{ "Event": { "analysis": "1", "date": "2026-06-03", "extends_uuid": "", "info": "[Threat Intel] Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem", "protected": false, "publish_timestamp": "1780629662", "published": true, "threat_level_id": "3", "timestamp": "1780629662", "uuid": "a61ff03b-bbe4-4a37-9108-01012488dde8", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#5dfed4", "local": false, "name": "misp-galaxy:producer=\"Check Point\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#7da4ad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#9dc839", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#1cbe6b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Virtualization/Sandbox Evasion - T1497\"", "relationship_type": "" }, { "colour": "#f95f85", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#07a4a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encoding - T1132\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#4c0fbb", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#15ccfd", "local": false, "name": "misp-galaxy:target-information=\"France\"", "relationship_type": "" }, { "colour": "#5ed128", "local": false, "name": "misp-galaxy:target-information=\"Germany\"", "relationship_type": "" }, { "colour": "#809a25", "local": false, "name": "misp-galaxy:target-information=\"Poland\"", "relationship_type": "" }, { "colour": "#15cd0b", "local": false, "name": "misp-galaxy:target-information=\"Russia\"", "relationship_type": "" }, { "colour": "#ce59f1", "local": false, "name": "misp-galaxy:target-information=\"United Kingdom\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780570826", "to_ids": false, "type": "link", "uuid": "514727a4-6e71-4843-86af-84aba46b33d7", "value": "https://research.checkpoint.com/2026/impersonation-click-hijacking-and-tds-inside-a-malware-distribution-ecosystem/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1780570826", "to_ids": false, "type": "text", "uuid": "7f486334-a906-47d1-b2fb-a4d50f56b219", "value": "A large-scale operation impersonates open-source and freeware projects to capture search traffic, targeting tools such as Ghidra, dnSpy, and SpiderFoot. The professionally designed sites load CloudFront-hosted JavaScript that converts download button clicks into handoffs to a Traffic Distribution System (TDS), which enforces strict gating including first-visit state, click confirmation, anti-bot logic, VPN filtering, and frequency capping. The ecosystem appears primarily built for traffic acquisition and monetization using legitimate ad-tech, but downstream redirect chains repeatedly led selected users to malware delivery infrastructure. The observed payloads include SessionGate (a multi-stage loader with heavy obfuscation delivering potentially unwanted applications), RemusStealer (an infostealer targeting over 20 browsers and hundreds of extensions), and AnimateClipper (a cryptocurrency clipper supporting 20+ blockchain ecosystems). Over 5,000 VirusTotal submissions indicate substantial reach across the ..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1780570826", "to_ids": false, "type": "text", "uuid": "64e3f17c-f2d9-4cb7-82a0-66e5913ffb5d", "value": "Name: Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution Ecosystem\nAuthor: AlienVault\nAdversary: \nTags: [\"animateclipper\", \"remusstealer\", \"click hijacking\", \"cryptocurrency clipper\", \"infostealer\", \"traffic distribution system\", \"sessiongate\"]\nTgtd countries: [\"Brazil\", \"France\", \"Germany\", \"Poland\", \"Russian Federation\", \"United Kingdom of Great Britain and Northern Ireland\"]\nMlwr families: [\"SessionGate\", \"RemusStealer\", \"AnimateClipper\"]\nAttack_ids: [\"T1113\", \"T1056.001\", \"T1539\", \"T1036.005\", \"T1204.002\", \"T1566.002\", \"T1115\", \"T1082\", \"T1005\", \"T1140\", \"T1055\", \"T1555.003\", \"T1083\", \"T1497\", \"T1552.001\", \"T1027\", \"T1573\", \"T1132\", \"T1071.001\", \"T1105\"]\nIndustries: []" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625086", "to_ids": true, "type": "domain", "uuid": "15bab0de-2f2d-497e-bdef-2a80ab5e158b", "value": "guiformat.