{ "Event": { "analysis": "1", "date": "2026-07-20", "extends_uuid": "", "info": "[Threat Intel] Targeted Attack on Government Entities in the Middle East | Part 1", "protected": false, "publish_timestamp": "1785033926", "published": true, "threat_level_id": "3", "timestamp": "1785033926", "uuid": "a3420ff6-459e-4603-a841-b39670ff54bf", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#6dbaba", "local": false, "name": "misp-galaxy:producer=\"Zscaler\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#bb2745", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Standard Encoding - T1132.001\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#f5a258", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Native API - T1106\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#f4b62b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"", "relationship_type": "" }, { "colour": "#9f6bd9", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Configuration Discovery - T1016\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#dac154", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Security Software Discovery - T1518.001\"", "relationship_type": "" }, { "colour": "#02475d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Windows Command Shell - T1059.003\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:region=\"030 - Eastern Asia\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Government, Administration\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784631625", "to_ids": false, "type": "link", "uuid": "6748c858-ba68-48ec-958d-60c57e54bf1d", "value": "https://www.zscaler.com/blogs/security-research/targeted-attack-government-entities-middle-east-part-1" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784631625", "to_ids": false, "type": "text", "uuid": "7ce75f36-3101-4f7c-be02-915ed94b54b8", "value": "In July 2026, a threat actor with links to East Asia launched sophisticated attacks against government entities in the Middle East. The multi-stage campaign deployed previously undocumented malware including TELESHIM, MIXEDKEY, and BINDCLOAK. TELESHIM abuses Telegram API for command-and-control communication to blend with legitimate traffic, while employing heavy code obfuscation techniques like control flow flattening and mixed boolean arithmetic. MIXEDKEY serves as a reflective loader that uses environmental keying by deriving decryption keys from the victim machine's volume serial number. The threat actor demonstrated advanced tradecraft through DLL sideloading, anti-analysis techniques including hypervisor detection and RAM speed checks, and careful staging to evade detection. Post-compromise activity revealed systematic reconnaissance and persistence establishment between July 7-9, 2026, with operations concentrated during East Asian working hours." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784631625", "to_ids": false, "type": "text", "uuid": "f17645c3-d802-4b7e-9b99-5ee2a7c19e14", "value": "Name: Targeted Attack on Government Entities in the Middle East | Part 1\nAuthor: AlienVault\nAdversary: \nTags: [\"telegram abuse\", \"dll sideloading\", \"east asia\", \"mixedkey\", \"government targeting\", \"middle east\", \"code obfuscation\", \"teleshim\", \"bindcloak\", \"environmental keying\"]\nTgtd countries: []\nMlwr families: [\"TELESHIM\", \"MIXEDKEY\", \"BINDCLOAK\"]\nAttack_ids: [\"T1053.005\", \"T1033\", \"T1132.001\", \"T1497.001\", \"T1082\", \"T1106\", \"T1140\", \"T1055\", \"T1497.003\", \"T1016\", \"T1083\", \"T1049\", \"T1027\", \"T1518.001\", \"T1059.003\", \"T1027.002\", \"T1071.001\", \"T1574.002\", \"T1105\"]\nIndustries: [\"Government\"]" }, { "category": "Payload delivery", "comment": "ISO image file No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899510", "to_ids": true, "type": "md5", "uuid": "cc968592-951b-45aa-8772-d76fed7cff85", "value": "68926e6c958562deaae35de3d9f59de3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MIXEDKEY reflective PE loader