{ "Event": { "analysis": "1", "date": "2026-07-22", "extends_uuid": "", "info": "[Threat Intel] Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT", "protected": false, "publish_timestamp": "1785647871", "published": true, "threat_level_id": "3", "timestamp": "1785647868", "uuid": "a93bb94c-0a45-4d79-9622-184bca1f0c8d", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#8f20d0", "local": false, "name": "misp-galaxy:producer=\"Huntress\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#705cef", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"", "relationship_type": "" }, { "colour": "#ed66f6", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#a9bb6d", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Password Stores - T1555\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#f95f85", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DNS Calculation - T1568.003\"", "relationship_type": "" }, { "colour": "#76434a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Link Target - T1608.005\"", "relationship_type": "" }, { "colour": "#a9f8b1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"", "relationship_type": "" }, { "colour": "#755c09", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Drive-by Compromise - T1189\"", "relationship_type": "" }, { "colour": "#3c0f50", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"SectopRAT\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Stealc\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Matryoshka\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" }, { "colour": "#18005c", "local": false, "name": "rectifyq:topic=\"ai\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784862050", "to_ids": false, "type": "link", "uuid": "222ec208-7a6e-4674-90ec-1280d65e7ead", "value": "https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1784862050", "to_ids": false, "type": "text", "uuid": "3817b0eb-f64c-4fe4-ad62-3efa6f04d83a", "value": "Between July 21-22, 2026, 29 organizations were compromised through a sophisticated malvertising campaign exploiting Claude AI's legitimate domain. Victims searching for Claude Desktop via Bing encountered sponsored advertisements leading to a malicious Claude Artifact hosted on the authentic Claude.ai domain. This artifact redirected users to attacker-controlled infrastructure distributing a fake ClaudeDesktop.exe file containing SectopRAT. The malware employed advanced anti-analysis techniques including VMProtect packing, GPU-based virtual machine detection, and DirectX shader-based payload decryption. Command-and-control infrastructure utilized EtherHiding, storing C2 addresses in Ethereum blockchain transactions for resilience against takedowns. The remote access trojan exfiltrated credit card data, credentials, browser information, and personal files. Analysis revealed connections to previous campaigns dating to December 2025, with infrastructure linked to Operation Endgame seizures and StealC distrib..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1784862050", "to_ids": false, "type": "text", "uuid": "d213e41d-abe1-4dd3-b340-480e5f08dc46", "value": "Name: Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT\nAuthor: AlienVault\nAdversary: \nTags: [\"claude ai\", \"sectoprat\", \"vmprotect\", \"stealc\", \"dll sideloading\", \"malvertising\", \"directx shader encryption\", \"gpu anti-vm\", \"ethereum blockchain\", \"etherhiding\"]\nTgtd countries: []\nMlwr families: [\"SectopRAT\", \"StealC\"]\nAttack_ids: [\"T1053.005\", \"T1539\", \"T1573.001\", \"T1497.001\", \"T1005\", \"T1140\", \"T1555\", \"T1036\", \"T1555.003\", \"T1552.001\", \"T1568.003\", \"T1608.005\", \"T1041\", \"T1059.001\", \"T1547.001\", \"T1189\", \"T1027.002\", \"T1071.001\", \"T1574.002\"]\nIndustries: []" }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS53667 frantech solutions", "deleted": false, "disable_correlation": false, "timestamp": "1785580633", "to_ids": true, "type": "ip-dst", "uuid": "2aa0ff05-0b37-46c7-8eff-49fd45f17ec7", "value": "104.194.133.210", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS53667 frantech solutions", "deleted": false, "disable_correlation": false, "timestamp": "1785580654", "to_ids": true, "type": "ip-dst", "uuid": "4b0730eb-9874-46cd-884b-63f14f3b0845", "value": "107.189.24.67", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS53667 