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625107", "to_ids": true, "type": "ip-dst", "uuid": "b60ba24e-5645-42cd-acec-2b7af8e6464b", "value": "194.150.220.218", "Tag": [ { "colour": "#6dc194", "local": false, "name": "asn:asn=\"7018\"", "relationship_type": "" }, { "colour": "#f71a75", "local": false, "name": "asn:as-owner=\"ATT-INTERNET4\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625130", "to_ids": true, "type": "domain", "uuid": "1bb2704c-a7b6-433d-9d35-d2e7f1675bb8", "value": "forestoaker.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625153", "to_ids": true, "type": "url", "uuid": "a7fda1ae-3a76-45c5-a8d2-6ada6ffa4a1a", "value": "http://194.150.220.218/4SLEYpfAk57hGubo/fo0suc2ki2.rtf", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625174", "to_ids": true, "type": "ip-dst", "uuid": "b9c88e3a-c983-4e37-ad02-16cb9d28342a", "value": "217.156.122.75", "Tag": [ { "colour": "#880467", "local": false, "name": "asn:asn=\"48753\"", "relationship_type": "" }, { "colour": "#2ef04f", "local": false, "name": "asn:as-owner=\"AVAHOHST\"", "relationship_type": "" }, { "colour": "#9ca493", "local": false, "name": "asn:as-country=\"MD\"", "relationship_type": "" }, { "colour": "#4f4d08", "local": false, "name": "misp-galaxy:country=\"moldova\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625197", "to_ids": true, "type": "hostname", "uuid": "32e3ef25-f8aa-4ef9-b0ed-799e96313275", "value": "arch2.maxdatahost1.cyou", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625218", "to_ids": true, "type": "url", "uuid": "7d5147ed-94ea-433c-acd5-d182e43099c4", "value": "http://baxe.pics:48261", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625239", "to_ids": true, "type": "url", "uuid": "3c851eaa-876b-4182-b68e-c75016921b61", "value": "http://buccstanor.pics:28313", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625260", "to_ids": true, "type": "url", "uuid": "4cdd81eb-57b6-4d0a-8d30-c69ae473c8fa", "value": "http://buccstanor.pics:48261", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625281", "to_ids": true, "type": "url", "uuid": "1f953bda-02d9-4b9a-9257-f90c111ccd03", "value": "http://forestoaker.com:6290", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625302", "to_ids": true, "type": "url", "uuid": "519505c0-d992-4138-a708-31c490cc529d", "value": "http://gluckcreek.online:48261", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625323", "to_ids": true, "type": "url", "uuid": "b36aab20-1aa6-4d5f-81fa-8b67d2996a16", "value": "http://intem.lat:9592", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625345", "to_ids": true, "type": "url", "uuid": "3c6e248f-2a8c-46f2-b2ac-cb28ea525969", "value": "http://ropea.top:28313", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625366", "to_ids": true, "type": "domain", "uuid": "b39c3aa8-98f4-4108-bed5-6762cbdade9b", "value": "buccstanor.pics", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625387", "to_ids": true, "type": "domain", "uuid": "fa60c489-c89b-4a6c-9a8b-dcdf4524d7b0", "value": "gluckcreek.online", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625409", "to_ids": true, "type": "domain", "uuid": "b1fa45a7-d939-4dae-919f-1e6091af2974", "value": "intem.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625430", "to_ids": true, "type": "domain", "uuid": "c15c41f4-6fc2-4be8-8bc7-283a866064c0", "value": "ropea.top", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625451", "to_ids": true, "type": "domain", "uuid": "2c3bdb17-6032-4eb6-b793-374d0ac552ec", "value": "ilspy.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625474", "to_ids": true, "type": "hostname", "uuid": "0f9ab78a-2205-40a6-b890-be211f4b689d", "value": "cdn-1415.brightcanvas.digital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625496", "to_ids": true, "type": "domain", "uuid": "a4d846ba-b7f0-4b4f-8dab-ab51b03d621d", "value": "flame-guard.cc", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623528", "to_ids": true, "type": "md5", "uuid": "ab8f0632-c843-46c9-8ceb-e182b07738de", "value": "bfea4ee8ef934be7a2b4c64a0bad1e92", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623529", "to_ids": true, "type": "sha256", "uuid": "4fd07e4b-cd3e-493b-af48-32ba08d3b28a", "value": "26f2abfc254a59c2386dd46dca16744f7147a0f0366cb6008e1d53219175f44c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