{ "Event": { "analysis": "1", "date": "2026-06-25", "extends_uuid": "", "info": "[Threat Intel] Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access", "protected": false, "publish_timestamp": "1782531167", "published": true, "threat_level_id": "3", "timestamp": "1782531167", "uuid": "9f97e5ae-cb15-4a1c-b4f9-b92060406774", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#96f4f6", "local": false, "name": "misp-galaxy:producer=\"Microsoft\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#d3f567", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#82eae0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domains - T1583.001\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#4a5d84", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1583.006\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#1acf09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Trusted Relationship - T1199\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#add7fd", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Services - T1584.006\"", "relationship_type": "" }, { "colour": "#f07d7c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#3f00e6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Compile After Delivery - T1027.004\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Hospitality\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Hotels\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:region=\"142 - Asia\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:region=\"150 - Europe\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#fdcb58", "local": false, "name": "rectifyq:MY-relevancy=\"somewhat-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782471610", "to_ids": false, "type": "link", "uuid": "19d9d515-9dbf-4e8a-9209-42d8fa609d1b", "value": "https://www.microsoft.com/en-us/security/blog/2026/06/25/photo-zip-campaign-targeting-hospitality-industry-delivers-node-js-implant-persistent-access/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782471610", "to_ids": false, "type": "text", "uuid": "f4bbfc96-7f88-461f-83bb-11b0df3a4eb7", "value": "Since April 2026, a sophisticated multi-stage intrusion campaign has targeted hospitality and hotel organizations across Europe and Asia. The operation uses photo-themed ZIP archives containing malicious shortcut files disguised as images. When executed, these shortcuts initiate an attack chain involving obfuscated PowerShell, Node.js-based implants, and dual registry persistence mechanisms. The threat actor exploits legitimate services like Calendly and Google redirects for phishing delivery, employing authentication laundering to bypass email security controls. The campaign evolved through two waves, introducing .NET DLL compilation, Cloudflare-fronted infrastructure, and refined obfuscation techniques. Post-compromise activities include command-and-control beaconing over non-standard ports, forced shutdowns, and portable executable compilation, suggesting preparation for additional malicious operations." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782471610", "to_ids": false, "type": "text", "uuid": "2dac6a93-813b-41a5-af5c-0d856ddb9474", "value": "Name: Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access\nAuthor: AlienVault\nAdversary: \nTags: [\"authentication laundering\", \"wacatac\", \"purerat\", \"tonrat\"]\nTgtd countries: []\nMlwr families: [\"TonRAT\", \"Wacatac\", \"PureRat\"]\nAttack_ids: [\"T1059.007\", \"T1204.002\", \"T1566.002\", \"T1583.001\", \"T1036\", \"T1016\", \"T1583.006\", \"T1059.001\", \"T1547.001\", \"T1199\", \"T1562.001\", \"T1584.006\", \"T1571\", \"T1027\", \"T1027.004\"]\nIndustries: [\"Hospitality\"]" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529306", "to_ids": true, "type": "ip-dst", "uuid": "20273775-f6ae-47ca-a444-2480ca3b21f0", "value": "178.16.54.27", "Tag": [ { "colour": "#ce048f", "local": false, "name": "asn:asn=\"209800\"", "relationship_type": "" }, { "colour": "#434f78", "local": false, "name": "asn:as-owner=\"METASPINNER-ASN\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529327", "to_ids": true, "type": "domain", "uuid": "63f164c4-adb0-4c46-9234-3777b38f6209", "value": "zloapobikahy23.bond", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529349", "to_ids": true, "type": "domain", "uuid": "6c26ae8f-98c2-4c6c-b258-36cf851b7042", "value": "prejointl.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529370", "to_ids": true, "type": "domain", "uuid": "62aedcd1-7075-409b-b3bc-58a7c7182137", "value": "recallnine.