": true, "type": "ssdeep", "uuid": "730161e3-6b9a-4172-97bf-bac97b19b060", "value": "3072:uMGk6vti+Os7HmBT4A8/VEQHOE/wcVCltW/n8TWRzvnF8:Xf6sTr8/SE/wcYT68TWdvnm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540254", "to_ids": false, "type": "size-in-bytes", "uuid": "9c1376c8-daa9-462d-8a7d-4d43b333a64a", "value": "132096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540254", "to_ids": true, "type": "vhash", "uuid": "d53be03f-d3ff-45f2-be0f-5694eac8c542", "value": "115036671d1~z18" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540254", "to_ids": true, "type": "filename", "uuid": "3613a37b-e059-44fc-9e8c-e920064072c1", "value": "VTCP.dll" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540254", "to_ids": false, "type": "text", "uuid": "afd1640f-d50c-40b9-a51e-c6fecaf27fb6", "value": "Type Description: Win32 DLL\nMicrosoft: None\nVT Total Detection:13/71\nFirst Submission:2026-06-09T09:43:16.000000+00:00\nLast Submission:2026-06-09T09:43:16.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550218", "uuid": "6ee49333-5933-4def-8cf3-301618f0a22e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550218", "to_ids": true, "type": "md5", "uuid": "a2a98f0a-7c58-426e-a759-f14c085493c4", "value": "dc69c01e1bb18a6d8d8b1d2be047f884", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546570", "to_ids": true, "type": "sha1", "uuid": "8a27f81d-b9fe-41c6-accd-d25b41047da4", "value": "2b8d9060ea0bc3eb4a1101cb2049c9f87827b9ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546570", "to_ids": true, "type": "sha256", "uuid": "c4299ef0-0931-4e8d-87f4-875d33ff3b2a", "value": "6c774188a54ae07ae896abdf1ea6695cc29f529388888665e05322af3e9178e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540276", "to_ids": true, "type": "ssdeep", "uuid": "cdd6ba7c-f0c4-4151-a27f-1a288193afc5", "value": "24576:Xo8+zVQ152TLYb2QXyH2vk2SEIrnuwcQ2CJ/:4NxQnrlML12m" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540276", "to_ids": false, "type": "size-in-bytes", "uuid": "4e5e0d43-3955-4bf9-b6ba-e45fe34341ad", "value": "1141760" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540276", "to_ids": true, "type": "vhash", "uuid": "68b99749-e1d3-4ed8-9b16-9ea13412d36e", "value": "016076656d155515155058z5d9z55z3lz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540276", "to_ids": true, "type": "filename", "uuid": "622a4e11-1d72-43b2-906a-3725a901126f", "value": "fjae2x6t.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540276", "to_ids": false, "type": "text", "uuid": "fb70406c-61cc-4163-bd12-d7fe63ce7732", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Egairtigado!rfn\nVT Total Detection:44/71\nFirst Submission:2026-05-18T14:28:56.000000+00:00\nLast Submission:2026-05-18T14:28:56.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550239", "uuid": "8fddcada-3802-4b3c-b73c-1533b7a64dde", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550239", "to_ids": true, "type": "md5", "uuid": "f9bdcb7b-9462-41df-aa63-ea314bb6fb07", "value": "dd2282bc697c779de2c25278102adff6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546572", "to_ids": true, "type": "sha1", "uuid": "9393a8a3-9114-4187-9e85-fc2a39186abf", "value": "e4a996ab1f29b12f2b496707411fc82e36258641", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546572", "to_ids": true, "type": "sha256", "uuid": "442de41c-4aed-4863-be87-3b23396386b2", "value": "7e142c8fa614cc39d0453aa648b12209821c6bcbb77ee02094f70161b40d50ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540297", "to_ids": true, "type": "ssdeep", "uuid": "7886eea6-9660-4171-bddd-ce3d8ac2ee93", "value": "1536:DpJ1PW6J2VUpsJKIe83lG7EUJeY6U/D1jayH3k+p8THdSQDXQq4IJgGEWPsWfdUI:ZI1KM0vPfD33k+y9TzQq4/GTLsRmv1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540298", "to_ids": false, "type": "size-in-bytes", "uuid": "db071041-dfa2-4b02-bd17-8352f201b0ca", "value": "123392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540298", "to_ids": true, "type": "vhash", "uuid": "1948d4d1-13a8-4fe2-ab6c-e1b5eb6f1aab", "value": "115076655d155d05155038z56hz20101011z1bz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540298", "to_ids": true, "type": "filename", "uuid": "e37ea91a-30ed-48bf-b981-43007fb3964e", "value": "s8nfl.