623530", "to_ids": true, "type": "sha256", "uuid": "32927a5d-6246-4a97-9b5d-9768707dc4ba", "value": "39dc2327fe1e5a56ac5ad9dc02f0386cff3d83dcfdc558cacba42ebb9dcc5ec2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623531", "to_ids": true, "type": "sha256", "uuid": "2cd06cbf-d287-4887-9b00-9909abe74f36", "value": "cbad672d9bd06ce91ce465d049e50696fbaec9d209ca0ab1fd814d993d04bc9b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623532", "to_ids": true, "type": "sha256", "uuid": "e51f0e8e-6a45-4611-b76b-090e00cfd855", "value": "ce0888df5e28716432013a8ae002437bd3e993fbe8362c5ff9efbddabfe0ab77", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:05/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1780623534", "to_ids": true, "type": "sha256", "uuid": "7a8752e1-2ab2-409e-ad6f-619030934a82", "value": "e6a1a428a7c09c9946f7c0179d89b263f442dc3208b5144a9146c200e4185bd6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625517", "to_ids": true, "type": "url", "uuid": "6252b312-5957-4cf7-ac33-a8edc57c7924", "value": "http://oundhertobeconsist.org/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625538", "to_ids": true, "type": "url", "uuid": "c9fa1026-80ec-43ae-95e9-6ffce41a5426", "value": "https://cdn-1415.brightcanvas.digital/fo0suc2ki2.rtf", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625559", "to_ids": true, "type": "url", "uuid": "81c0463d-c4a2-42dd-a071-218cbc9c5c47", "value": "https://javascriptapiusa.com/lic", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625580", "to_ids": true, "type": "domain", "uuid": "cf6ad127-a839-4247-878b-b45e38dff04f", "value": "appfreshstart.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625601", "to_ids": true, "type": "domain", "uuid": "7460f916-d6b9-4d65-af25-f63fc7bcec83", "value": "appgetonline.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625622", "to_ids": true, "type": "domain", "uuid": "8b043cf2-0a63-4c51-9252-3b327d268c2d", "value": "appmakingcenter.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625643", "to_ids": true, "type": "domain", "uuid": "bf0752ec-5f66-4268-bded-99e385261eda", "value": "carlessclapped.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625665", "to_ids": true, "type": "domain", "uuid": "6e5e703c-28ca-4a6d-97ee-503c7d275d77", "value": "crystaldiskmark.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625689", "to_ids": true, "type": "domain", "uuid": "41cb3f22-8034-4bfe-a523-e1b71ed78a7e", "value": "dnspy.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625713", "to_ids": true, "type": "domain", "uuid": "c286999f-5ecd-408e-a920-0ef0b2a757d5", "value": "ghidralite.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625737", "to_ids": true, "type": "domain", "uuid": "001078ca-caa4-4605-8a48-be44f95ecae1", "value": "grpcurl.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625758", "to_ids": true, "type": "domain", "uuid": "6a58357d-c4e9-490c-83bf-03fa3d54b222", "value": "integritycrc.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625782", "to_ids": true, "type": "domain", "uuid": "05516a0b-5730-4765-b610-d95972559b6d", "value": "javascriptapiusa.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625803", "to_ids": true, "type": "domain", "uuid": "229bfe04-8f0f-4243-a4e3-41f92ab823bc", "value": "mfcmapi.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625825", "to_ids": true, "type": "domain", "uuid": "46c696f8-7a7b-443d-a1b3-cc91a766e3d1", "value": "mobileversioncrc.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625846", "to_ids": true, "type": "domain", "uuid": "452e8a8a-4747-4395-b4e9-7532a2cff957", "value": "mqttexplorer.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625867", "to_ids": true, "type": "domain", "uuid": "9658dd37-7fda-42d0-9c6e-f40093ef1e47", "value": "originaldownloads.info", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625890", "to_ids": true, "type": "domain", "uuid": "0d3e1742-d05b-45cd-9573-f523b2ec78f6", "value": "ukentaspectsofc.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625911", "to_ids": true, "type": "domain", "uuid": "bc29d4c0-b71d-4d4f-9957-edbfa9b410e2", "value": "unlockcontent.