{ "Event": { "analysis": "1", "date": "2026-07-01", "extends_uuid": "", "info": "[Threat Intel] Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula", "protected": false, "publish_timestamp": "1784200118", "published": true, "threat_level_id": "3", "timestamp": "1784200118", "uuid": "af021fb7-b44f-4dde-996c-3f28316eef11", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#7223eb", "local": false, "name": "misp-galaxy:producer=\"Fortinet\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#8ee8d8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#47d9d3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious File - T1204.002\"", "relationship_type": "" }, { "colour": "#56c932", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Symmetric Cryptography - T1573.001\"", "relationship_type": "" }, { "colour": "#2c1d2e", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Checks - T1497.001\"", "relationship_type": "" }, { "colour": "#c202a1", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"", "relationship_type": "" }, { "colour": "#5539fe", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Attachment - T1566.001\"", "relationship_type": "" }, { "colour": "#9dc839", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Clipboard Data - T1115\"", "relationship_type": "" }, { "colour": "#7eb739", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Msiexec - T1218.007\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#f4b62b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Time Based Checks - T1497.003\"", "relationship_type": "" }, { "colour": "#62e1b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#b76d96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"", "relationship_type": "" }, { "colour": "#c84641", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"GUI Input Capture - T1056.002\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#30cc3b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#98f3da", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Visual Basic - T1059.005\"", "relationship_type": "" }, { "colour": "#5884a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Malicious Link - T1204.001\"", "relationship_type": "" }, { "colour": "#c70b8f", "local": false, "name": "misp-galaxy:target-information=\"Portugal\"", "relationship_type": "" }, { "colour": "#f439e5", "local": false, "name": "misp-galaxy:target-information=\"Spain\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:sector=\"Bank\"", "relationship_type": "" }, { "colour": "#c94db5", "local": false, "name": "misp-galaxy:target-information=\"Brazil\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Ousaban\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782990028", "to_ids": false, "type": "link", "uuid": "350de000-e833-44f5-8a3c-cf02e2c5f97c", "value": "https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1782990028", "to_ids": false, "type": "text", "uuid": "8ac9f214-3c0a-4a5c-be99-750455b04321", "value": "In May 2026, an attack campaign targeting banking users in Spain and Portugal was identified involving the Ousaban banking Trojan. The malware, previously active in Brazil, spreads through phishing PDFs that redirect victims to malicious webpages performing environment checks to ensure targets are located in Spain or Portugal. The attack chain involves VBS scripts downloading steganographic images containing the payload, which is then dropped and executed on victims' systems. Ousaban establishes persistence, monitors banking activity across multiple financial institutions, and uses daily-changing DDNS domains to resolve C2 server addresses. The malware employs screenshot capture, keylogging, clipboard injection, and remote control capabilities to steal banking credentials. It utilizes custom encryption algorithms and geofencing techniques to evade detection and limit exposure to intended targets." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1782990028", "to_ids": false, "type": "text", "uuid": "9305d8b5-bf9e-482f-86f2-356740885aca", "value": "Name: Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula\nAuthor: AlienVault\nAdversary: \nTags: [\"credential theft\", \"phishing\", \"portugal\", \"iberian peninsula\", \"ousaban\", \"geofencing\", \"casbaneiro\", \"spain\", \"banking trojan\"]\nTgtd countries: [\"Portugal\", \"Spain\"]\nMlwr families: [\"Ousaban\", \"Metamorfo - S0455\", \"Casbaneiro\"]\nAttack_ids: [\"T1113\", \"T1056.001\", \"T1204.002\", \"T1573.001\", \"T1497.001\", \"T1566.002\", \"T1566.001\", \"T1115\", \"T1218.007\", \"T1140\", \"T1497.003\", \"T1185\", \"T1112\", \"T1547.001\", \"T1056.002\", \"T1027\", \"T1070.004\", \"T1071.001\", \"T1059.005\", \"T1204.001\"]\nIndustries: [\"Finance\"]" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154224", "to_ids": true, "type": "ip-dst", "uuid": "fd1b2092-4ecc-454f-ade8-5869e344763c", "value": "162.33.179.46", "Tag": [ { "colour": "#5beb6d", "local": false, "name": "asn:asn=\"399629\"", "relationship_type": "" }, { "colour": "#6967e5", "local": false, "name": "asn:as-owner=\"BLNWX\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154245", "to_ids": true, "type": "ip-dst", "uuid": "e0763428-f971-4387-809b-cd3076d26b0d", "value": "91.92.240.140", "Tag": [ { "colour": "#ce048f", "local": false, "name": "asn:asn=\"209800\"", "relationship_type": "" }, { "colour": "#434f78", "local": false, "name": "asn:as-owner=\"METASPINNER-ASN\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154266", "to_ids": true, "type": "ip-dst", "uuid": "c9f18fd5-1b06-4c34-b9c2-12ac23bec455", "value": "78.40.209.32", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 16/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784154150", "to_ids": true, "type": "sha256", "uuid": "04bce042-d52d-4c3f-8d67-ff4bff3393e0", "value": "19ac18a50abb48dc0ea9524850acfaec49359e6b3bcc67c6193c2d56da812c71", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 16/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784154151", "to_ids": true, "type": "sha256", "uuid": "b5377143-0144-4ab0-a1e1-88be7389dace", "value": "65c1a998bac48e02b52b1c850cd500e9fb87521e21755c3a4a491243f5f9a700", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154288", "to_ids": true, "type": "ip-dst", "uuid": "62b15645-a145-46f4-9066-b8fbadfb46e7", "value": "213.159.64.191", "Tag": [ { "colour": "#9fc6d7", "local": false, "name": "asn:asn=\"209847\"", "relationship_type": "" }, { "colour": "#5b76e7", "local": false, "name": "asn:as-owner=\"THE\"", "relationship_type": "" }, { "colour": "#3ae32e", "local": false, "name": "asn:as-country=\"NL\"", "relationship_type": "" }, { "colour": "#768323", "local": false, "name": "misp-galaxy:country=\"netherlands\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154309", "to_ids": true, "type": "domain", "uuid": "704c4045-c42e-4f2f-9e13-d05b8842273e", "value": "controlfacturas.site", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154330", "to_ids": true, "type": "domain", "uuid": "ffc8d3cf-f64f-4d40-9f6d-b2dbb41c4947", "value": "faturanova.xyz", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154351", "to_ids": true, "type": "hostname", "uuid": "679ea7b2-8b8c-4196-8e10-a9cd85a9e583", "value": "facture-arsys.duckdns.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154373", "to_ids": true, "type": "hostname", "uuid": "dbecee55-ad13-43e0-97b6-dc2426238cf6", "value": "faturanova.duckdns.org", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784154394", "to_ids": true, "type": "hostname", "uuid": "33edb561-e8e8-44e7-b1ef-cee63ff89209", "value": "facture-in.pages.dev", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154416", "uuid": "2c3d4f3c-8199-421a-b6bd-f79937d58305", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "md5", "timestamp": "1784154416", "to_ids": true, "type": "md5", "uuid": "21c98e28-c04e-420b-92a1-2a2ac0c31f57", "value": "26c0aee6c79935ee6da46e6444f1c109", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "sha1", "timestamp": "1784154127", "to_ids": true, "type": "sha1", "uuid": "23b23593-7486-4dec-be7f-ad9d96d7d59b", "value": "26b9b123e0f664dd9792b820255fe991496cf2d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "sha256", "timestamp": "1784154127", "to_ids": true, "type": "sha256", "uuid": "4df22545-a9cb-4e5f-8a8d-b14b3cebe755", "value": "d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "text", "timestamp": "1784153051", "to_ids": false, "type": "text", "uuid": "2c3aa453-59dd-4655-88f6-2e2bfcf77c0b", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: TrojanDownloader:Win32/Malgent!MSR\nClamAV: None\nVT Total Detection: 36/74\nFirst Submission: 2025-12-15T15:42:26+00:00\nLast