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529391", "to_ids": true, "type": "domain", "uuid": "33c149b0-5e51-47e1-aa1f-ba1ddc303175", "value": "visaphoto-secure.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529412", "to_ids": true, "type": "domain", "uuid": "39fd0c95-1d73-43ad-b03f-8eb20a0f80ea", "value": "ministrew.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529433", "to_ids": true, "type": "domain", "uuid": "da7c17fd-b4b3-465f-93c7-153fb076414d", "value": "heliosup.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529454", "to_ids": true, "type": "domain", "uuid": "f0e78550-e2b1-46a3-b79e-1a977a9b7415", "value": "docshub-secure.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529476", "to_ids": true, "type": "domain", "uuid": "712a4c61-4cde-469a-a367-b40a61e84e1e", "value": "visaimage-storage.icu", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529498", "to_ids": true, "type": "domain", "uuid": "9db6f420-f817-4e88-aaae-9f2eb9c181ca", "value": "safephoto-vault.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529519", "to_ids": true, "type": "domain", "uuid": "f98bd221-6e78-42b6-a275-ac227aef3207", "value": "keypmenu.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529540", "to_ids": true, "type": "domain", "uuid": "4d62dbd9-a48f-497e-a1ae-27302e90a6a9", "value": "kellystreets.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529562", "to_ids": true, "type": "domain", "uuid": "2740da7c-5658-42e1-8017-2fdc325421ba", "value": "image-vlt.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529583", "to_ids": true, "type": "domain", "uuid": "2fd4ec3e-6f92-48b8-9aeb-2804712f23d4", "value": "visaphoto-vault.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529604", "to_ids": true, "type": "domain", "uuid": "e504708c-7b5a-484b-a7b3-26af7230e9de", "value": "safe-picvault.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529625", "to_ids": true, "type": "domain", "uuid": "fde46cb0-44d4-4133-bc21-c9e7bd33aa7a", "value": "safedoc-storage.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529646", "to_ids": true, "type": "domain", "uuid": "e6af0346-dd10-4d1d-9943-4a23e49ad1e0", "value": "photobook-reserv.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529667", "to_ids": true, "type": "domain", "uuid": "3aff26c3-0770-43c0-bc1c-9b47447b7d49", "value": "imagestore-hub.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529688", "to_ids": true, "type": "domain", "uuid": "6032d3eb-c88f-4073-9a3d-e7566ba80bf8", "value": "photo-box.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529709", "to_ids": true, "type": "domain", "uuid": "6938463c-1db2-4a12-96e0-d0c6865fd41f", "value": "photo-hub-io.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529730", "to_ids": true, "type": "domain", "uuid": "d6380705-bdcb-4689-a2e6-1f606e4ae3a7", "value": "sec-safe-dc.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529751", "to_ids": true, "type": "domain", "uuid": "08f46a1d-436f-41a7-840d-afbbf9e3dd93", "value": "hakeiwjs727wj.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529773", "to_ids": true, "type": "domain", "uuid": "ac5240b4-d76d-4a84-941a-1dbc7c7fd8df", "value": "photo-dekor.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529794", "to_ids": true, "type": "domain", "uuid": "4e517bcc-669f-4eff-83a4-6a598c445b55", "value": "photobookadm.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529816", "to_ids": true, "type": "domain", "uuid": "f0fe2a6a-3c12-42ef-b694-ae213487f66e", "value": "haobbao.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529837", "to_ids": true, "type": "domain", "uuid": "07ead1a7-feaa-4d06-9c9b-9e92ebc00b78", "value": "recstrace.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529858", "to_ids": true, "type": "domain", "uuid": "bad1851d-d7e6-44ed-a30a-6f7357f3c5e7", "value": "vertualstreak.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529879", "to_ids": true, "type": "domain", "uuid": "f67fb7c6-8540-458c-8dcd-12b39020bb57", "value": "dancamp.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529900", "to_ids": true, "type": "domain", "uuid": "79c30c01-f1d3-4c63-ab2c-cc1f6369afc9", "value": "docshub-01.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529921", "to_ids": true, "type": "domain", "uuid": "21547b6d-ce77-4a31-8fa1-2fa55bd42200", "value": "montagelips.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529943", "to_ids": true, "type": "domain", "uuid": "95999a6f-0752-476f-ad2a-704420f761b2", "value": "safedocphoto.