{ "Event": { "analysis": "1", "date": "2026-07-07", "extends_uuid": "", "info": "[Threat Intel] From Invoice to AnyDesk: Uncovering a Phishing Campaign Targeting Russian Aerospace Organizations", "protected": false, "publish_timestamp": "1784321939", "published": true, "threat_level_id": "3", "timestamp": "1784321938", "uuid": "9fcff7f6-1728-40b8-a166-c6f4cf63b0aa", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#57356b", "local": false, "name": "misp-galaxy:producer=\"Seqrite\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#4985d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Autostart Execution - T1547\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#e00500", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Archive Collected Data - T1560\"", "relationship_type": "" }, { "colour": "#cfba47", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Automated Exfiltration - T1020\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Window - T1564.003\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#15cd0b", "local": false, "name": "misp-galaxy:target-information=\"Russia\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Aerospace\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:rmm-tool=\"AnyDesk\"", "relationship_type": "" }, { "colour": "#bd512b", "local": false, "name": "misp-galaxy:target-information=\"Belarus\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:target-information=\"Kazakhstan\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"xmrig\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652407", "to_ids": false, "type": "link", "uuid": "7033ea98-e162-4d48-8415-45fd90dc7711", "value": "https://www.seqrite.com/blog/from-invoice-to-anydesk-uncovering-a-phishing-campaign-targeting-russian-aerospace-organizations/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783652407", "to_ids": false, "type": "text", "uuid": "60c86fd3-55eb-405d-a84d-66e6d7e8df1e", "value": "A sophisticated spear-phishing campaign targeting Russian aerospace and aviation organizations has been identified, likely attributed to the Rare Werewolf threat group. The attack begins with fraudulent emails impersonating a legitimate Russian aerospace research institute, delivering password-protected archives containing malicious installers. The campaign employs living-off-the-land techniques, abusing legitimate tools including AnyDesk, Blat, WinRAR, and Tray Minimizer to establish persistent remote access. The attack chain deploys portable AnyDesk with unattended access configured using a predefined password, exfiltrates configuration data via SMTP to attacker-controlled infrastructure, and establishes persistence through scheduled tasks. The operators conceal their activities by minimizing the AnyDesk interface and removing forensic artifacts. This methodology aligns with previously documented Rare Werewolf campaigns targeting strategically important sectors across Russia, Belarus, and Kazakhstan, par..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783652407", "to_ids": false, "type": "text", "uuid": "f68987e6-2ce9-4948-960c-e78e248c919a", "value": "Name: From Invoice to AnyDesk: Uncovering a Phishing Campaign Targeting Russian Aerospace Organizations\nAuthor: AlienVault\nAdversary: Rare Werewolf\nTags: [\"scheduled task persistence\", \"remote access tool\", \"aerospace targeting\", \"smtp exfiltration\", \"russian victims\", \"living-off-the-land\", \"anydesk\", \"spear-phishing\"]\nTgtd countries: [\"Russian Federation\"]\nMlwr families: []\nAttack_ids: [\"T1053.005\", \"T1547\", \"T1204.002\", \"T1566.001\", \"T1005\", \"T1219\", \"T1036\", \"T1560\", \"T1020\", \"T1059.001\", \"T1027\", \"T1564.003\", \"T1059.003\", \"T1070.004\", \"T1071.001\"]\nIndustries: [\"Aerospace\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1783652407", "to_ids": false, "type": "threat-actor", "uuid": "3211f0eb-db1b-41bc-a674-ba12a66ed0ae", "value": "Rare