Submission: 2025-12-23T04:38:13+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "creation-time", "timestamp": "1784153051", "to_ids": false, "type": "datetime", "uuid": "42f71473-3054-46fe-ac8e-52daf8a96a29", "value": "2025-12-15T02:25:32+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "ssdeep", "timestamp": "1784153050", "to_ids": true, "type": "ssdeep", "uuid": "e620f34c-248e-4bc2-a410-58a643f6e5cf", "value": "49152:o2+a9ZTGUJRqMwLVMMWZ3i5O7TEeiLjU/9ax/:GuqjeoU/9aV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153050", "to_ids": false, "type": "size-in-bytes", "uuid": "b209c11b-3abd-4b92-8540-a44c7eab00f8", "value": "1773568" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "vhash", "timestamp": "1784153050", "to_ids": true, "type": "vhash", "uuid": "b05d28bc-58c8-436f-9690-c90db294a4af", "value": "4333ab3d7dd4fcc3736dd7c53f2f874f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:42:26+00:00", "last_seen": "2025-12-23T04:38:13+00:00", "object_relation": "filename", "timestamp": "1784153050", "to_ids": true, "type": "filename", "uuid": "a7f02370-472e-4fb8-ae9f-0b2471d69383", "value": "d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154437", "uuid": "0c3dafc3-0a95-4e6d-934b-65e09ad7b3da", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "md5", "timestamp": "1784154437", "to_ids": true, "type": "md5", "uuid": "e0ad0bc9-d179-4ba0-8420-7fc991a26b80", "value": "18205d398e5df7d38705dbdc700ccb46", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "sha1", "timestamp": "1784154128", "to_ids": true, "type": "sha1", "uuid": "e4caf850-0765-47ff-b31a-a2798b891ebb", "value": "6e37b4a0c1d747d19abb6736a1ec3293972d3e0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "sha256", "timestamp": "1784154128", "to_ids": true, "type": "sha256", "uuid": "276f5051-5b1b-463f-bb64-28780912bc19", "value": "ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "text", "timestamp": "1784153072", "to_ids": false, "type": "text", "uuid": "6f4d904b-e91e-4ecf-9518-40b28a89d202", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ousaban.GVE!MTB\nClamAV: None\nVT Total Detection: 30/74\nFirst Submission: 2026-05-20T11:54:31+00:00\nLast Submission: 2026-05-20T11:54:31+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "creation-time", "timestamp": "1784153072", "to_ids": false, "type": "datetime", "uuid": "15eb67b9-48d5-424b-ae8e-27aac0b8a325", "value": "2026-04-29T10:39:10+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "ssdeep", "timestamp": "1784153072", "to_ids": true, "type": "ssdeep", "uuid": "1f416a0f-54da-4211-9bc3-978865c2c3e8", "value": "786432:NAWNRtZGfL/QcVRPn4ywTPsVJzr6xyPI/:NRHGfL/5n4ymP6r6" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153072", "to_ids": false, "type": "size-in-bytes", "uuid": "7fe08a4a-dcd6-4733-861d-bd84fdc6c023", "value": "50127872" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "vhash", "timestamp": "1784153072", "to_ids": true, "type": "vhash", "uuid": "894c47d6-4ffb-4e4e-bf50-900e0f811155", "value": "0570b6666d5c0d5d151c014262za5009216zf145zd0100f70301018z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T11:54:31+00:00", "last_seen": "2026-05-20T11:54:31+00:00", "object_relation": "filename", "timestamp": "1784153072", "to_ids": true, "type": "filename", "uuid": "155438c5-5534-44e5-90fa-e294e610eedb", "value": "SysMain.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154458", "uuid": "98652528-4e0d-4026-90b0-c1b381a84957", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "md5", "timestamp": "1784154458", "to_ids": true, "type": "md5", "uuid": "d6a22819-972e-4f12-9b10-dcb6eb25a3a4", "value": "22e3cd043e36a9c0bad1479ad4c3214a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "sha1", "timestamp": "1784154130", "to_ids": true, "type": "sha1", "uuid": "685b3115-b243-4bd6-adba-6b0a1430bb2d", "value": "11ca4e19ea79f68aaf23c4afe472dbc03833002c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "sha256", "timestamp": "1784154130", "to_ids": true, "type": "sha256", "uuid": "488273ec-07f7-4d65-885d-ca5f9a5cec06", "value": "4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "text", "timestamp": "1784153093", "to_ids": false, "type": "text", "uuid": "e7247f05-63d4-445f-aa2f-bf1172bd94a4", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ousaban.GVE!MTB\nClamAV: None\nVT