No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899511", "to_ids": true, "type": "md5", "uuid": "ef377baa-d5de-4c34-8e30-90cdc870ea5c", "value": "78a4f8574830bf7fbaf63d7da09be2b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "BINDCLOAK No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899513", "to_ids": true, "type": "md5", "uuid": "9d787c66-f17d-4887-8d0f-790e66afc167", "value": "7a14a99d70d42d3f7bf72f843185fc07", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive containing the ISO image No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899514", "to_ids": true, "type": "md5", "uuid": "6e45817f-d572-4ebe-826e-b9ff4d1b10cf", "value": "97124a93766be732e8fef5a56a5346a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899516", "to_ids": true, "type": "md5", "uuid": "a5d427a5-e3e7-4292-87bd-cb7c0a10bd48", "value": "c99f29ac08454855b3d538960bb2f34f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "BINDCLOAK No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899517", "to_ids": true, "type": "sha1", "uuid": "a041def9-febc-493c-9365-cf4656b178f8", "value": "577b1cc894636f4ac5ad670b0079b9b7ade137c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive containing the ISO image No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899518", "to_ids": true, "type": "sha1", "uuid": "5e04aefb-0556-4f61-9ccd-f1b89a4a8e1d", "value": "c1f16e31ae71372ee45fa6fd6927c7b887a4e3f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ISO image file No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899519", "to_ids": true, "type": "sha1", "uuid": "a7387b65-70d6-4e44-938e-4d1e0533fd6f", "value": "ccb2002fe8f5cc1f511d52309625b52d1c507421", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MIXEDKEY reflective PE loader No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899520", "to_ids": true, "type": "sha1", "uuid": "40bebdfa-74be-42cb-97a5-cc894b703250", "value": "ee287d6a09295502ab2407aec336f9f0d8477d68", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "BINDCLOAK No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899522", "to_ids": true, "type": "sha256", "uuid": "d729a723-77f7-403e-ba5d-b341fdaa1def", "value": "3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "MIXEDKEY reflective PE loader No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899523", "to_ids": true, "type": "sha256", "uuid": "7158f491-0f77-4113-b1f8-dde9712ff97c", "value": "3b3eaea783fd6dab90f0408274bf8a9c49adbdc70c0efd70658d65b0e1684a3f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive containing the ISO image No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899524", "to_ids": true, "type": "sha256", "uuid": "db4ff8fb-1eac-489d-a48a-515da7387085", "value": "789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ISO image file No sample in VT\r\nLast check: 24/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784899525", "to_ids": true, "type": "sha256", "uuid": "ba2c9517-f239-4769-a653-5726946aaf6c", "value": "c84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C2 domain", "deleted": false, "disable_correlation": false, "timestamp": "1784902140", "to_ids": true, "type": "hostname", "uuid": "a5ae5b0f-4b90-4c15-ba33-c52410186a31", "value": "cert.hypersnet.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784902162", "uuid": "0dbc8176-af54-4352-b47e-c4b085cb19ab", "Attribute": [ { "category": "Payload delivery", "comment": "ZIP archive containing the ISO image", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "object_relation": "md5", "timestamp": "1784902162", "to_ids": true, "type": "md5", "uuid": "dbb26559-cd72-46a3-8e0b-795278b06d2c", "value": "087499849115eb28c4364581d2b28d09", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive containing the ISO image", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "object_relation": "sha1", "timestamp": "1784899502", "to_ids": true, "type": "sha1", "uuid": "d618a415-063d-485a-88f7-0c2c9ea7d092", "value": "86ee99f293a30720bcc898a4a8e391f93fb9be95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ZIP