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529964", "to_ids": true, "type": "domain", "uuid": "fa600e50-e907-44a5-908f-415f3e77926f", "value": "visaimages.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782529985", "to_ids": true, "type": "domain", "uuid": "61257ac6-816f-4670-b59d-54db4f283239", "value": "photo-26254.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530006", "to_ids": true, "type": "domain", "uuid": "e879d425-5fcf-4c4b-9068-cdd8c7eb48c1", "value": "photo-26654.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530027", "to_ids": true, "type": "domain", "uuid": "e000f442-55be-4d76-b063-8a5851e52131", "value": "photo-26656.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530048", "to_ids": true, "type": "domain", "uuid": "ec2ed15b-814d-4bb8-85dc-ede06dcf1bc9", "value": "photo-26653.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530069", "to_ids": true, "type": "domain", "uuid": "8ba04131-433a-400e-8a04-53bfbae6dc6f", "value": "photo-27857.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530090", "to_ids": true, "type": "domain", "uuid": "abba07a6-79e5-4600-b83a-7f53c1b0befb", "value": "widjssij728dj.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530112", "to_ids": true, "type": "domain", "uuid": "48a57cdd-018a-4d67-99b9-e626bf890bd5", "value": "reservebookphot.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530133", "to_ids": true, "type": "domain", "uuid": "79e9159d-2be6-488a-8a65-9beee6f91cf2", "value": "finallyrain.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528018", "to_ids": true, "type": "md5", "uuid": "13af9241-754d-4d73-826f-6d5485953e19", "value": "17082531775760189576112827972435", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528020", "to_ids": true, "type": "md5", "uuid": "d932d11f-fdeb-486b-bd75-7b4803d94d6f", "value": "25908558764390958596189327204542", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528021", "to_ids": true, "type": "sha256", "uuid": "319a8e30-cc45-4d88-bb6b-386de25a1e26", "value": "1c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528022", "to_ids": true, "type": "sha256", "uuid": "e3e1615e-2e56-4e0b-9373-add3698c1467", "value": "1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528023", "to_ids": true, "type": "sha256", "uuid": "007cd802-fb77-4a0e-b6eb-62abf99bef56", "value": "49cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528024", "to_ids": true, "type": "sha256", "uuid": "9e8146a8-fc6c-4bca-9b22-003e375381ab", "value": "6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528025", "to_ids": true, "type": "sha256", "uuid": "e9a9f8a2-01dc-4f4d-aa07-22e03d83a7fc", "value": "89934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c1028", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528026", "to_ids": true, "type": "sha256", "uuid": "624a6f2c-03c5-4621-9410-9201ce5a3400", "value": "97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528027", "to_ids": true, "type": "sha256", "uuid": "7e588b46-9e9d-4522-852c-fffcb1937b63", "value": "9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528029", "to_ids": true, "type": "sha256", "uuid": "afcf4044-d43a-4542-800e-f5462133e0f4", "value": "b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528030", "to_ids": true, "type": "sha256", "uuid": "b6fb05ff-f833-4b8f-bef6-4e31be8d2d88", "value": "bd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528030", "to_ids": true, "type": "sha256", "uuid": "b2e32232-bb87-433a-b998-855d81a765b3", "value": "c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:27/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782528032", "to_ids": true, "type": "sha256", "uuid": "7bfa64c7-7e63-445a-9757-719525ae2318", "value": "da4b72764ae929050353f3da759c839e2a061a8b9a8dd3c3b2e909d4a8a3291c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530154", "to_ids": true, "type": "ip-dst", "uuid": "6f6caa61-b59f-48ad-ab6b-dad542a562ed", "value": "178.16.55.179", "Tag": [ { "colour": "#ce048f", "local": false, "name": "asn:asn=\"209800\"", "relationship_type": "" }, { "colour": "#434f78", "local": false, "name": "asn:as-owner=\"METASPINNER-ASN\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530175", "to_ids": true, "type": "ip-dst", "uuid": "87255e91-fcd4-4e12-a869-69e70e8b4906", "value": "193.202.84.32", "Tag": [ { "colour": "#443a97", "local": false, "name": "asn:asn=\"26548\"", "relationship_type": "" }, { "colour": "#b4d9d8", "local": false, "name": "asn:as-owner=\"PUREVOLTAGE-INC\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530196", "to_ids": true, "type": "domain", "uuid": "8548dbf7-705f-4013-8b41-85d4285c7eb7", "value": "aluminiostramuntana.