{ "Event": { "analysis": "1", "date": "2026-07-18", "extends_uuid": "", "info": "[Threat Intel] Contagious Interview malware in SVG images: DPRK campaign", "protected": false, "publish_timestamp": "1784588166", "published": true, "threat_level_id": "2", "timestamp": "1784588166", "uuid": "a4d42c79-247c-4d1b-9210-a72d35dc1479", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#5f1b93", "local": false, "name": "misp-galaxy:producer=\"Elastic\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-original-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#9dc839", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"APT\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#cc5e96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Obfuscation - T1001\"", "relationship_type": "" }, { "colour": "#ff841f", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"north korea\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Beavertail\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"OtterCookie\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"Contagious Interview\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784343644", "to_ids": false, "type": "link", "uuid": "3d3210cf-165a-41a3-a7a3-96e0a1d9fe8a", "value": "https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784343644", "to_ids": false, "type": "text", "uuid": "55f48838-627f-43f0-a420-f586743c01c8", "value": "A DPRK-aligned threat group is targeting developers through fake job postings and coding challenges in a campaign tracked as REF9403. Attackers post fake job offers in developer forums, then send trojanized repositories containing fully functional e-commerce projects with malicious code hidden using steganography inside SVG flag images. When developers run these projects, the malware deploys four-stage payloads aligned with OTTERCOOKIE: a browser credential and cryptocurrency wallet stealer, a file exfiltration module, a Socket.IO-based remote access trojan, and a clipboard stealer. The campaign was discovered after targeting Elastic's community Slack workspace. Multiple trojanized repositories were found with zero antivirus detections at the time of discovery, demonstrating the sophistication of this supply chain attack vector against software developers." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784343644", "to_ids": false, "type": "text", "uuid": "2ef2b540-735d-4373-ade0-a75863cb72a1", "value": "Name: Contagious Interview malware in SVG images: DPRK campaign\nAuthor: AlienVault\nAdversary: Contagious Interview\nTags: [\"developer targeting\", \"cryptocurrency wallet theft\", \"supply chain attack\", \"svg\", \"ottercookie\", \"steganography\", \"fake job interviews\", \"beavertail\", \"dprk\"]\nTgtd countries: []\nMlwr families: [\"OTTERCOOKIE\", \"BEAVERTAIL\"]\nAttack_ids: [\"T1113\", \"T1059.007\", \"T1071.004\", \"T1497.001\", \"T1115\", \"T1082\", \"T1005\", \"T1140\", \"T1552\", \"T1555.003\", \"T1083\", \"T1036.004\", \"T1204\", \"T1041\", \"T1059.001\", \"T1027.003\", \"T1189\", \"T1071.001\", \"T1105\"]\nIndustries: [\"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784343644", "to_ids": false, "type": "threat-actor", "uuid": "ed4d2d90-5efd-4576-a398-bf2abf2c0fa6", "value": "Contagious Interview" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587678", "to_ids": true, "type": "hostname", "uuid": "c37f47d3-bb00-4f4c-94e7-432e40d6a78d", "value": "controller.rightwidth.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587699", "to_ids": true, "type": "hostname", "uuid": "c128a56d-ad6c-42f0-98d1-4d19c37e3752", "value": "file.rightwidth.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587720", "to_ids": true, "type": "hostname", "uuid": "1b86bf6f-644d-44bb-abf8-35f22cd3b8f9", "value": "ldb.rightwidth.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784587742", "to_ids": true, "type": "hostname", "uuid": "c38bf09a-9f7a-430b-95bd-ec3a6a506ba8", "value": "upload.rightwidth.