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625932", "to_ids": true, "type": "domain", "uuid": "83018352-1fb1-4aa4-b244-c3561ee4ae9a", "value": "webcrcprove.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625953", "to_ids": true, "type": "domain", "uuid": "536676a6-df23-4547-bcbd-f598bf231cb9", "value": "webinnosetup.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625974", "to_ids": true, "type": "domain", "uuid": "34d6b100-870f-486e-9e61-743c5872bf2b", "value": "winsetupfromusb.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780625996", "to_ids": true, "type": "domain", "uuid": "734fd660-02eb-4012-8696-dca593628983", "value": "yourfastcrc.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626017", "to_ids": true, "type": "hostname", "uuid": "ce51856f-d416-470c-866f-7f9dce5f77d8", "value": "cw.hugo-lapp.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626038", "to_ids": true, "type": "hostname", "uuid": "ec6166d4-a5c9-4ad0-810b-022113313d65", "value": "ed.hugo-lapp.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626060", "to_ids": true, "type": "hostname", "uuid": "c966cad6-20af-4b01-a246-99f90ef6dee2", "value": "fd.hugo-lapp.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626081", "to_ids": true, "type": "hostname", "uuid": "f65d9f3f-ffab-4df6-babd-c52fec3aa660", "value": "io.hugo-lapp.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626102", "to_ids": true, "type": "hostname", "uuid": "a1ddd995-4e29-4709-8088-3ad11715b78b", "value": "kr.hugo-lapp.co", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626123", "to_ids": true, "type": "hostname", "uuid": "0e2de7e8-7478-4306-a9d0-9de689eca46a", "value": "media.stellarcloudhub1.cfd", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626145", "to_ids": true, "type": "hostname", "uuid": "36d8a18b-8e95-4544-9a4a-08e8430809aa", "value": "processing-in-progress-x4.t3.storage.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626166", "to_ids": true, "type": "hostname", "uuid": "e822da83-9b1a-48bd-98a9-64c07e82537f", "value": "st.hugo-lapp.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626189", "to_ids": true, "type": "hostname", "uuid": "ebc88f3e-ab7d-48b1-a1d6-36ec36c6b8ae", "value": "td.hugo-lapp.lat", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 28313", "deleted": false, "disable_correlation": false, "timestamp": "1780626210", "to_ids": true, "type": "url", "uuid": "179dc603-a64e-48fc-b52b-6457a8139ce0", "value": "http://buccstanor.pics", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 48261", "deleted": false, "disable_correlation": false, "timestamp": "1780626230", "to_ids": true, "type": "url", "uuid": "a439ddb4-15a5-4ec6-9133-581980cd4508", "value": "http://baxe.pics", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 1378", "deleted": false, "disable_correlation": false, "timestamp": "1780626251", "to_ids": true, "type": "url", "uuid": "3ca6c392-125d-4f81-be1f-754cf8f4d3c5", "value": "http://217.156.122.75", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 9592", "deleted": false, "disable_correlation": false, "timestamp": "1780626272", "to_ids": true, "type": "url", "uuid": "82f9e5df-51f9-47bd-9902-9211618e3389", "value": "http://intem.lat", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 28313", "deleted": false, "disable_correlation": false, "timestamp": "1780626293", "to_ids": true, "type": "url", "uuid": "ec9cd501-20c4-49f1-94f4-70534851a26e", "value": "http://ropea.top", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 6290", "deleted": false, "disable_correlation": false, "timestamp": "1780626314", "to_ids": true, "type": "url", "uuid": "fa80faef-69b1-4d8d-9710-65b3d18be49c", "value": "http://forestoaker.com", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 28313", "deleted": false, "disable_correlation": false, "timestamp": "1780626335", "to_ids": true, "type": "url", "uuid": "77effc6b-b930-4af8-b819-aa4a30e362ea", "value": "http://94.231.205.229", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 