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530217", "to_ids": true, "type": "domain", "uuid": "5d1317b9-15c6-48ee-92d0-46c14c8cc5a5", "value": "bookreservphoto.pro", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530238", "to_ids": true, "type": "domain", "uuid": "5de16dc9-f729-4a31-ba53-268dabe535b6", "value": "dashgamein.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530259", "to_ids": true, "type": "domain", "uuid": "5e75c5e4-d79a-40d7-9c81-8a5c2f0be4ce", "value": "deeprace.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530280", "to_ids": true, "type": "domain", "uuid": "795b0b5c-e1b4-4ad9-bf02-2531035ecca2", "value": "derbyoni.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530301", "to_ids": true, "type": "domain", "uuid": "c6e689fd-1f8e-43e2-bfba-3fd2c2aee748", "value": "doc-imagehub.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530323", "to_ids": true, "type": "domain", "uuid": "30fe1391-96ce-4a34-9ea0-900357bb6f48", "value": "docstore-safe.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530344", "to_ids": true, "type": "domain", "uuid": "7e1142d1-0983-4c01-a3cd-6044708e7238", "value": "expedla-getphoto.cloud", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530365", "to_ids": true, "type": "domain", "uuid": "4ab05267-3d5a-4ea9-aff1-5f4b20de283b", "value": "fairyspells.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530386", "to_ids": true, "type": "domain", "uuid": "bd1287bb-0b3c-4349-8b3c-4751f878e42c", "value": "ginrinsou.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530408", "to_ids": true, "type": "domain", "uuid": "bc3c1ab0-5618-4417-bef3-43b285a252b4", "value": "higoksbupwou.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530429", "to_ids": true, "type": "domain", "uuid": "055edc8a-7be1-4cdc-a2b9-9708cc030310", "value": "imagevault-safe.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530450", "to_ids": true, "type": "domain", "uuid": "e93bff9c-9001-4cd1-98ea-b49fa6383e76", "value": "joincroud.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530471", "to_ids": true, "type": "domain", "uuid": "43e71b17-8db9-4472-8701-c1f5d7115498", "value": "kelopins.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530492", "to_ids": true, "type": "domain", "uuid": "96501174-2e5c-4562-b405-4657b107ebdc", "value": "kentjerk.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530513", "to_ids": true, "type": "domain", "uuid": "0c882d2e-5dec-4889-8c0a-06f2d5d77019", "value": "kinghoruswe.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530534", "to_ids": true, "type": "domain", "uuid": "3f454bbf-1990-4fd9-bfd6-55e5adbb998d", "value": "kiptownim.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530555", "to_ids": true, "type": "domain", "uuid": "2df19129-5224-4b1d-a74d-ff9c7e7c3627", "value": "lestresot.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530577", "to_ids": true, "type": "domain", "uuid": "c5aaaed0-1528-4380-ab32-a88001b5eaf3", "value": "lookinlip.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530598", "to_ids": true, "type": "domain", "uuid": "49d8b448-c75b-4424-917c-a51dfb835f57", "value": "photo-132454.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530619", "to_ids": true, "type": "domain", "uuid": "6843c924-d4cc-4550-90f2-c54d6d46f656", "value": "photo-21473.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530640", "to_ids": true, "type": "domain", "uuid": "983fadc1-a3d6-46c8-82fd-25440f50af2f", "value": "photo-7216102.click", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530661", "to_ids": true, "type": "domain", "uuid": "757f049f-9992-4046-b87a-c5d7d7983838", "value": "photo-7216302.sbs", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530682", "to_ids": true, "type": "domain", "uuid": "6a017652-4840-471d-9422-73a0d6096f5b", "value": "photo-8632454.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530703", "to_ids": true, "type": "domain", "uuid": "70624b9d-5d74-47fd-8648-921179f26ef4", "value": "photodoc-secure.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530724", "to_ids": true, "type": "domain", "uuid": "cca5c079-4656-429c-a534-9a2b11fc9106", "value": "photosafe-hub.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530745", "to_ids": true, "type": "domain", "uuid": "8affee63-8fd3-4907-98a6-bbe3d78871e6", "value": "racestrech.