Werewolf" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307794", "to_ids": true, "type": "ip-dst", "uuid": "52bf1c7d-f181-4105-b1e6-662ce718e7fd", "value": "194.87.57.81", "Tag": [ { "colour": "#05c4d6", "local": false, "name": "asn:asn=\"214822\"", "relationship_type": "" }, { "colour": "#a0502a", "local": false, "name": "asn:as-owner=\"MTFINANCE-AS\"", "relationship_type": "" }, { "colour": "#fdd220", "local": false, "name": "asn:as-country=\"RU\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"russia\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307816", "to_ids": true, "type": "ip-dst", "uuid": "27477093-28a9-47af-aeaa-084cccbe6f6b", "value": "109.106.178.14", "Tag": [ { "colour": "#aa39e0", "local": false, "name": "asn:asn=\"48635\"", "relationship_type": "" }, { "colour": "#f959f7", "local": false, "name": "asn:as-owner=\"CLDIN-NL Your Hosting B.V. part of Your.Online\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307837", "to_ids": true, "type": "ip-dst", "uuid": "3a5efd2b-052a-40c9-aac6-8aa47a846748", "value": "198.54.120.13", "Tag": [ { "colour": "#17fb50", "local": false, "name": "asn:asn=\"22612\"", "relationship_type": "" }, { "colour": "#e80394", "local": false, "name": "asn:as-owner=\"NAMECHEAP-NET\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307858", "to_ids": true, "type": "domain", "uuid": "0793b3c3-a959-4337-a5b4-e33fc51a03e7", "value": "vniir-info.space", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307879", "to_ids": true, "type": "domain", "uuid": "664f34ed-1739-4b62-913f-9b5eb3d229dd", "value": "vniir-avia.space", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307900", "to_ids": true, "type": "ip-dst", "uuid": "9e79bf7f-7d51-43b3-97cf-fba8efdab1b3", "value": "2.23.88.201", "Tag": [ { "colour": "#742f68", "local": false, "name": "asn:asn=\"16625\"", "relationship_type": "" }, { "colour": "#9fbb17", "local": false, "name": "asn:as-owner=\"AKAMAI-AS\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307921", "to_ids": true, "type": "domain", "uuid": "7977ed2f-2ec5-42e7-9e30-d60db6e0deee", "value": "aviatronika.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307942", "to_ids": true, "type": "domain", "uuid": "067209c8-f683-461a-b775-5157e89a0e01", "value": "fgub-vniir.space", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784307964", "to_ids": true, "type": "domain", "uuid": "c68147cd-781f-45a5-9707-35c23f57bd0c", "value": "nova-stream.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784307985", "uuid": "a82c16ab-8708-4d3c-a499-752d559a98cd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "md5", "timestamp": "1784307985", "to_ids": true, "type": "md5", "uuid": "6fb1b874-1f0a-4a5f-9c3b-7742c5a84fcb", "value": "144a0a499e007931628c98f38929466f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "sha1", "timestamp": "1784305140", "to_ids": true, "type": "sha1", "uuid": "64578b5f-87a9-4ee1-ab3d-2602f5b84904", "value": "c7eccd855d2e97b57420afd23a4b9261f42f5b84", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "sha256", "timestamp": "1784305140", "to_ids": true, "type": "sha256", "uuid": "45950a87-ae7e-4bac-a746-d0449a18d7a7", "value": "0dc0fa727f900ed5033f46f8ba6cf2d97d20ab95fd334cabc0f216da6e0622b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "text", "timestamp": "1784304803", "to_ids": false, "type": "text", "uuid": "a6fcfcaf-c63c-4a95-aab2-141719a16e36", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/XMRig.AB!MTB\nClamAV: None\nVT Total Detection: 49/74\nFirst Submission: 2026-06-25T07:42:50+00:00\nLast Submission: 