48261", "deleted": false, "disable_correlation": false, "timestamp": "1780626356", "to_ids": true, "type": "url", "uuid": "31d9ad6a-97a7-4e96-a354-2d4cd9d39c40", "value": "http://gluckcreek.online", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780626376", "to_ids": true, "type": "url", "uuid": "d0a94bea-375a-4979-9f95-1edb863782a8", "value": "https://185.0xA1.0xFB.58/navy.7z", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780626398", "uuid": "1eb409d8-089e-43d0-be46-238e0fd979f0", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780626398", "to_ids": true, "type": "md5", "uuid": "58d556af-a081-4a5b-b6af-30adf55e8322", "value": "bdc248b7ad0e4e28d30ecbd476a8e944", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623519", "to_ids": true, "type": "sha1", "uuid": "af6e8a3e-8b1b-46b1-bbd9-1a8149d5df4b", "value": "f12acf3c9d123277961ab11c57ac480f74440e05", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623519", "to_ids": true, "type": "sha256", "uuid": "382ce2ad-c2ed-4308-9cdb-cb4c9054c8ce", "value": "87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622791", "to_ids": true, "type": "ssdeep", "uuid": "ca248120-d063-42aa-86d6-c4560998d3a1", "value": "3072:N8h1DnnA4tDw/sliLbjlJ6Bd4MD2vUQz+K1fKiKjX6mNasZ74mGhzfx7:NS1DB+ZbjlYT1cUQz+yfKVOYZqf" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622791", "to_ids": false, "type": "size-in-bytes", "uuid": "0c88ccb3-a7a1-4572-9ef6-be3cb655ea53", "value": "233472" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622791", "to_ids": true, "type": "vhash", "uuid": "2853a700-c112-446c-8f61-a4ca61a9d880", "value": "025086655d155d0d05155az543z91z404bz61z7bz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622791", "to_ids": true, "type": "filename", "uuid": "91331a38-e121-4221-a2da-2b2851cb4072", "value": "FINAL MALWARE.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622791", "to_ids": false, "type": "text", "uuid": "f9a41421-14ef-4428-ba2f-b9c667c1413a", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/ClipBanker.ATB!MTB\nVT Total Detection:52/71\nFirst Submission:2026-02-22T14:19:08.000000+00:00\nLast Submission:2026-03-12T20:09:25.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780626419", "uuid": "d491a67a-af0e-42fd-bb02-137d360bde82", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780626419", "to_ids": true, "type": "md5", "uuid": "7f944420-506f-4038-ad41-f7283398f2f4", "value": "8c4f8abe69bde5e1a53ca98fe22e13aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623520", "to_ids": true, "type": "sha1", "uuid": "9fcb2157-ba14-4862-92e7-fecce1c6bff0", "value": "d6b6eb84b0718cbd02eea586637679b4d77bb34f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623520", "to_ids": true, "type": "sha256", "uuid": "5a96645b-efa9-469f-a368-e21f966badb4", "value": "3bb92771e287aa0a8bdd8e5b5bb697427223eaefded3d9b64b5d5c32ad40f3c2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622813", "to_ids": true, "type": "ssdeep", "uuid": "c0b6b505-9d24-4fbe-81ff-6ba62d8c3afa", "value": "393216:jXVxcaTtqtn2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlkr:jlxcaTtqtK2OGfEhP0JqHOG8qr" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622813", "to_ids": false, "type": "size-in-bytes", "uuid": "35a8f11d-1aff-4984-8b79-337826ce0e37", "value": "20968520" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622813", "to_ids": true, "type": "vhash", "uuid": "9869e604-9287-436e-af29-4f22019faf72", "value": "027056555d55156098zad9z35z12z14ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622813", "to_ids": true, "type": "filename", "uuid": "41986259-9472-4890-a3f9-e68b46e910d5", "value": "Vape-Client_250099.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622813", "to_ids": false, "type": "text", "uuid": "4e688f42-ad07-42f1-ba62-b566881bf609", "value": "Type Description: Win32 EXE\nMicrosoft: Adware:Win32/OpenSUpdater\nVT Total Detection:23/71\nFirst Submission:2026-01-11T17:23:34.000000+00:00\nLast Submission:2026-05-25T04:46:04.