archive containing the ISO image", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "object_relation": "sha256", "timestamp": "1784899503", "to_ids": true, "type": "sha256", "uuid": "012d8fdd-c32c-4b4d-9d55-2e6c3df2b837", "value": "32529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e66", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 24/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "object_relation": "text", "timestamp": "1784898384", "to_ids": false, "type": "text", "uuid": "f8872941-8622-4934-90b2-5acd42edc6fc", "value": "ZIP archive containing the ISO image\r\nType Description: ZIP\nMicrosoft: Trojan:Win32/Suschil!rfn\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-07-09T09:20:21+00:00\nLast Submission: 2026-07-09T09:20:21+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "object_relation": "ssdeep", "timestamp": "1784898384", "to_ids": true, "type": "ssdeep", "uuid": "d38e0894-9e0e-4949-9313-7ee7c404d19c", "value": "24576:1hfKDFVfs3/lmlFR8BSKslQREWTPt5UcLksG1b:H79fSGLtvLk51b" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898384", "to_ids": false, "type": "size-in-bytes", "uuid": "14556a12-5fb2-4135-a98e-183c06c6c8b1", "value": "1039155" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "object_relation": "vhash", "timestamp": "1784898384", "to_ids": true, "type": "vhash", "uuid": "24c7356e-152a-475a-a3a3-a16901b53ea6", "value": "d40b77435933b1f44968161e0953103d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:20:21+00:00", "last_seen": "2026-07-09T09:20:21+00:00", "object_relation": "filename", "timestamp": "1784898384", "to_ids": true, "type": "filename", "uuid": "ca1800a4-0312-4500-8570-aef13ca0c894", "value": "Agreement_on_the_Establishment_of_Common_Border_Offices_English (1).zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784902184", "uuid": "66b7678b-4bd1-49ef-8ae5-467cc4e051cc", "Attribute": [ { "category": "Payload delivery", "comment": "TELESHIM (old)", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "md5", "timestamp": "1784902184", "to_ids": true, "type": "md5", "uuid": "c02681c1-0a8d-4137-a35f-843969d4a634", "value": "28b47bdf16d7af6f8ec21218eac9145a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TELESHIM (old)", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "sha1", "timestamp": "1784899504", "to_ids": true, "type": "sha1", "uuid": "89d72e7e-cdb4-411c-b214-0c861060e521", "value": "fee6806c96f87bf1e240a2eb6fd7e045101d58d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TELESHIM (old)", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "sha256", "timestamp": "1784899504", "to_ids": true, "type": "sha256", "uuid": "dd7149fe-2e5d-463a-9002-44532240d6b4", "value": "0637069c7052118fd5c0f1113541bdd35e5f71cd9689f2516045da152c6fa8d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "text", "timestamp": "1784898406", "to_ids": false, "type": "text", "uuid": "35644c84-f029-42bd-bb07-85abb3cb3d15", "value": "TELESHIM (old)\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win64/TELESHIM.DA!MTB\nClamAV: None\nVT Total Detection: 22/74\nFirst Seen In The Wild: 2026-02-05T12:33:19+00:00\nFirst Submission: 2026-02-05T09:35:03+00:00\nLast Submission: 2026-02-05T15:51:47+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "creation-time", "timestamp": "1784898406", "to_ids": false, "type": "datetime", "uuid": "d4dd9979-aa02-4d40-9940-ce6e31cc9ab5", "value": "2025-03-26T05:20:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "ssdeep", "timestamp": "1784898406", "to_ids": true, "type": "ssdeep", "uuid": "ae10ca51-affb-4aa6-b210-2b3921e95dd0", "value": "6144:2lCc/SyCvuDVCG37nV5i9rZCdYxrIi5DKTrxcr37PX4xx743LpuadAtSXqu1X7:2RwuJY9dCdYxsO+XqD7f4v8BdAtSfX" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898406", "to_ids": false, "type": "size-in-bytes", "uuid": "fd2499cd-e7df-42ad-aa9b-bf7cf2f8fcd9", "value": "451072" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "vhash", "timestamp": "1784898406", "to_ids": true, "type": "vhash", "uuid": "9dde7279-0fae-45a7-8357-8e39bac01091", "value": "145066655d1555155az6oz5ez6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-05T09:35:03+00:00", "last_seen": "2026-02-05T15:51:47+00:00", "object_relation": "filename", "timestamp": "1784898406", "to_ids": true, "type": "filename", "uuid": "dd97e998-9e71-4e6b-9e4e-0d4698e2e374", "value": "dlpprem64.