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530766", "to_ids": true, "type": "domain", "uuid": "a892568b-de7c-4381-ae4f-9dfa8892dcc6", "value": "recepyman.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530787", "to_ids": true, "type": "domain", "uuid": "c1a91fe8-87ab-4efa-b03b-d1bff950671a", "value": "safedoc-vault.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530808", "to_ids": true, "type": "domain", "uuid": "3eac0705-acba-4f06-94f9-f4659f270934", "value": "safevault-hub.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530829", "to_ids": true, "type": "domain", "uuid": "cdef1342-ea00-4d26-b795-19d0eb230a5a", "value": "secure-imagehub.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530850", "to_ids": true, "type": "domain", "uuid": "89d539bf-bfcd-4605-b687-3dabd4e8585b", "value": "snapkeep.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530871", "to_ids": true, "type": "domain", "uuid": "6baa708c-76b1-44b5-afa9-ab576ac21c16", "value": "tripadvisor-photo-view.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530892", "to_ids": true, "type": "domain", "uuid": "275ee352-bb90-484b-bd0c-f66da45fde41", "value": "visa-safedocs.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530914", "to_ids": true, "type": "domain", "uuid": "d13a2c84-4dab-40bd-ab1b-7eee55bae955", "value": "visa-vault.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530935", "to_ids": true, "type": "ip-dst", "uuid": "cbcd620b-dc0f-4e95-a6c4-129a6824c6e8", "value": "95.217.97.121", "Tag": [ { "colour": "#d17f93", "local": false, "name": "asn:asn=\"24940\"", "relationship_type": "" }, { "colour": "#18e065", "local": false, "name": "asn:as-owner=\"HETZNER-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782530956", "to_ids": true, "type": "ip-dst", "uuid": "80abb097-e8ad-4b15-8466-2c9f11647b81", "value": "172.67.161.215", "Tag": [ { "colour": "#c4bd10", "local": false, "name": "asn:asn=\"13335\"", "relationship_type": "" }, { "colour": "#60003e", "local": false, "name": "asn:as-owner=\"CLOUDFLARENET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#2c2142", "local": false, "name": "false-positive:risk=\"high\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782530978", "uuid": "ff60c0b1-147d-4174-bd79-ca10dc1a1570", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782530978", "to_ids": true, "type": "md5", "uuid": "3e908cc3-7a6d-4bf3-aded-58ca0eb8b0ef", "value": "01eb459a28a329aaf6b5fa6fc5acdc7e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528007", "to_ids": true, "type": "sha1", "uuid": "c78e5f71-da9a-4b99-8e30-6693041a13fb", "value": "ff4edf35349eb7af8edc60f01eede469bee54efb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528007", "to_ids": true, "type": "sha256", "uuid": "f930a0d5-8750-4d87-8f74-a40c4408bddd", "value": "f629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782525993", "to_ids": true, "type": "ssdeep", "uuid": "25866efd-0276-4fde-8707-41ffb634e00a", "value": "98304:E5/f2avoQgrpQggjjWOiri0MApt1acopcDFUagjy:gX2FgpWO8iXVcyrj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782525993", "to_ids": false, "type": "size-in-bytes", "uuid": "be84ba9b-1359-4af9-9cb6-713a01ba57ea", "value": "11980311" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782525993", "to_ids": true, "type": "vhash", "uuid": "dba1a997-2ed5-4a33-9e65-bc31f55d95ea", "value": "0170b6666d5c0d5d151c00d016z699zfaz1fz2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782525993", "to_ids": true, "type": "filename", "uuid": "a5b9c9cd-2f8f-4f29-a4dd-1051ff632f16", "value": "mq2o2ri.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782525993", "to_ids": false, "type": "text", "uuid": "4ddce0ed-0393-4db0-84e0-27afe6193a2a", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/PureRat!MTB\nVT Total Detection:40/71\nFirst Submission:2026-05-23T14:14:13.000000+00:00\nLast