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780626440", "uuid": "85806ea2-2f86-42b7-be73-e02791bfa221", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780626440", "to_ids": true, "type": "md5", "uuid": "0e91d4b0-471c-443a-9fdc-568f23f46ff6", "value": "f0ea4c47bc8fec96770d023f1025bcb3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623521", "to_ids": true, "type": "sha1", "uuid": "a8ee2168-9d1a-49ec-83b2-0c2aeac7b2c4", "value": "a3d2ea3aa5850ecac5e75b0cc1467bda57dbb776", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623521", "to_ids": true, "type": "sha256", "uuid": "d5975a85-77c8-4fd2-899a-c8d71cc61d44", "value": "15e6df0c95f2147952308e640d55270e9d097639eaebb34d4b352415f1c6bceb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622856", "to_ids": true, "type": "ssdeep", "uuid": "a1ed5c1b-a6b7-476e-b6bc-7dc237a3fdbc", "value": "393216:uVBR7W8Fn2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlki:sBR7W8FK2OGfEhP0JqHOG8qi" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622856", "to_ids": false, "type": "size-in-bytes", "uuid": "976031d7-b359-4ced-9426-7e3e01430a57", "value": "21015624" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622856", "to_ids": true, "type": "vhash", "uuid": "7b29e57f-d7a0-440c-85a1-eca3d5cbb53b", "value": "027056555d55156098zad9z35z12z14ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622856", "to_ids": true, "type": "filename", "uuid": "13643278-8598-4d4b-8cc2-9e8b2961b47c", "value": "Offline-Lunar-Tool_312847.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622856", "to_ids": false, "type": "text", "uuid": "c7174c9c-9ac1-4ee1-9654-286d50dcfe24", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:22/70\nFirst Submission:2026-01-05T16:28:24.000000+00:00\nLast Submission:2026-05-17T17:11:37.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780626461", "uuid": "23e84963-7200-4bfc-8f15-f36d240dbd87", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780626461", "to_ids": true, "type": "md5", "uuid": "72d992e0-7d47-470f-bb7c-7e0b00cddf3d", "value": "f48bf08687948ead049686cdee0e92dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623523", "to_ids": true, "type": "sha1", "uuid": "a443b994-1f91-4cf1-a2bc-97e6166944d7", "value": "606966a9ec33765baedf63331595d1168f2a596f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623523", "to_ids": true, "type": "sha256", "uuid": "f6613277-f6f6-4734-929f-0e2b3b93e44b", "value": "74091f5a8746a1c68d73e1fc1e4e1ff514632ee3f632a8b306f35dabae2d2b64", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622877", "to_ids": true, "type": "ssdeep", "uuid": "c8cd1f7b-589b-41c5-ac97-f12b0803dc02", "value": "393216:WJFXmhjx1n2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlku:WJF2hjzK2OGfEhP0JqHOG8qu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622877", "to_ids": false, "type": "size-in-bytes", "uuid": "266cad08-4e8c-4f88-b9e3-d0aabed063bb", "value": "20865096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622877", "to_ids": true, "type": "vhash", "uuid": "d82f2cca-39f0-4fc6-9a74-46c34fe04650", "value": "027056555d55156098zad9z35z12z14ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622877", "to_ids": true, "type": "filename", "uuid": "8e5881f2-de8b-4130-aba4-732a600da6b9", "value": "Fluxus-Z-Executor_275116.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622877", "to_ids": false, "type": "text", "uuid": "612bffd3-7eed-4f27-a8b3-3709592b1fbc", "value": "Type Description: Win32 EXE\nMicrosoft: Adware:Win32/Tnega\nVT Total Detection:20/71\nFirst Submission:2026-01-08T18:22:52.000000+00:00\nLast Submission:2026-05-14T19:10:02.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780626482", "uuid": "d1adffee-4367-41e0-845e-60843028fd85", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780626482", "to_ids": true, "type": "md5", "uuid": "aef3a84e-afb6-42f4-8574-464b2c6c6d37", "value": "3f3c40e6cd10bb385464d8601df30060", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623524", "to_ids": true, "type": "sha1", "uuid": "43fbaca8-6998-4aa4-92ba-d9f2259431c7", "value": "58761f5bddb95bd8f91340e995cf42322d47cf30", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623524", "to_ids": true, "type": "sha256", "uuid": "befefd2c-9827-46fa-809f-2e590b9f28ed", "value": "2e842eab0c16ddd1a2ec4a56610adb58d115b65a1e08e9b67e7e375f8eed0873", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622920", "to_ids": true, "type": "ssdeep", "uuid": "b6298fe6-af94-4e8a-b270-ed3e53d7f58d", "value": "3072:+uasQyBVshtd+fOUIA1qwMpfUkwMU86O6iy5JuRw1pdvbH:+SDs7BlDUkwmn6iy5JTdvbH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622920", "to_ids": false, "type": "size-in-bytes", "uuid": "21d2fddf-3215-4390-aa49-1ce934df01bb", "value": "221184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622920", "to_ids": true, "type": "vhash", "uuid": "5b5b3082-ac05-469d-a2e4-600f95e508ec", "value": "025046655d155035z91z67z504bzafz" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 04/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622920", "to_ids": false, "type": "text", "uuid": "6be13c7c-5991-4934-b18b-87c15826f20c", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Stealer.NVE!MTB\nVT Total Detection:41/71\nFirst Submission:2026-02-18T19:17:30.000000+00:00\nLast Submission:2026-02-18T19:17:30.