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784902206", "uuid": "146771cf-e564-415e-b5b7-9eb291b31064", "Attribute": [ { "category": "Payload delivery", "comment": "TELESHIM (old)", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "md5", "timestamp": "1784902206", "to_ids": true, "type": "md5", "uuid": "5f9e1829-97bc-44d1-8765-68705c4f3a20", "value": "3f60d53a2b5737d77e058d9e33cbe9eb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TELESHIM (old)", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "sha1", "timestamp": "1784899505", "to_ids": true, "type": "sha1", "uuid": "94f74cf5-07a1-44cd-baea-aff4b827f161", "value": "1099bf51e53bd5fb32401edb4e0be841d8486b19", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TELESHIM (old)", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "sha256", "timestamp": "1784899506", "to_ids": true, "type": "sha256", "uuid": "ef77fd0e-c62c-47c4-b85c-2d8e6321c12f", "value": "cac1f37beaa814461f7709a073aeec468c74e5d70f7d693a9e367ece4a3a78be", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 22/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "text", "timestamp": "1784898428", "to_ids": false, "type": "text", "uuid": "985e6acd-2d3d-4c80-81e9-d60bc5bbb5b7", "value": "TELESHIM (old)\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/TELESHIM.DB!MTB\nClamAV: None\nVT Total Detection: 38/74\nFirst Seen In The Wild: 2026-02-05T12:07:49+00:00\nFirst Submission: 2026-02-05T09:40:58+00:00\nLast Submission: 2026-02-05T15:51:29+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "creation-time", "timestamp": "1784898428", "to_ids": false, "type": "datetime", "uuid": "f3ab9ab4-d1fd-4acb-8082-c05ca120b49b", "value": "2025-04-14T05:00:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "ssdeep", "timestamp": "1784898428", "to_ids": true, "type": "ssdeep", "uuid": "ceb1c7da-b688-4633-aae3-0b54e3a66a72", "value": "6144:17BQbaMrzPJNvLvPVdHGQkNsHt9ucqqjb7SVHonPLwnRPgHiRQkXo:17uPXJhLvrkNEt9uNgPBHi2Oo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898428", "to_ids": false, "type": "size-in-bytes", "uuid": "30c57e81-1824-470f-a481-875d12a8fdb1", "value": "380928" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "vhash", "timestamp": "1784898428", "to_ids": true, "type": "vhash", "uuid": "2e010bb1-7915-4a7c-a20e-15ff824151c5", "value": "135046655d156az5bnz6ez2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-02-05T09:40:58+00:00", "last_seen": "2026-02-05T15:51:29+00:00", "object_relation": "filename", "timestamp": "1784898428", "to_ids": true, "type": "filename", "uuid": "9d06e95c-cbb9-4ae0-b726-e6f73c79ee9f", "value": "g494v75j.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784902228", "uuid": "c4894847-249a-436b-91a8-63b80a5a48c2", "Attribute": [ { "category": "Payload delivery", "comment": "TELESHIM (new)", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "md5", "timestamp": "1784902228", "to_ids": true, "type": "md5", "uuid": "b69d13f2-7809-4785-bfe7-f18ed56fa444", "value": "7cbc51ada1a4aec88660ec32c408114b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TELESHIM (new)", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "sha1", "timestamp": "1784899507", "to_ids": true, "type": "sha1", "uuid": "899bf267-2557-4c32-a2fe-47902ec68ea7", "value": "f46c01a5be2e08e36d4ec3302a8650a6ed25ec14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "TELESHIM (new)", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "sha256", "timestamp": "1784899507", "to_ids": true, "type": "sha256", "uuid": "c2a0b526-8621-4580-be92-f4c98052438c", "value": "5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 