Submission:2026-05-23T14:14:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782530999", "uuid": "c4e20c5d-bd2f-42f6-9803-2cb3939407d2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782530999", "to_ids": true, "type": "md5", "uuid": "c63a4a52-d237-4c6c-a2a8-4ba3726be604", "value": "0e5be13d3339b4b2561e5d88127e1bd3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528008", "to_ids": true, "type": "sha1", "uuid": "210c7151-a2f3-4449-942e-962d8ce271b2", "value": "29e3cd6c5f1d8a7ad0ce9a4bb5d6e95e6bc33010", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528008", "to_ids": true, "type": "sha256", "uuid": "e881d4d7-5a94-4631-be53-c7e27d903113", "value": "83e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526014", "to_ids": true, "type": "ssdeep", "uuid": "c7624500-5233-4702-bc53-a308e4a9eabd", "value": "196608:ddJ6AJm5ILgA7R4Y6GEWxxduPTrIfuuX/i3w:XPMm4OEWxxd68fuuPi3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526014", "to_ids": false, "type": "size-in-bytes", "uuid": "a7378a43-592e-4944-8512-a88cc260a8bf", "value": "10836480" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526014", "to_ids": true, "type": "vhash", "uuid": "fd027b31-18dc-4e89-9531-da30f9beedc3", "value": "01706e655d1d05757161203073c00da7zc064z13zbbfz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526014", "to_ids": true, "type": "filename", "uuid": "2dd4417e-94a2-4b5c-9c15-daa3a2748651", "value": "zmrpmyhacnf.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526014", "to_ids": false, "type": "text", "uuid": "46e2f850-92de-4742-902e-fc644bf971af", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/PureRat!MTB\nVT Total Detection:27/71\nFirst Submission:2026-04-16T08:40:09.000000+00:00\nLast Submission:2026-05-14T02:12:26.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531020", "uuid": "ac841f3d-4cd8-4ba2-929b-d9a109cb94ea", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531020", "to_ids": true, "type": "md5", "uuid": "4cc7677c-9168-4d78-80c8-e98846716c5a", "value": "ba8600d349779c4ba0ea37da2e109f11", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528009", "to_ids": true, "type": "sha1", "uuid": "a4636331-3ac0-4d60-a2bf-4857436f7dce", "value": "9db9b3e55f58553735a25db6702d272cf48495ea", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528009", "to_ids": true, "type": "sha256", "uuid": "3ce25cd6-835d-49c0-bc07-8c828d6945d8", "value": "3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b44", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526079", "to_ids": true, "type": "ssdeep", "uuid": "c06b0d1a-0e49-464b-a252-253921ce6cf7", "value": "98304:4FW9DeRiR8BR7+wgqokV0k0S7OoWS9dkMRlLqPceZFBJS:40FR8aG0MFWAkMLLwZFB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526079", "to_ids": false, "type": "size-in-bytes", "uuid": "cba6ef5b-cdf1-4568-904c-e7a2e91fa6de", "value": "13539840" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526079", "to_ids": true, "type": "vhash", "uuid": "39d8f631-f4e5-4ba2-a67f-7d4712ed0d6a", "value": "0170ce666d5c5d5d151c7112501006d008716z9115za2zca031z18z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526079", "to_ids": true, "type": "filename", "uuid": "3a3a571e-871d-4a4e-ac9c-76411fe1a4ec", "value": "pdftoimage.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526079", "to_ids": false, "type": "text", "uuid": "2123e940-d8a9-4dac-8f41-1a11f9b0828d", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/PureRat!MTB\nVT Total Detection:45/71\nFirst Submission:2026-05-06T10:05:14.000000+00:00\nLast Submission:2026-05-06T10:05:14.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531041", "uuid": "39ba3427-48ed-4994-908d-834d57cb066a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531041", "to_ids": true, "type": "md5", "uuid": "8feb0844-bb9c-41f0-b6bc-b9f190fac885", "value": "c2d5d410a37d0c51546b1ef4962aff57", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528010", "to_ids": true, "type": "sha1", "uuid": "e75f0138-887e-41ef-a5fe-4bf0c503b75e", "value": "b77835ab95bd5c25472fa352c5204cf15ab42d09", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528010", "to_ids": true, "type": "sha256", "uuid": "ac6b41f5-005c-4339-8378-077b3ae2c35d", "value": "2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526101", "to_ids": true, "type": "ssdeep", "uuid": "ad4dcbde-6a56-434e-9ab8-05800cf8f5ea", "value": "98304:TFW9DeRiR8BR7IqgqokV0k0S7OoWeMWVg3qPceZFBJS:T0FR8c/G0MFWsV+wZFB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526101", "to_ids": false, "type": "size-in-bytes", "uuid": "308868ca-6798-4a70-97dd-ae2a99c0ec37", "value": "13538816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526101", "to_ids": true, "type": "vhash", "uuid": "4bd2a893-67b8-48cc-a0e8-f25f3c51bbfe", "value": "0170ce666d5c5d5d151c7112501006d008716z9115za2zca031z18z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526101", "to_ids": true, "type": "filename", "uuid": "880dd3a1-9456-467f-91c9-42fa55765f18", "value": "pdftoimage.