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780626503", "uuid": "a93c2ac3-baeb-448f-8a00-67e8122d9971", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780626503", "to_ids": true, "type": "md5", "uuid": "60c42eb5-f211-4d79-a856-301052bf240b", "value": "2b5ee82548199a49ff06e001cade2ada", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623525", "to_ids": true, "type": "sha1", "uuid": "f62694ef-6bca-4040-80b5-781b0761e636", "value": "e507582d95494f35cbc2d4c1198e3e26336cebad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623526", "to_ids": true, "type": "sha256", "uuid": "ed843c32-3f60-4b59-83c3-65ea4741757f", "value": "4cdb1f7ac502289119f7f8256f00baaa994e6ecfb4000dcf5e1c46073508fcb3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622962", "to_ids": true, "type": "ssdeep", "uuid": "f29e46a4-19ed-43d6-9624-4aca50410b0a", "value": "196608:p5TaWxiNF4Qm7K3eu3jeLCueVuV24ZG4mgTVpjQMAcAzL6nZVkbqw:vTaWe+UvSt9G2RpgzL6ZV3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622962", "to_ids": false, "type": "size-in-bytes", "uuid": "cddecf57-cbe3-4be7-85bf-17e5a93dd24f", "value": "10372736" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622962", "to_ids": true, "type": "vhash", "uuid": "6891d0d3-b57e-426c-a3f3-2f8cccee19ee", "value": "017056655d151563z54zaa7z6065z52z3afz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622962", "to_ids": true, "type": "filename", "uuid": "7daa39e2-f668-48f6-958d-7ec0c14f7de7", "value": "multiget.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 05/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622962", "to_ids": false, "type": "text", "uuid": "654bed69-7ae3-4425-9f8e-15a0f9838f4d", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:6/71\nFirst Submission:2026-02-05T16:51:36.000000+00:00\nLast Submission:2026-02-06T03:40:58.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780626525", "uuid": "eddebbd4-51ee-4371-aa73-a8419627a3ac", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780626525", "to_ids": true, "type": "md5", "uuid": "ed20747d-1e76-408a-b2ec-06d5114911a9", "value": "0f05642e9a296b074afe93581600b50c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780623527", "to_ids": true, "type": "sha1", "uuid": "44aff06c-0343-4b81-a0f0-826441f16a72", "value": "316c05d32a1650cca76af08a35057320ecc5b855", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780623527", "to_ids": true, "type": "sha256", "uuid": "ec12530a-c5de-4b06-b044-4faf74a108c5", "value": "598b023e56c45b19173e8f96c1c88036d732fec305cf6bf1b9cf4dbe304beb7f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780622984", "to_ids": true, "type": "ssdeep", "uuid": "57f51802-a91c-487a-b370-ccb3fc8febce", "value": "393216:y1aOn2FmYS9pGKOJwC2jA5xlDvMud0dLqPkbrSOG2d6ytHlk5:AaOK2OGfEhP0JqHOG8q5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780622984", "to_ids": false, "type": "size-in-bytes", "uuid": "1ca88a70-6dcd-4d7b-bd40-1ff1e748e1d3", "value": "20740168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780622984", "to_ids": true, "type": "vhash", "uuid": "f5442ec7-9934-4bc0-9c8c-e889befbce96", "value": "027056555d55156098zad9z35z12z14ez1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780622984", "to_ids": true, "type": "filename", "uuid": "79671adc-6db6-40ba-9139-6f2d3f5c0a1e", "value": "Bodycam-C3-84-C2-B0ndir_907842.exe" }, { "category": "Other", "comment": "Checked: 05/06/2026\nLast-scan\t: 05/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780622984", "to_ids": false, "type": "text", "uuid": "b2b20de6-673a-415e-b29f-8575ed66bae9", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:17/71\nFirst Submission:2026-01-21T07:05:53.000000+00:00\nLast Submission:2026-04-14T16:01:42.000000+00:00" } ] } ] } }