frantech solutions", "deleted": false, "disable_correlation": false, "timestamp": "1785580675", "to_ids": true, "type": "ip-dst", "uuid": "8b3662ee-6865-4b0f-ae62-d779210beeaf", "value": "107.189.26.86", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS53667 frantech solutions", "deleted": false, "disable_correlation": false, "timestamp": "1785580696", "to_ids": true, "type": "ip-dst", "uuid": "20b71fa7-26c6-4cd2-887c-46abc9bd64cf", "value": "107.189.21.86", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46261 quickpacket llc", "deleted": false, "disable_correlation": false, "timestamp": "1785580718", "to_ids": true, "type": "ip-dst", "uuid": "48dce810-b8ae-42d8-9eb4-8e6dc9b90ffd", "value": "45.59.124.17", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS53667 frantech solutions", "deleted": false, "disable_correlation": false, "timestamp": "1785580740", "to_ids": true, "type": "ip-dst", "uuid": "90b0b6c7-ebad-4a96-98f1-c947a1914f7d", "value": "107.189.17.143", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46261 quickpacket llc", "deleted": false, "disable_correlation": false, "timestamp": "1785580761", "to_ids": true, "type": "ip-dst", "uuid": "46589d9e-ef88-4825-afa0-f9a732c5e9cd", "value": "45.59.125.228", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46261 quickpacket llc", "deleted": false, "disable_correlation": false, "timestamp": "1785580782", "to_ids": true, "type": "ip-dst", "uuid": "4b219fdd-1f14-4c71-b52c-884128b37257", "value": "45.59.122.134", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46261 quickpacket llc", "deleted": false, "disable_correlation": false, "timestamp": "1785580803", "to_ids": true, "type": "ip-dst", "uuid": "191140f0-495c-407c-b8b4-d195c6265f13", "value": "45.59.122.235", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS53667 frantech solutions", "deleted": false, "disable_correlation": false, "timestamp": "1785580824", "to_ids": true, "type": "ip-dst", "uuid": "c33940f3-435e-4400-8494-8761d5355998", "value": "107.189.22.118", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS53667 frantech solutions", "deleted": false, "disable_correlation": false, "timestamp": "1785580845", "to_ids": true, "type": "ip-dst", "uuid": "9a033636-e754-4a00-a761-37aa22b70d44", "value": "107.189.20.32", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS53667 frantech solutions", "deleted": false, "disable_correlation": false, "timestamp": "1785580866", "to_ids": true, "type": "ip-dst", "uuid": "56e2960f-eb43-47e3-97b4-f68555f62f03", "value": "107.189.20.95", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785580887", "to_ids": true, "type": "url", "uuid": "0b9f9a07-351f-4939-b554-950fe830ef3b", "value": "http://107.189.24.255", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46261 quickpacket llc", "deleted": false, "disable_correlation": false, "timestamp": "1785580908", "to_ids": true, "type": "ip-dst", "uuid": "f50ed5e2-3cb7-432c-9b37-5ce1f70f0010", "value": "45.59.117.145", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46261 quickpacket llc", "deleted": false, "disable_correlation": false, "timestamp": "1785580929", "to_ids": true, "type": "ip-dst", "uuid": "fb32d9b3-30b8-45fb-89aa-217a63113207", "value": "45.59.114.190", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46261 quickpacket llc", "deleted": false, "disable_correlation": false, "timestamp": "1785580950", "to_ids": true, "type": "ip-dst", "uuid": "d769a930-6337-4b21-aa91-112fa8a424bf", "value": "45.59.123.122", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=US ASN=AS46261 quickpacket llc", "deleted": false, "disable_correlation": false, "timestamp": "1785580971", "to_ids": true, "type": "ip-dst", "uuid": "ec8fb766-3a65-47c4-81b9-e1f05d7f82cb", "value": "45.59.117.67", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785580992", "to_ids": true, "type": "domain", "uuid": "674f5a24-6cb8-4340-a749-fcc3074768d8", "value": "download-app.us", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=AE ASN=AS61317 digital energy technologies ltd.", "deleted": false, "disable_correlation": false, "timestamp": "1785581013", "to_ids": true, "type": "ip-dst", "uuid": "5f138e98-da7f-41c8-8c92-e4ab0dad5881", "value": "191.101.80.211", "Tag": [ { "colour": "#6e3d21", "local": false, "name": "asn:asn=\"47583\"", "relationship_type": "" }, { "colour": "#ec60bc", "local": false, "name": "asn:as-owner=\"AS-HOSTINGER\"", "relationship_type": "" }, { "colour": "#0f6daf", "local": false, "name": "asn:as-country=\"CY\"", "relationship_type": "" }, { "colour": "#d60f3f", "local": false, "name": "misp-galaxy:country=\"cyprus\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=GB ASN=AS12576 ee limited", "deleted": false, "disable_correlation": false, "timestamp": "1785581035", "to_ids": true, "type": "ip-dst", "uuid": "314aeee8-bf38-42c1-be97-cb053f4a3dae", "value": "2.24.131.246", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "tempdir.dll No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578925", "to_ids": true, "type": "sha256", "uuid": "bae77dfe-4731-4f7a-8e39-882f27af83e7", "value": "1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "Embedded SectopRAT Payload No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578926", "to_ids": true, "type": "sha256", "uuid": "29fb3073-8b8f-4b51-92a9-c99643b33faf", "value": "1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "libcef.dll No sample in VT\r\nLast check: 01/08/2026", "deleted": false, "disable_correlation": false, "timestamp": "1785578927", "to_ids": true, "type": "sha256", "uuid": "d6461404-c1c8-483c-b38a-bae6e3250cbb", "value": "26bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Backup SectopRAT Domain", "deleted": false, "disable_correlation": false, "timestamp": "1785581056", "to_ids": true, "type": "domain", "uuid": "4e0a1329-73d8-4cb8-ad8e-4851022ee2f6", "value": "5ca8758c-02d0-4a72-89c8-d468b66dda41.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1785581077", "to_ids": true, "type": "hostname", "uuid": "af82823f-d4da-4b94-b64e-76ac1bea17d9", "value": "claude.ai.download-app.us", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=GB ASN=AS47583 hostinger international limited", "deleted": false, "disable_correlation": false, "timestamp": "1785581098", "to_ids": true, "type": "ip-dst", "uuid": "f3592235-8ef4-43c0-ade5-2582d637582f", "value": "195.110.58.222", "Tag": [ { "colour": "#6e3d21", "local": false, "name": "asn:asn=\"47583\"", "relationship_type": "" }, { "colour": "#ec60bc", "local": false, "name": "asn:as-owner=\"AS-HOSTINGER\"", "relationship_type": "" }, { "colour": "#0f6daf", "local": false, "name": "asn:as-country=\"CY\"", "relationship_type": "" }, { "colour": "#d60f3f", "local": false, "name": "misp-galaxy:country=\"cyprus\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Extracted C2 Address", "deleted": false, "disable_correlation": false, "timestamp": "1785581119", "to_ids": true, "type": "ip-dst", "uuid": "5cd68329-165b-4fd4-8001-8de6a5558834", "value": "45.59.122.82", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Extracted C2 Address", "deleted": false, "disable_correlation": false, "timestamp": "1785581140", "to_ids": true, "type": "ip-dst", "uuid": "70bbac64-3dd7-4cd6-80cf-bf0e32c2b45d", "value": "107.189.24.255", "Tag": [ { "colour": "#652a80", "local": false, "name": "asn:asn=\"14956\"", "relationship_type": "" }, { "colour": "#9f7512", "local": false, "name": "asn:as-owner=\"ROUTERHOSTING\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "\"....]us (registered May 9, 2026) and subsequently to downloading-api.it[.]com/html/claude/win. At this point, the user is ser...\"", "deleted": false, "disable_correlation": false, "timestamp": "1785581161", "to_ids": true, "type": "domain", "uuid": "0801f3bb-6add-4012-b238-3a810657198b", "value": "downloading-api.it.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "hosting StealC stealer malware", "deleted": false, "disable_correlation": false, "timestamp": "1785581182", "to_ids": true, "type": "domain", "uuid": "66b74146-448f-40c6-b701-e3034d53c523", "value": "polse.us", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581203", "uuid": "5d80a379-a764-4be5-88e5-87f19a4cfac5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "md5", "timestamp": "1785581203", "to_ids": true, "type": "md5", "uuid": "ce160f04-bb38-4808-a2b7-b19778c1dce6", "value": "04dcc1abb68aae9d3ae4901cc140dbb8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "sha1", "timestamp": "1785578923", "to_ids": true, "type": "sha1", "uuid": "a4b8af66-b7c8-4b91-b223-3f6668864c91", "value": "da7a5028b9694c406a881eb85e5acd8ea375a890", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "sha256", "timestamp": "1785578923", "to_ids": true, "type": "sha256", "uuid": "ab0fe222-1bd5-43c8-84f2-bd8de7606842", "value": "f8acb8f5cf88b77a4c27d7fd6856aa299bb178e85f9963c2fbd447d818da3ed0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 