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "OTTERCOOKIE C2 Server", "deleted": false, "disable_correlation": false, "timestamp": "1784587763", "to_ids": true, "type": "ip-dst", "uuid": "8fa06fb1-443d-42ac-acc3-48fd37081145", "value": "195.26.248.212", "Tag": [ { "colour": "#cbf497", "local": false, "name": "asn:asn=\"40021\"", "relationship_type": "" }, { "colour": "#8d4a96", "local": false, "name": "asn:as-owner=\"CONTABO-40021\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "OTTERCOOKIE C2 Server", "deleted": false, "disable_correlation": false, "timestamp": "1784587784", "to_ids": true, "type": "ip-dst", "uuid": "cc8c3a64-6f8f-4207-8845-9b02dd42e771", "value": "188.40.64.61", "Tag": [ { "colour": "#d17f93", "local": false, "name": "asn:asn=\"24940\"", "relationship_type": "" }, { "colour": "#18e065", "local": false, "name": "asn:as-owner=\"HETZNER-AS\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587805", "uuid": "ac8d868d-6d34-4f37-8c51-eb71f5264394", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "object_relation": "md5", "timestamp": "1784587805", "to_ids": true, "type": "md5", "uuid": "53861220-23f0-4928-b331-b4648ca7ccdb", "value": "e382215527d3e3d7de320797c56898ad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "object_relation": "sha1", "timestamp": "1784585123", "to_ids": true, "type": "sha1", "uuid": "8a0ca98b-9eee-4b79-95e9-db26e45046fe", "value": "e1d89263e20ee02f61634759eb34c4c25ba0b423", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "object_relation": "sha256", "timestamp": "1784585123", "to_ids": true, "type": "sha256", "uuid": "88d1fe31-bab0-47e0-bc75-e0c1f4df15ce", "value": "3e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "object_relation": "text", "timestamp": "1784584456", "to_ids": false, "type": "text", "uuid": "1077e3f8-a723-4f8d-acd5-8d1a87672cc8", "value": "Trojanized repository\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-05-26T14:24:43+00:00\nLast Submission: 2026-05-26T14:24:43+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "object_relation": "ssdeep", "timestamp": "1784584456", "to_ids": true, "type": "ssdeep", "uuid": "248a79ad-5bb5-477e-8b95-584098e16f6c", "value": "49152:kqNuF+Q6ItljMoHl2DZyqemwFumoPvSmtlyzRHLJrXWsbb:kGItljMKlAManmoCmwFWsf" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584456", "to_ids": false, "type": "size-in-bytes", "uuid": "542732ba-c84e-4431-aa63-e90b1cd2e84d", "value": "2285556" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "object_relation": "vhash", "timestamp": "1784584456", "to_ids": true, "type": "vhash", "uuid": "e7702812-c11b-47f8-9f45-63d7cf36e49d", "value": "96d14c247802bf84380a8055c8bbb225" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T14:24:43+00:00", "last_seen": "2026-05-26T14:24:43+00:00", "object_relation": "filename", "timestamp": "1784584456", "to_ids": true, "type": "filename", "uuid": "6d56a768-4b6a-40e3-a2f5-9836045753de", "value": "next-ecommerce-private-main.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587826", "uuid": "2b0789bb-594c-4c42-a63e-24d7d6cbdff5", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "object_relation": "md5", "timestamp": "1784587826", "to_ids": true, "type": "md5", "uuid": "66dfa0e7-fff9-45bb-a734-89f632c519b1", "value": "692cbab7a22a159d6c7de455b9b3a38c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "object_relation": "sha1", "timestamp": "1784585124", "to_ids": true, "type": "sha1", "uuid": "b1ad6a18-ff21-40b0-9b84-ce1054504843", "value": "fffe60d09bd25b0fc0066d6a40f33fe8d934c36b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "object_relation": "sha256", "timestamp": "1784585124", "to_ids": true, "type": "sha256", "uuid": "797fa6b4-8326-464b-8cc6-8775f6e09b22", "value": "4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "object_relation": "text", "timestamp": "1784584478", "to_ids": false, "type": "text", "uuid": "32a94a8b-5d7f-49a2-b405-09f4b0564bf9", "value": "Trojanized repository\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-05-06T15:04:23+00:00\nLast Submission: 