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540298", "to_ids": false, "type": "text", "uuid": "d55d9461-20a0-45f7-8101-b96abbfcf9b0", "value": "Type Description: Win32 DLL\nMicrosoft: TrojanDownloader:Win32/Small.gen!AO\nVT Total Detection:47/71\nFirst Submission:2026-05-27T11:13:45.000000+00:00\nLast Submission:2026-05-27T11:13:45.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550260", "uuid": "2ef480bf-b5a6-4cbc-a485-251ece7d3acd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550260", "to_ids": true, "type": "md5", "uuid": "d52c3368-66ca-44b0-af51-7a80ac42ded9", "value": "04e7f7422425ce8451ab21450f8983b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546573", "to_ids": true, "type": "sha1", "uuid": "afeb5c5b-c879-449f-b5a1-4d0435717b89", "value": "a26a77c7348a3b72e04be0d2bc92194a74ce0144", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546573", "to_ids": true, "type": "sha256", "uuid": "430531fc-3723-4843-a183-29a878492f3e", "value": "8ed95259300ca268279867d2999d9c4f6585c6c45308635fc39af87da27546b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540320", "to_ids": true, "type": "ssdeep", "uuid": "9cffa012-0fec-4774-ba77-9d194cc9e7b1", "value": "3072:xgSYOHu5rsgbD4Uy7XsiwtzQjlUkiMva3cZQm+BNOT:2SYOHEoU/ssi4zceBIT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540320", "to_ids": false, "type": "size-in-bytes", "uuid": "699d3aa1-f221-4017-9208-5868edf54271", "value": "126464" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540320", "to_ids": true, "type": "vhash", "uuid": "b40cca82-c7eb-4625-844a-e4749f9f33a6", "value": "115076655d555d05555az4e?z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540320", "to_ids": true, "type": "filename", "uuid": "16852e64-ca65-4aeb-93d9-279a09201663", "value": "wz9464.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540320", "to_ids": false, "type": "text", "uuid": "3168b751-fcdb-4c1f-82dd-9d49c7f90ae7", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:29/71\nFirst Submission:2026-03-17T05:47:52.000000+00:00\nLast Submission:2026-03-17T05:47:52.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550282", "uuid": "33fe27c7-4ff1-46a1-9489-540d913a2274", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550282", "to_ids": true, "type": "md5", "uuid": "f0e7a674-df80-43c8-915a-7a910c1b50ac", "value": "90016e26410da8a53e9c2b26ce0a5c08", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546575", "to_ids": true, "type": "sha1", "uuid": "b8a5b740-fab9-45e9-8171-e309e5dad98c", "value": "04b777d301fcaf0a490ca43f061dec8c3da993eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546575", "to_ids": true, "type": "sha256", "uuid": "f46fdd04-629b-4d64-a438-32a4a95488f5", "value": "a8614dfad5fd2a79302a7c4829a0fed6f3a0a46b11beb28f89531cdfa83d32b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540342", "to_ids": true, "type": "ssdeep", "uuid": "36c8f827-440e-4c06-bdb0-9011739ff626", "value": "6144:iNEgJF81ES1zTOyHkHcBE5q+LHRTtJIHfxIhuGXUELl3SSJgj:FEgTOyEHcBE5qOJIHfxIsGE0VY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540342", "to_ids": false, "type": "size-in-bytes", "uuid": "68c1c8f5-b2f5-4c0f-bc17-5e57c4e2231e", "value": "504024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540342", "to_ids": true, "type": "vhash", "uuid": "646d1da1-3610-4a59-8591-c162a5cdbb4b", "value": "155096655d155d0d15151az5d=z73" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540342", "to_ids": true, "type": "filename", "uuid": "45c1d17d-5afa-4b63-af9a-895d44d0d26a", "value": "libEGL.dll" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540342", "to_ids": false, "type": "text", "uuid": "5862c01a-43f7-4aa9-993c-3d58869bd7c2", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:28/71\nFirst Submission:2026-06-09T09:38:35.000000+00:00\nLast Submission:2026-06-09T09:38:35.