2026-06-25T11:14:55+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "creation-time", "timestamp": "1784304803", "to_ids": false, "type": "datetime", "uuid": "68b3b826-1e85-4883-bec3-6cc311cf3e24", "value": "1992-06-19T22:22:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "ssdeep", "timestamp": "1784304803", "to_ids": true, "type": "ssdeep", "uuid": "434c810b-b448-4bfc-9956-325977819983", "value": "24576:ZAT8QE+kdhyUgCy1fTqIiPiUzhSemc43mJv3FCx1RxJrlDC7HCJzvDxwjhMgO:ZAI+zpqIil8WlFG3xJ9CTC9DxwqgO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304803", "to_ids": false, "type": "size-in-bytes", "uuid": "c38b349b-575d-47d9-af2c-882e3a3416b2", "value": "1569618" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "vhash", "timestamp": "1784304803", "to_ids": true, "type": "vhash", "uuid": "adcd885b-3bf5-4e17-a80d-823dad3b0967", "value": "0160866d1c0d5c051565103042z2300167z1025z13z23z29z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T07:42:50+00:00", "last_seen": "2026-06-25T11:14:55+00:00", "object_relation": "filename", "timestamp": "1784304803", "to_ids": true, "type": "filename", "uuid": "7e04f6ba-bc52-4742-bba5-275a436eaf0d", "value": "fpdt1vl.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-07-14T17:37:52+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784308006", "uuid": "096cd818-122d-4d03-9d1d-8cbee1561e7a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-07-14T17:37:52+00:00", "object_relation": "md5", "timestamp": "1784308006", "to_ids": true, "type": "md5", "uuid": "3703ff73-2fd6-445c-a688-3317497f41b9", "value": "7884be8a701f31421717c0835add92d5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-07-14T17:37:52+00:00", "object_relation": "sha1", "timestamp": "1784305142", "to_ids": true, "type": "sha1", "uuid": "d14fa0d2-0ec3-4656-a419-59314fbd9dbc", "value": "5d9d91cf9da3b37d8eee87d5d4dd38dbfec28358", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-07-14T17:37:52+00:00", "object_relation": "sha256", "timestamp": "1784305142", "to_ids": true, "type": "sha256", "uuid": "9ff7284a-d581-4f53-9a57-d166d4dd12e4", "value": "12648cd9d425f78db2dbc6e03c14f11e6ac6aadf8b3975c23cce9519e2b58d33", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-07-14T17:37:52+00:00", "object_relation": "text", "timestamp": "1784304824", "to_ids": false, "type": "text", "uuid": "c19f6938-abfc-4bc1-9a55-1821f50a4c3d", "value": "Type Description: DOS batch file\nMicrosoft: Trojan:BAT/Runner.DL!AMTB\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-05-29T09:09:51+00:00\nLast Submission: 2026-07-14T17:37:52+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-07-14T17:37:52+00:00", "object_relation": "ssdeep", "timestamp": "1784304824", "to_ids": true, "type": "ssdeep", "uuid": "4dc31edc-8026-4651-a162-b8e6a3909af3", "value": "12:jr0gGr0Im8jgr0L3E9Dr03Aefr0LtBWFCHr0OKkYyjyoKGejjPZ+HZ+car0LtLuR:mjghnekBpSHy1G3oHocacKpA7+FBqM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-07-14T17:37:52+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304824", "to_ids": false, "type": "size-in-bytes", "uuid": "565ee71a-8f81-4e2a-98b8-4c651a4f0cf5", "value": "1107" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-07-14T17:37:52+00:00", "object_relation": "filename", "timestamp": "1784304824", "to_ids": true, "type": "filename", "uuid": "3ac5de02-b1a3-4bec-84f5-29f69e26051c", "value": "wctF522.bat" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784308027", "uuid": "2f16dac1-9355-42c2-bc76-08b11b62c8a9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "md5", "timestamp": "1784308027", "to_ids": true, "type": "md5", "uuid": "1dc78d02-4e30-4d2b-9c8f-0b120576cf3f", "value": "eabd440c996846d0992e37ab01d01208", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "sha1", "timestamp": "1784305143", "to_ids": true, "type": "sha1", "uuid": "c6ee848c-c8f9-4ec1-9386-01907d6752ca", "value": "ee577f1880397a00480b210fcd6bc84d2330a19e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "sha256", "timestamp": "1784305143", "to_ids": true, "type": "sha256", "uuid": "63ca781a-6f09-4b89-9658-6199329084fa", "value": "47854deb456cb08c651b7f9ae2f9d87c72d0719de6af233340632efb3c1980f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "text", "timestamp": "1784304847", "to_ids": false, "type": "text", "uuid": "c6dda2d9-eb45-4e88-9edd-e866c585a3dd", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/XMRig.AB!MTB\nClamAV: None\nVT Total Detection: 46/74\nFirst Submission: 2026-06-25T10:14:02+00:00\nLast Submission: 2026-06-25T10:14:02+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "creation-time", "timestamp": "1784304847", "to_ids": false, "type": "datetime", "uuid": "62b076ad-071d-49cb-8e4f-d4b90d27544c", "value": "1992-06-19T22:22:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "ssdeep", "timestamp": "1784304847", "to_ids": true, "type": "ssdeep", "uuid": "36237eb8-e9ba-4eb0-a148-31450f0c7f6e", "value": "24576:2AT8QE+kRdyUgCy1fTqIiPiUzhSemc43mJv3FCx1RxJrlDC7HCJzvDxwjhMgu:2AI+dpqIil8WlFG3xJ9CTC9Dxwqgu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304847", "to_ids": false, "type": "size-in-bytes", "uuid": "52357dec-61d7-43e7-b99e-6c025a212b3f", "value": "1569541" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "vhash", "timestamp": "1784304847", "to_ids": true, "type": "vhash", "uuid": "f89146ba-c75b-4630-b390-9bad1ddc657b", "value": "0160866d1c0d5c051565103042z2300167z1025z13z23z29z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-25T10:14:02+00:00", "last_seen": "2026-06-25T10:14:02+00:00", "object_relation": "filename", "timestamp": "1784304847", "to_ids": true, "type": "filename", "uuid": "687f7052-2d12-4d0c-9776-3881f6dc8b45", "value": "v1829ex.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-05-29T09:09:51+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784308048", "uuid": "46c4287f-47ac-4dc1-b62d-602c6c949903", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-05-29T09:09:51+00:00", "object_relation": "md5", "timestamp": "1784308048", "to_ids": true, "type": "md5", "uuid": "4dac6108-5dac-42a4-9875-09a8f1391cfd", "value": "6cc3c68c56e099792fdeadde76256d56", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-05-29T09:09:51+00:00", "object_relation": "sha1", "timestamp": "1784305145", "to_ids": true, "type": "sha1", "uuid": "45e7f223-dab1-4e87-b401-5693fab9589b", "value": "7d415612a00d99617bd89670e1570c145863ad08", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-05-29T09:09:51+00:00", "object_relation": "sha256", "timestamp": "1784305145", "to_ids": true, "type": "sha256", "uuid": "0447df90-8866-4e52-8dca-2f11c83091bc", "value": "f57e010541fb4ccbf23aefc4a827f753a6ff3f8792d9c04c3eea83f6963c6bae", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-05-29T09:09:51+00:00", "object_relation": "text", "timestamp": "1784304868", "to_ids": false, "type": "text", "uuid": "fc1255f7-f44d-49e2-a181-fde3659c47b0", "value": "Type Description: RAR\nMicrosoft: None\nClamAV: None\nVT Total Detection: 4/74\nFirst Submission: 2026-05-29T09:09:51+00:00\nLast Submission: 2026-05-29T09:09:51+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-05-29T09:09:51+00:00", "object_relation": "ssdeep", "timestamp": "1784304868", "to_ids": true, "type": "ssdeep", "uuid": "48de4251-4126-4cb3-a14b-7e77850d4520", "value": "196608:4zZGe/FnfJ50dq3OIZmIQ7PJJe5wYIzdw85RzYtDe:4zZGe/pJ5cq+IZDQ7xJeqYIrgC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-05-29T09:09:51+00:00", "object_relation": "size-in-bytes", "timestamp": "1784304868", "to_ids": false, "type": "size-in-bytes", "uuid": "95377986-50ac-4210-8586-7e3a72e39372", "value": "6830076" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-29T09:09:51+00:00", "last_seen": "2026-05-29T09:09:51+00:00", "object_relation": "filename", "timestamp": "1784304868", "to_ids": true, "type": "filename", "uuid": "e594f027-c646-4e46-b9a8-c06175424964", "value": "dd_BackgroundDownload_20260528130031.rar" } ] } ] } }