2026-05-06T15:04:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "object_relation": "ssdeep", "timestamp": "1784584478", "to_ids": true, "type": "ssdeep", "uuid": "c9b41dba-ff5e-4ba7-bc1f-87fd0ec50e73", "value": "49152:Vvur+746tZbMW9dORDmqemixomoZvMmFlvqRHLJrXWLK:u6tZbMsd06armoymiFW+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584478", "to_ids": false, "type": "size-in-bytes", "uuid": "8b36ab17-17a4-410d-85ed-e041972a26f3", "value": "2300510" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "object_relation": "vhash", "timestamp": "1784584478", "to_ids": true, "type": "vhash", "uuid": "1ed8e631-2166-41b0-a96e-56c4e7723c66", "value": "96d14c247802bf84380a8055c8bbb225" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-06T15:04:23+00:00", "last_seen": "2026-05-06T15:04:23+00:00", "object_relation": "filename", "timestamp": "1784584478", "to_ids": true, "type": "filename", "uuid": "a6e752ab-3e0c-41de-a20d-4b3d51e528b8", "value": "shopping-platform-main.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587847", "uuid": "617d6fbc-351a-4cb7-a6e0-b339410e7d62", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "object_relation": "md5", "timestamp": "1784587847", "to_ids": true, "type": "md5", "uuid": "9ffe2587-1f39-4375-b058-74066025fa07", "value": "d8f7778fa63af28303c8a4b8c9bcd0dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "object_relation": "sha1", "timestamp": "1784585125", "to_ids": true, "type": "sha1", "uuid": "bbdd429b-dab6-4eee-8703-c7316ece8b86", "value": "09ca41335b8fbef077b16950f56c1f7532d2e1f7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "object_relation": "sha256", "timestamp": "1784585126", "to_ids": true, "type": "sha256", "uuid": "0082ad50-cb6b-446c-bf75-2bae18344d49", "value": "54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "object_relation": "text", "timestamp": "1784584499", "to_ids": false, "type": "text", "uuid": "ef1ff433-9c14-4a89-9ebd-43f75652576b", "value": "Trojanized repository\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-04-15T09:34:39+00:00\nLast Submission: 2026-04-15T09:34:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "object_relation": "ssdeep", "timestamp": "1784584499", "to_ids": true, "type": "ssdeep", "uuid": "ec7d2080-8cf7-40c7-b982-3692bc9dd1aa", "value": "98304:z64tygMX+VIJDeoGaPtOTTPmo9m4dleh8M7HtnFWof:24Eg7VIwoGa8TKo9m4dle8IHWof" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584499", "to_ids": false, "type": "size-in-bytes", "uuid": "c5b99ba0-6da1-40ba-af7c-f91852f53100", "value": "4673310" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "object_relation": "vhash", "timestamp": "1784584499", "to_ids": true, "type": "vhash", "uuid": "851e8a74-dc04-4938-b5a5-b87e7409dec2", "value": "0dc7758c7dbda27587cd20b6c3a2ed79" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-15T09:34:39+00:00", "last_seen": "2026-04-15T09:34:39+00:00", "object_relation": "filename", "timestamp": "1784584499", "to_ids": true, "type": "filename", "uuid": "a74fbfe8-9f71-4996-beb6-63d2e68aebf4", "value": "ecommerce-platform.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587868", "uuid": "e51040c0-1cb9-477d-940f-cc7519f5ac66", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "object_relation": "md5", "timestamp": "1784587868", "to_ids": true, "type": "md5", "uuid": "cbc7ddf8-5a40-42c9-acb9-52e2e3ab43d4", "value": "70f26685659017511390ea60f19cd334", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "object_relation": "sha1", "timestamp": "1784585127", "to_ids": true, "type": "sha1", "uuid": "caf52aad-62a9-4f1e-93d1-417eefb816c2", "value": "498a5355c551d99017c6ad89f6fccb8b7808d0b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "object_relation": "sha256", "timestamp": "1784585127", "to_ids": true, "type": "sha256", "uuid": "8fafd698-49a6-49ad-9343-4d12e20ed66a", "value": "8e571d58794b9b44ae53c2c67bedef72c500e8adbb80aab7a5c263adcba55b1e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "object_relation": "text", "timestamp": "1784584521", "to_ids": false, "type": "text", "uuid": "459e9d36-deb9-42d6-9c54-a9c75985abb5", "value": "Trojanized repository\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-07-16T20:55:55+00:00\nLast