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550303", "uuid": "dbc6fbc7-d877-4fe4-945c-bc6ca38136bc", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550303", "to_ids": true, "type": "md5", "uuid": "105aae35-6a05-421b-8daf-b3f77d560380", "value": "732f41faff82a3627cd5ae25cc4b0e3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546576", "to_ids": true, "type": "sha1", "uuid": "2439dae2-651f-4144-ac6a-27ff8e9bb379", "value": "b92d0e5c99286c1f5f79bd4b3b6707acdf3862a8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546576", "to_ids": true, "type": "sha256", "uuid": "1863d3f8-f970-45ff-bdf4-54f3013057e1", "value": "b0fcd7d9396e70b89e8292f6b80f933607b6fc9a9d3d4dd4ca69b408a2625932", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540364", "to_ids": true, "type": "ssdeep", "uuid": "839614fb-6985-4c98-95cd-50a198ea93b9", "value": "1536:1pJ1PW6J2VUpsJKIe83lG7EUJeY6U/D1jayH3k+p8THdSQDXQq4FxgGEWPsWfdU5:DI1KM0vPfD33k+y9TzQq4cGTLsSmv1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540364", "to_ids": false, "type": "size-in-bytes", "uuid": "928b6838-a5f7-459b-8ab7-6e383120cddc", "value": "122880" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540364", "to_ids": true, "type": "vhash", "uuid": "fd53244d-bf55-4532-9e28-f7498a70b67c", "value": "1150766d5d155d05155038z56hz20101011z1bz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540364", "to_ids": true, "type": "filename", "uuid": "2bd66b78-820b-4b55-9771-32f3edb00897", "value": "y0icmg3.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540364", "to_ids": false, "type": "text", "uuid": "a8e88595-a4e9-47f2-9cf1-01344e5d3117", "value": "Type Description: Win32 DLL\nMicrosoft: TrojanDownloader:Win32/Small.gen!AO\nVT Total Detection:47/71\nFirst Submission:2026-06-09T09:43:24.000000+00:00\nLast Submission:2026-06-09T09:43:24.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550324", "uuid": "c8fbe6eb-136c-4186-b78a-f7070ae1e494", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550324", "to_ids": true, "type": "md5", "uuid": "5ecbd4f3-75af-4cbd-9cd3-2a7481a00dce", "value": "20d4a47a6f8e4f0a2733317b4fadf0cc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546577", "to_ids": true, "type": "sha1", "uuid": "dec27396-c5cb-4cd3-b569-8989a3e870d3", "value": "7e3b013f1192d3aa1e63635c43ccdad60ab0dd12", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546578", "to_ids": true, "type": "sha256", "uuid": "e6930e72-6bd5-47f1-889b-6e3b8cf498b5", "value": "c6651d6ce31c3a00357e579981d48c0da942b5bbe1582bf3d612a07dc3bc0ff6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540386", "to_ids": true, "type": "ssdeep", "uuid": "3d8c9f7e-0599-463d-8f26-dd6e58e3a962", "value": "6144:MNEgJF81ES1zTOyHkHcBE5q+LHRTtJIHfxIhuGXUEV1KWq:HEgTOyEHcBE5qOJIHfxIsGE61" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540386", "to_ids": false, "type": "size-in-bytes", "uuid": "9378195d-0af1-4619-8d7d-19d1bf58dc19", "value": "483328" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540386", "to_ids": true, "type": "vhash", "uuid": "52278284-f3cc-420a-b93e-c5de67786c93", "value": "1450966d5d155d0d15151az5d=z73" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540386", "to_ids": true, "type": "filename", "uuid": "37b13f1e-8213-4def-b432-991e420c699f", "value": "libEGL.dll" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540386", "to_ids": false, "type": "text", "uuid": "e3a364af-4615-4090-96c4-0bf8a538b052", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Ravartar!rfn\nVT