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526101", "to_ids": false, "type": "text", "uuid": "e2659437-6982-42b4-8cce-f5b0aa55b333", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/PureRat!MTB\nVT Total Detection:46/71\nFirst Submission:2026-05-06T10:05:13.000000+00:00\nLast Submission:2026-05-06T10:05:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531063", "uuid": "f30ea391-b122-4917-8fc4-f24441986f8e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531063", "to_ids": true, "type": "md5", "uuid": "4692888b-0506-4eac-9562-1aa5721176b7", "value": "b450eac4a01696f90f738d4029b10dc0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528012", "to_ids": true, "type": "sha1", "uuid": "1fef8f38-c125-4c0f-bff0-d9f483d32242", "value": "4852b47c2fe4d77329e8cc4a75f755833b85f7ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528012", "to_ids": true, "type": "sha256", "uuid": "e7fec826-6025-43b1-882f-1aee3245bfff", "value": "04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526123", "to_ids": true, "type": "ssdeep", "uuid": "762d9b20-096e-4b45-abd5-847c97f4c635", "value": "196608:NTCTSm9HHrAt7g4FLOyomFHKnPGzPemaw:GS/FRzPemaw" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526123", "to_ids": false, "type": "size-in-bytes", "uuid": "46869316-fb33-4aac-891a-6e200eace2e5", "value": "6520320" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526123", "to_ids": true, "type": "vhash", "uuid": "d479a12e-bc54-4ea3-a328-9e4efd551b88", "value": "06606e655d55656071a0c1z27400d86z3c0e3z70f0700e6010d01277z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526123", "to_ids": true, "type": "filename", "uuid": "433b7ad7-0449-4646-818e-9c25e8074be5", "value": "Proxifier.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526123", "to_ids": false, "type": "text", "uuid": "47290cfa-f143-4db8-a768-57590e3ef4b2", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Tedy!MTB\nVT Total Detection:15/71\nFirst Submission:2026-03-17T17:13:33.000000+00:00\nLast Submission:2026-05-28T02:51:53.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531084", "uuid": "e743a51e-bbab-4b8d-881d-de973fc32b57", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531084", "to_ids": true, "type": "md5", "uuid": "74a74473-7b5f-4044-9aec-c47617b2a760", "value": "5d4e1bccb8466080f2e975c0a9caa161", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528013", "to_ids": true, "type": "sha1", "uuid": "b0bc8407-a860-4d24-844f-084d2a84687e", "value": "94b16dd138fbc659ba5184c46341885342c4dd4b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528013", "to_ids": true, "type": "sha256", "uuid": "863a3f7a-8246-4217-8223-d065445bfb7e", "value": "06a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e227969", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526159", "to_ids": true, "type": "ssdeep", "uuid": "acb6406e-a381-4a1a-818f-82b77bab58fd", "value": "98304:uFW9DeRiR8BR7ZgqokV0k0S7OoWW5UvwIxcTt:u0FR8iG0MFWYUK" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526159", "to_ids": false, "type": "size-in-bytes", "uuid": "6a2099c1-6165-4365-841c-1970bf70ba85", "value": "6132736" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526159", "to_ids": true, "type": "vhash", "uuid": "19629268-ce1b-456c-80d2-12f5a87507be", "value": "0660be666d5c5d5d151c7112501006d008716z9115za2zca031z18z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526159", "to_ids": true, "type": "filename", "uuid": "cb05e0c0-c20b-47e5-84e6-ffbea5e838a7", "value": "pdftoimage.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526159", "to_ids": false, "type": "text", "uuid": "c78f8c39-9048-4fbd-a53b-05e168f39637", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/PureRat!MTB\nVT Total Detection:47/71\nFirst Submission:2026-04-24T15:25:08.000000+00:00\nLast Submission:2026-05-06T22:19:07.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531105", "uuid": "a1debabf-1f3e-42ac-9ec4-c5ad49b44e4b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531105", "to_ids": true, "type": "md5", "uuid": "b9fefe77-9a7f-4b81-b848-0a3bc62ed9c4", "value": "704ea437431f1a9c8cd1f8ffced31d2f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528014", "to_ids": true, "type": "sha1", "uuid": "3e45e797-718e-4ab7-ae51-1bda75049c49", "value": "d28bc288c559f61f9395a8037ed17a048bd41255", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528015", "to_ids": true, "type": "sha256", "uuid": "f372b5e4-3cca-48c5-b83e-452e0bad4ed9", "value": "63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526245", "to_ids": true, "type": "ssdeep", "uuid": "4bb16644-7eab-4d94-938c-623824932559", "value": "98304:4FW9DeR4bR8vR7rgqokV0k0S7OoW7yfRsG0DW:40bR8qG0MFW7yfDv" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526245", "to_ids": false, "type": "size-in-bytes", "uuid": "cb543e40-5b1b-4260-b48e-db01d3188a62", "value": "6158848" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526245", "to_ids": true, "type": "vhash", "uuid": "c7bddbbf-d483-4a91-8d74-6e644aa5321f", "value": "0660be666d5c5d5d151c7112501006d008716z9115za2zca031z18z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526245", "to_ids": true, "type": "filename", "uuid": "354570ba-e41c-464b-9991-570b85c9209f", "value": "pdftoimage.