Submission: 2026-07-16T20:55:55+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "object_relation": "ssdeep", "timestamp": "1784584521", "to_ids": true, "type": "ssdeep", "uuid": "d828de77-2098-4ae5-8ae7-4fd4c36307e7", "value": "98304:/e2ZaaXWcOuoR+EkzMJADqAbbIlVdK7H94cXfZLBjx9M:zBOaEaKADqAYlVdiPM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584521", "to_ids": false, "type": "size-in-bytes", "uuid": "57616a99-fb1f-45f2-b0c9-7275bf6f54bc", "value": "4091786" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "object_relation": "vhash", "timestamp": "1784584521", "to_ids": true, "type": "vhash", "uuid": "28e4cff7-3acc-454c-baa9-5d53de72cd4b", "value": "1bef128634afef73e17c39b5b517ade8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-16T20:55:55+00:00", "last_seen": "2026-07-16T20:55:55+00:00", "object_relation": "filename", "timestamp": "1784584521", "to_ids": true, "type": "filename", "uuid": "37e267e4-a91f-46c1-8b09-bdc976316578", "value": "ecommerce-main.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587889", "uuid": "89accf25-e285-4d0e-86de-30b135e3e63a", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "object_relation": "md5", "timestamp": "1784587889", "to_ids": true, "type": "md5", "uuid": "c4e632d7-f105-4417-b4b1-e8c3d9d6ce0c", "value": "3b00a14383b099fdfed05e17ace03bbc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "object_relation": "sha1", "timestamp": "1784585128", "to_ids": true, "type": "sha1", "uuid": "c9ca6415-b377-43c7-9970-8e703779ad9c", "value": "eb8c6c4446870da0dbd9e26c67baf51d291fbf0d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "object_relation": "sha256", "timestamp": "1784585128", "to_ids": true, "type": "sha256", "uuid": "0389b4f5-fb91-4db6-87a6-0fff3c093bc5", "value": "96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "object_relation": "text", "timestamp": "1784584543", "to_ids": false, "type": "text", "uuid": "c4c22d98-0ee4-43e7-99ff-a7b05ee68729", "value": "Trojanized repository\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 25/74\nFirst Submission: 2026-05-14T04:45:00+00:00\nLast Submission: 2026-05-14T04:45:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "object_relation": "ssdeep", "timestamp": "1784584543", "to_ids": true, "type": "ssdeep", "uuid": "9a1ee4dc-153b-4f78-8214-2f287087dc02", "value": "49152:7bSE+hQ35tMgMHCnxQaLMemJYpmosvPm0lR8LHLJrXW3C:D5tMgMin6IAwmogmvFWy" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584543", "to_ids": false, "type": "size-in-bytes", "uuid": "16652e9a-bc5e-41d7-83d0-efeefa9bdaac", "value": "2296112" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "object_relation": "vhash", "timestamp": "1784584543", "to_ids": true, "type": "vhash", "uuid": "f1f3acbf-0149-450b-9b7f-c86d61450666", "value": "96d14c247802bf84380a8055c8bbb225" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-14T04:45:00+00:00", "last_seen": "2026-05-14T04:45:00+00:00", "object_relation": "filename", "timestamp": "1784584543", "to_ids": true, "type": "filename", "uuid": "2578aa72-2471-4320-ad6a-1948facfd53d", "value": "shop-main.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587911", "uuid": "f1f05912-c798-4ef2-b542-335633ba3998", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "object_relation": "md5", "timestamp": "1784587911", "to_ids": true, "type": "md5", "uuid": "47d55dbf-05c2-4f02-98d5-69c3922b9592", "value": "5a087c9b1aa99571801e5fdb4b6e323e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "object_relation": "sha1", "timestamp": "1784585129", "to_ids": true, "type": "sha1", "uuid": "c04ff5f7-79c4-40f6-80ff-433d18081cbb", "value": "d3f905b72892170de47669f636ab01d88c6917a7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "object_relation": "sha256", "timestamp": "1784585129", "to_ids": true, "type": "sha256", "uuid": "9eb636e2-112d-46d7-9de3-d3ee33b8f334", "value": "9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "object_relation": "text", "timestamp": "1784584564", "to_ids": false, "type": "text", "uuid": "68e8b83e-ec3c-4373-8ced-cf9f0c4eb314", "value": "Trojanized