31/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "text", "timestamp": "1785577845", "to_ids": false, "type": "text", "uuid": "d8436410-f662-4a19-9272-4c000c96a8db", "value": "Type Description: Win32 EXE\nOriginal name: jcef_helper.exe\nVerified: Signed\nSigning date: 06:20 AM 05/23/2026\nSigners: JetBrains s.r.o.; DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/75\nFirst Submission: 2026-05-25T22:21:47+00:00\nLast Submission: 2026-07-26T22:24:41+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "creation-time", "timestamp": "1785577845", "to_ids": false, "type": "datetime", "uuid": "eaa444b3-12dd-4f12-967f-82256dc6d749", "value": "2026-05-23T01:35:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "ssdeep", "timestamp": "1785577845", "to_ids": true, "type": "ssdeep", "uuid": "bda378ea-15a0-496e-a674-dbea0504492d", "value": "6144:ZtujmJhRyJSNW/B/Fwzng9nOmSxR9WZONu94aipJVRymCHePpL:rem7pi/Fi8nox+ZONudIVw3Up" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577845", "to_ids": false, "type": "size-in-bytes", "uuid": "bc1b33bf-bcbd-44ba-b22d-8517aff4358a", "value": "778096" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "vhash", "timestamp": "1785577845", "to_ids": true, "type": "vhash", "uuid": "131ac7ea-de87-489d-ad95-16c2635cebb1", "value": "075066655d1555555az6!z1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-25T22:21:47+00:00", "last_seen": "2026-07-26T22:24:41+00:00", "object_relation": "filename", "timestamp": "1785577845", "to_ids": true, "type": "filename", "uuid": "64ad8103-a9e5-4b03-b2d3-6640b7af1aac", "value": "jcef_helper.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1785581224", "uuid": "5f02dd3e-d7f9-474a-af9d-b5e9a0f806b3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "md5", "timestamp": "1785581224", "to_ids": true, "type": "md5", "uuid": "75c4bb89-97ee-4db0-958a-66e7602eb935", "value": "71fdd6fb7f0acd3e9a6206851452e11b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "sha1", "timestamp": "1785578924", "to_ids": true, "type": "sha1", "uuid": "7823daed-ed6d-43d1-bf5d-912c062b7cd5", "value": "82011a9ff3692236df69427eb200ba05799205b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "sha256", "timestamp": "1785578924", "to_ids": true, "type": "sha256", "uuid": "fca2b9c6-3c95-4a7f-b8b0-49eb9565ff93", "value": "fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 01/08/2026\nLast-scan: 30/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "text", "timestamp": "1785577866", "to_ids": false, "type": "text", "uuid": "c0dfc891-163e-48c2-9f48-bd7c18210430", "value": "Type Description: Win32 EXE\nVerified: Signed\nSigning date: 01:07 AM 04/18/2026\nSigners: International Business Machines Corporation; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Seen In The Wild: 2026-06-17T08:23:59+00:00\nFirst Submission: 2026-04-26T13:40:38+00:00\nLast Submission: 2026-07-30T00:29:30+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "creation-time", "timestamp": "1785577867", "to_ids": false, "type": "datetime", "uuid": "894d33b3-a09e-481f-b718-b13f703e4d29", "value": "2026-04-17T22:07:54+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "ssdeep", "timestamp": "1785577866", "to_ids": true, "type": "ssdeep", "uuid": "77851bbe-c05d-44bf-8c69-659124830a38", "value": "384:51FiQ200ruE3ae6GIlp3HQIYiB53y1ny8RbmL4nNytn:piPuE3aplB5Yi05AL3" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1785577866", "to_ids": false, "type": "size-in-bytes", "uuid": "8546faf3-5ae5-45e8-9d36-9303b2dbbd9d", "value": "30016" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "vhash", "timestamp": "1785577866", "to_ids": true, "type": "vhash", "uuid": "26cf6864-f302-4dd5-a244-c48c50aae369", "value": "034066551d1515151az16nz6fz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-26T13:40:38+00:00", "last_seen": "2026-07-30T00:29:30+00:00", "object_relation": "filename", "timestamp": "1785577866", "to_ids": true, "type": "filename", "uuid": "f0457f51-8d53-4bd3-9279-d84eca36eaf5", "value": "cl.exe" } ] } ] } }