Total Detection:42/71\nFirst Submission:2026-06-09T09:43:26.000000+00:00\nLast Submission:2026-06-09T09:43:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550345", "uuid": "4fac28ee-7d7e-4119-90ee-f3edc4c9b440", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550345", "to_ids": true, "type": "md5", "uuid": "a378d9df-217c-4f29-9fc7-0c90e219b718", "value": "c67e5693cafe60bad7bcc4005f8b73f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546579", "to_ids": true, "type": "sha1", "uuid": "b53bc66f-4b68-42cb-a165-b5bcf7b504b9", "value": "40a6eae7201a3bdcd6ca9f48339f4906f8750b50", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546579", "to_ids": true, "type": "sha256", "uuid": "624f1be6-83d9-4b46-86cf-a22ca8de1ccc", "value": "ec5d4103b3d97885e9575ad045b2ef5467bf9fccf71828e418e6488d78983146", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540407", "to_ids": true, "type": "ssdeep", "uuid": "98cd787b-be13-4a8e-bc9b-3bdc3c976488", "value": "6144:QNEgaF81kSxK99+zkhh6RVHcBE5q+LHRTtJIHfxIhuGXULLj3SSJgj:6kn9/h6RVHcBE5qOJIHfxIsGEXnY" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540407", "to_ids": false, "type": "size-in-bytes", "uuid": "8ed2e443-9668-43ec-ac89-39154548710e", "value": "504024" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540407", "to_ids": true, "type": "vhash", "uuid": "d2f23842-6461-436c-a989-a2e6da367730", "value": "155096655d155d0d15151az5d=z73" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540407", "to_ids": true, "type": "filename", "uuid": "b71a91a2-e5d1-4e4d-9459-573777c76dd6", "value": "libEGL.dll" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540407", "to_ids": false, "type": "text", "uuid": "15c718b9-8d2f-4110-8629-1ff4ffef37bc", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Wacatac.B!ml\nVT Total Detection:33/71\nFirst Submission:2026-05-30T23:30:13.000000+00:00\nLast Submission:2026-05-30T23:30:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782550367", "uuid": "b64f7db2-28e1-46ad-8480-0a1d5ac11731", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782550367", "to_ids": true, "type": "md5", "uuid": "f34231f1-430e-4ec1-9214-769696de7118", "value": "1c612ae0ecb6c3624c0e8e89fed7b96e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782546580", "to_ids": true, "type": "sha1", "uuid": "f73f28c5-4ca2-4172-b994-119e8ed42f7c", "value": "b5466844fb974886297d3f7e4e6952f07a9be499", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782546580", "to_ids": true, "type": "sha256", "uuid": "07ee49a5-f1b5-4c8e-a0b8-6a4d24066710", "value": "eccff5c026a01cbe91db45cd0289f8822985aa5183f096d8add69762696d100d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782540429", "to_ids": true, "type": "ssdeep", "uuid": "cc3861c1-eec2-4664-b8df-470d4e89a331", "value": "1536:spJ1PW6J2VUpsJKIe83lG7EUJeY6U/D1jayH3k+p8THdSQDXQq4h0gGEWPsWfdUI:YI1KM0vPfD33k+y9TzQq4jGTLsRmv1" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782540429", "to_ids": false, "type": "size-in-bytes", "uuid": "beb32063-3456-4d16-8862-5defb5475a22", "value": "122880" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782540429", "to_ids": true, "type": "vhash", "uuid": "9b8dbe0c-bff1-4949-9245-ca7e49894810", "value": "1150766d5d155d05155038z56hz20101011z1bz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782540429", "to_ids": true, "type": "filename", "uuid": "dfc05239-9df2-4852-8145-daeded29e6d2", "value": "09ka0d.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782540429", "to_ids": false, "type": "text", "uuid": "34827fcb-0399-40e2-9441-d5a4309bad26", "value": "Type Description: Win32 DLL\nMicrosoft: TrojanDownloader:Win32/Small.gen!AO\nVT Total Detection:47/71\nFirst Submission:2026-05-27T11:16:59.000000+00:00\nLast Submission:2026-05-27T11:16:59.000000+00:00" } ] } ] } }