repository\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-05-16T23:55:18+00:00\nLast Submission: 2026-05-18T06:35:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "object_relation": "ssdeep", "timestamp": "1784584564", "to_ids": true, "type": "ssdeep", "uuid": "dd2af452-a052-48f6-b557-4a63a11ab8a8", "value": "49152:RrSh+9Gotf7M0BfETXkMemwt4moZvUmtlNOZHLJrXWjD:Ootf7MMfmUAdmoSm0FW/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584564", "to_ids": false, "type": "size-in-bytes", "uuid": "181488d3-f9ae-4b19-b156-d3d05cf4e7f6", "value": "2303981" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "object_relation": "vhash", "timestamp": "1784584564", "to_ids": true, "type": "vhash", "uuid": "421f1a67-01bd-47ab-9808-497302e6f30e", "value": "96d14c247802bf84380a8055c8bbb225" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-16T23:55:18+00:00", "last_seen": "2026-05-18T06:35:35+00:00", "object_relation": "filename", "timestamp": "1784584564", "to_ids": true, "type": "filename", "uuid": "120d70dd-33ad-477b-8d60-0110d28c73f2", "value": "ecommerce-platform-main.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-02T19:39:58+00:00", "last_seen": "2026-06-02T19:39:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587932", "uuid": "cee4a383-8fc9-4297-b870-359039e07876", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T19:39:58+00:00", "last_seen": "2026-06-02T19:39:58+00:00", "object_relation": "md5", "timestamp": "1784587932", "to_ids": true, "type": "md5", "uuid": "557e745e-a95f-4424-9a56-6d4b16332088", "value": "49356187fbdb16a27756478a514dff3b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T19:39:58+00:00", "last_seen": "2026-06-02T19:39:58+00:00", "object_relation": "sha1", "timestamp": "1784585131", "to_ids": true, "type": "sha1", "uuid": "81a856f3-faa4-4d84-9e43-7f59dd1ca32b", "value": "62436d37c5247c41e33b5c93963774bae900ad3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T19:39:58+00:00", "last_seen": "2026-06-02T19:39:58+00:00", "object_relation": "sha256", "timestamp": "1784585131", "to_ids": true, "type": "sha256", "uuid": "7718786f-22fa-40c5-be7e-a2fd7da9762b", "value": "c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T19:39:58+00:00", "last_seen": "2026-06-02T19:39:58+00:00", "object_relation": "text", "timestamp": "1784584586", "to_ids": false, "type": "text", "uuid": "eb029122-5e48-4db4-ba9f-1ad24069c868", "value": "Trojanized repository\r\nType Description: RAR\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-06-02T19:39:58+00:00\nLast Submission: 2026-06-02T19:39:58+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T19:39:58+00:00", "last_seen": "2026-06-02T19:39:58+00:00", "object_relation": "ssdeep", "timestamp": "1784584586", "to_ids": true, "type": "ssdeep", "uuid": "a034cfd6-6c1f-4cd1-a15d-eb066bc7b5d5", "value": "49152:IXtOPxWOI78hrGJlw6DwS5FtgR6otBC3TWipDm6JUvc4Tji:IIZWEr0l30Sw6JCq3b4TO" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T19:39:58+00:00", "last_seen": "2026-06-02T19:39:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584586", "to_ids": false, "type": "size-in-bytes", "uuid": "d4267152-0247-402c-a8cd-0ade194aa94e", "value": "2188616" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T19:39:58+00:00", "last_seen": "2026-06-02T19:39:58+00:00", "object_relation": "filename", "timestamp": "1784584586", "to_ids": true, "type": "filename", "uuid": "eef85be1-239a-4dd3-a9a6-ed185d8ae5b2", "value": "shopping-platform.rar" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-02T19:39:15+00:00", "last_seen": "2026-06-02T19:39:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587953", "uuid": "e1cc1035-4377-4178-8930-8fe9620e56b0", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T19:39:15+00:00", "last_seen": "2026-06-02T19:39:15+00:00", "object_relation": "md5", "timestamp": "1784587953", "to_ids": true, "type": "md5", "uuid": "6df58fbc-a856-420d-8b34-374b588b1915", "value": "681ad25778e051803503cbf29189b6f4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T19:39:15+00