22/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "text", "timestamp": "1784898513", "to_ids": false, "type": "text", "uuid": "2c05fb3f-7bda-4e2a-8630-d7f9a39c4279", "value": "TELESHIM (new)\r\nType Description: Win32 DLL\nMicrosoft: Trojan:Win32/TELESHIM.DC!MTB\nClamAV: None\nVT Total Detection: 35/74\nFirst Seen In The Wild: 2026-07-09T11:21:55+00:00\nFirst Submission: 2026-07-09T09:21:17+00:00\nLast Submission: 2026-07-09T09:21:17+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "creation-time", "timestamp": "1784898513", "to_ids": false, "type": "datetime", "uuid": "032efae2-93ad-474a-b46d-45162d777121", "value": "2026-07-07T05:41:14+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "ssdeep", "timestamp": "1784898513", "to_ids": true, "type": "ssdeep", "uuid": "8b76aa0f-62c9-452c-9bc3-c9dd7a831dd8", "value": "24576:cDCrWRrt5c6ixvZMaiAx0I95k05z/WGSl7fhim1h8sPX8AdHn4KPn:cDiWv5cSaSI95p/WG3m+sf8AdHpPn" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898513", "to_ids": false, "type": "size-in-bytes", "uuid": "6dda8645-ac81-47f5-9d7a-21eba84c3297", "value": "1271296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "vhash", "timestamp": "1784898513", "to_ids": true, "type": "vhash", "uuid": "030c6429-cc3b-4548-99a9-2a0f6a936e22", "value": "116056755d1d156az59nz5ez2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:21:17+00:00", "last_seen": "2026-07-09T09:21:17+00:00", "object_relation": "filename", "timestamp": "1784898513", "to_ids": true, "type": "filename", "uuid": "ae840748-63d8-4a88-a4bb-000c5cf5c209", "value": "AsTaskSched.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784902250", "uuid": "ffdf6ad5-1374-46a0-bb34-9f02a280feaf", "Attribute": [ { "category": "Payload delivery", "comment": "ISO image file", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "object_relation": "md5", "timestamp": "1784902250", "to_ids": true, "type": "md5", "uuid": "20b49f9a-e7d8-4cf5-95f0-27f54b01a66d", "value": "b776eb638fbb535708fb92b12fcc1731", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ISO image file", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "object_relation": "sha1", "timestamp": "1784899508", "to_ids": true, "type": "sha1", "uuid": "3919d34a-4f1c-4690-97d9-a0346888a272", "value": "2377c47cfde148c2140faa7105628174f9c4d56d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "ISO image file", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "object_relation": "sha256", "timestamp": "1784899508", "to_ids": true, "type": "sha256", "uuid": "6a182425-cb1c-40a0-88f0-a6281409cd7a", "value": "db11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 24/07/2026\nLast-scan: 23/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "object_relation": "text", "timestamp": "1784898556", "to_ids": false, "type": "text", "uuid": "c0428319-6445-4b32-9622-53f6cf19f5c3", "value": "ISO image file\r\nType Description: ISO image\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-07-09T09:20:39+00:00\nLast Submission: 2026-07-09T09:20:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "object_relation": "ssdeep", "timestamp": "1784898556", "to_ids": true, "type": "ssdeep", "uuid": "9b18b071-2042-4747-80eb-2670a7e60a4c", "value": "49152:ttLp83DiWv5cSaSI95p/WG3m+sf8AdHpPn:98WWv5V8D/WsW8AdJP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1784898556", "to_ids": false, "type": "size-in-bytes", "uuid": "683ccd48-0649-4e67-aaa9-5a930aa73ad5", "value": "2142208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "object_relation": "vhash", "timestamp": "1784898556", "to_ids": true, "type": "vhash", "uuid": "3e156cb6-249b-4cbe-a19d-8ebd982989d1", "value": "20cb6e49d76d47dee43737e0b32eb8d9" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-09T09:20:39+00:00", "last_seen": "2026-07-09T09:20:39+00:00", "object_relation": "filename", "timestamp": "1784898556", "to_ids": true, "type": "filename", "uuid": "7cdb5bb9-36bf-49d9-a319-36d03f2f9a22", "value": "Agreement on the Establishment of Common Border Offices (English).img" } ] } ] } }