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526245", "to_ids": false, "type": "text", "uuid": "786aacfa-4c7c-48d1-95d1-8626c5639594", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/PureRat!rfn\nVT Total Detection:46/71\nFirst Submission:2026-05-08T07:46:43.000000+00:00\nLast Submission:2026-05-08T07:46:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531126", "uuid": "6dcc8820-f8d8-4a6e-b21b-1aaecca229ee", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531126", "to_ids": true, "type": "md5", "uuid": "d8aa94b8-04fa-472e-8225-c6f3a4c3dab1", "value": "eb01125a0a9a542e9a3e4776b2976078", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528016", "to_ids": true, "type": "sha1", "uuid": "5c1f55d4-ab1f-4f3e-a613-ba1c60377e94", "value": "952c05c2c8557339bd06db300ba5735d2eb19b0c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528016", "to_ids": true, "type": "sha256", "uuid": "fe449261-8a9d-4c04-890c-f01de67a7778", "value": "98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526330", "to_ids": true, "type": "ssdeep", "uuid": "72d45afe-ba11-4533-a022-8c601f9579e5", "value": "24576:1RnafS8cfq2vU2CqI2L3mYgiQ8Q4QvojUOhlG+bhdGwQG9/65sypiHaQpT3KkU8M:vhc2c2MXYgiQ8Q4ioQWlXaY9S6ysxjR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526330", "to_ids": false, "type": "size-in-bytes", "uuid": "ad51cafd-1ca9-4d5b-bb41-464129daace6", "value": "1861120" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526330", "to_ids": true, "type": "vhash", "uuid": "c313be17-d10b-42ac-aa58-faa246ac7aff", "value": "01605e655d15557az347z27z13z7fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526330", "to_ids": true, "type": "filename", "uuid": "dff2b1b9-386e-498b-b22c-1d727768f820", "value": "MEmuConsole.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526330", "to_ids": false, "type": "text", "uuid": "b6a51b53-fdd7-4f79-ad4d-15ed4075ca6e", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/PureRat!rfn\nVT Total Detection:35/71\nFirst Submission:2026-04-20T04:17:31.000000+00:00\nLast Submission:2026-04-24T15:26:49.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782531147", "uuid": "27221925-0317-481e-8126-d64cb45987cb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782531147", "to_ids": true, "type": "md5", "uuid": "aca83ce7-e84d-453e-84fc-b7427ec62342", "value": "dbc3117087d4768c084ccba252b4d8e5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782528017", "to_ids": true, "type": "sha1", "uuid": "dd8b50b5-582e-4015-91b2-d70cd2521f7b", "value": "3905f9f6102892569e2ef99f942d2cdf4e1dc220", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782528017", "to_ids": true, "type": "sha256", "uuid": "ab3913cb-7eea-4826-b972-852b9093bbc4", "value": "d14ba95cdce1ef7dc9ad3ac74949ca5db38b27378ee30f30a23cf26f9e875a11", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782526459", "to_ids": true, "type": "ssdeep", "uuid": "12c24afb-7025-4e5d-bbd1-87e086ea3f58", "value": "393216:3nVxhanA6rh7CLBAwOdC1yJ8w65aPahY7ZZiRT4VpaUgPj1BiGUtlVpFzeBNsiXe:3nvEA6rpCLBwb658a8ZZiOpgPVlcmK5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782526459", "to_ids": false, "type": "size-in-bytes", "uuid": "c3aabb46-5fd7-46d5-af98-e5a1b5a330d9", "value": "89953280" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782526459", "to_ids": true, "type": "vhash", "uuid": "72c2dae7-b2fb-42f0-a86c-cc74b5b5b5da", "value": "0870a6656d156d0d15165263z92zff7z17z13z93z12c4z11z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782526459", "to_ids": true, "type": "filename", "uuid": "3872c2be-5ec8-464b-b07b-0bbed5c5f6bd", "value": "node.exe" }, { "category": "Other", "comment": "Checked: 27/06/2026\nLast-scan\t: 27/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782526459", "to_ids": false, "type": "text", "uuid": "e1120082-e551-4773-a349-a52d9e3ed763", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:0/70\nFirst Submission:2026-01-13T14:00:39.000000+00:00\nLast Submission:2026-06-26T21:53:43.000000+00:00" } ] } ] } }