:00", "last_seen": "2026-06-02T19:39:15+00:00", "object_relation": "sha1", "timestamp": "1784585132", "to_ids": true, "type": "sha1", "uuid": "79f69a5a-f457-45a3-805e-e056327a313f", "value": "54eba094d078db96d4d8c29e5d349737a9bc0738", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T19:39:15+00:00", "last_seen": "2026-06-02T19:39:15+00:00", "object_relation": "sha256", "timestamp": "1784585132", "to_ids": true, "type": "sha256", "uuid": "b6782687-1fe2-4819-9c8b-d445c8d5846b", "value": "cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T19:39:15+00:00", "last_seen": "2026-06-02T19:39:15+00:00", "object_relation": "text", "timestamp": "1784584608", "to_ids": false, "type": "text", "uuid": "47486cdd-0cfd-4a7c-8278-0b4cec486959", "value": "Trojanized repository\r\nType Description: RAR\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-06-02T19:39:15+00:00\nLast Submission: 2026-06-02T19:39:15+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-02T19:39:15+00:00", "last_seen": "2026-06-02T19:39:15+00:00", "object_relation": "ssdeep", "timestamp": "1784584608", "to_ids": true, "type": "ssdeep", "uuid": "be112a05-407a-449e-ba8a-274e54590dc0", "value": "196608:CdgfCgvBrJMY0m0CMMLGcWSun9h+hHyvBM:CahBrJZFjKrpvBM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T19:39:15+00:00", "last_seen": "2026-06-02T19:39:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584608", "to_ids": false, "type": "size-in-bytes", "uuid": "084060db-b1fa-4969-a81b-c2b6bf4eee95", "value": "6622032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-02T19:39:15+00:00", "last_seen": "2026-06-02T19:39:15+00:00", "object_relation": "filename", "timestamp": "1784584608", "to_ids": true, "type": "filename", "uuid": "fe73af27-35a5-4c77-a374-d29438771341", "value": "shopping-platform.rar" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784587974", "uuid": "a3beddbc-9f74-4f8d-8885-6320021fe69a", "Attribute": [ { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "object_relation": "md5", "timestamp": "1784587974", "to_ids": true, "type": "md5", "uuid": "1c295740-e2d2-42e3-9110-cde30edf3e74", "value": "9c055f0f21059552f29459c1b07de509", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "object_relation": "sha1", "timestamp": "1784585133", "to_ids": true, "type": "sha1", "uuid": "ee251950-a067-4561-a73d-c97a6da0a627", "value": "ff0d75903b97acd26776879ba255b8641efaf2fd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Trojanized repository", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "object_relation": "sha256", "timestamp": "1784585133", "to_ids": true, "type": "sha256", "uuid": "2e45bb52-66ca-4f3a-9a9f-0e97bfdeb0f4", "value": "fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "object_relation": "text", "timestamp": "1784584629", "to_ids": false, "type": "text", "uuid": "5d280ea4-fb66-44aa-a464-7ac670b4a8a6", "value": "Trojanized repository\r\nType Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 2/74\nFirst Submission: 2026-05-13T21:10:19+00:00\nLast Submission: 2026-05-13T21:10:19+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "object_relation": "ssdeep", "timestamp": "1784584629", "to_ids": true, "type": "ssdeep", "uuid": "f02536fd-6910-4296-a2dc-9e795b45fd22", "value": "49152:LbSE+hQ35tMgMHCnxQaLMemJYpmosvPm0lR8LHLJrXW0X:T5tMgMin6IAwmogmvFW6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "object_relation": "size-in-bytes", "timestamp": "1784584629", "to_ids": false, "type": "size-in-bytes", "uuid": "367bb9ba-0789-46ab-9c52-8aaf78869c55", "value": "2292666" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "object_relation": "vhash", "timestamp": "1784584629", "to_ids": true, "type": "vhash", "uuid": "30251cd9-48f9-4652-beb7-77d005949571", "value": "96d14c247802bf84380a8055c8bbb225" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T21:10:19+00:00", "last_seen": "2026-05-13T21:10:19+00:00", "object_relation": "filename", "timestamp": "1784584629", "to_ids": true, "type": "filename", "uuid": "56c35cc7-a15d-45b2-ba0d-db03eef8f1fe", "value": "shop-main.zip" } ] } ] } }