Total Detection: 33/74\nFirst Submission: 2025-04-03T17:52:38+00:00\nLast Submission: 2025-04-16T10:48:29+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "creation-time", "timestamp": "1784153094", "to_ids": false, "type": "datetime", "uuid": "ad3ee53f-5576-4dbd-9d6d-befa80461498", "value": "2025-03-26T16:47:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "ssdeep", "timestamp": "1784153093", "to_ids": true, "type": "ssdeep", "uuid": "35151197-9121-4b9a-86c3-f86c7f8c527b", "value": "393216:h5lvEOd66FjsJk1sG+iL/QcVR0Pae7Uvn4ywqA5PsVfWuxdRND5dHUEW:z8/IsbiL/QcVRPn4ywTPsVJz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153093", "to_ids": false, "type": "size-in-bytes", "uuid": "7adb368a-89ed-4e3e-9f01-9ede20fa85de", "value": "53153792" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "vhash", "timestamp": "1784153093", "to_ids": true, "type": "vhash", "uuid": "47e54c55-d8a6-446f-a96b-7eb097715abd", "value": "0570b6666d5c0d5d551c022260400a2009515z16145zd0100f90301az2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-03T17:52:38+00:00", "last_seen": "2025-04-16T10:48:29+00:00", "object_relation": "filename", "timestamp": "1784153093", "to_ids": true, "type": "filename", "uuid": "b3d92c9b-d627-4904-a800-316b9a84c0bc", "value": "WinLSP.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154479", "uuid": "ade3c5c3-f4bf-48f0-83fb-042e76f72332", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "md5", "timestamp": "1784154479", "to_ids": true, "type": "md5", "uuid": "9a80bec2-ac5f-4f18-b46c-226502450c76", "value": "ebb680f7ae4db6cdc426b8112d2536b6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "sha1", "timestamp": "1784154131", "to_ids": true, "type": "sha1", "uuid": "41c8df13-9665-4623-a7e9-e928115882db", "value": "1ec576cf0c82c023f2eb380809588980b98cd296", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "sha256", "timestamp": "1784154131", "to_ids": true, "type": "sha256", "uuid": "8983c556-ab0e-4707-bc58-f659c10893e8", "value": "18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "text", "timestamp": "1784153116", "to_ids": false, "type": "text", "uuid": "4a089caf-3dfc-4499-bd47-bfb5a8d96d66", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ousaban.GVE!MTB\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2025-12-11T02:34:58+00:00\nLast Submission: 2025-12-11T02:34:58+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "creation-time", "timestamp": "1784153116", "to_ids": false, "type": "datetime", "uuid": "3d83cebe-ac8c-4b57-848d-2a0f91d8cbb3", "value": "2025-12-11T02:10:17+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "ssdeep", "timestamp": "1784153116", "to_ids": true, "type": "ssdeep", "uuid": "432fca98-81b8-4048-90f6-dc7220301aba", "value": "393216:j7s6ybsJDN+hUT4eXL/Q6QkvLf0Pae7Uvn4ywq45P36A1w31d7YEWd:mkd4eXL/Q6QkvLfPn4ywrPWF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153116", "to_ids": false, "type": "size-in-bytes", "uuid": "05392ac3-339e-4bbc-9229-a59a8c2444e5", "value": "59746816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "vhash", "timestamp": "1784153116", "to_ids": true, "type": "vhash", "uuid": "c9ebb62f-3368-409c-8e18-b6c92c5d4b82", "value": "0570b6666d5c0d5d151c014260200a6009316zf145za2zfa0301018z2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-11T02:34:58+00:00", "last_seen": "2025-12-11T02:34:58+00:00", "object_relation": "filename", "timestamp": "1784153116", "to_ids": true, "type": "filename", "uuid": "bf8859e3-f267-42d0-96b1-1429d83efc49", "value": "winlsp.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154500", "uuid": "554ccc9d-be25-444a-b4b9-c0b86fbc5c29", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "object_relation": "md5", "timestamp": "1784154500", "to_ids": true, "type": "md5", "uuid": "110fda81-34c4-40b5-b672-7eb3b5048e27", "value": "7896359d730b065543ff0aa0120f9b11", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "object_relation": "sha1", "timestamp": "1784154132", "to_ids": true, "type": "sha1", "uuid": "e895283e-f0bf-4963-babd-fe1aef936ba2", "value": "e8725fdee5edd8249c3c72d282e60ae4c7e0556a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "object_relation": "sha256", "timestamp": "1784154132", "to_ids": true, "type": "sha256", "uuid": "92605eb4-1281-4cc6-a113-bc5a5d1a5fc0", "value": "1e77992666acbbfa0d01fcefa9cc8fbdac291e0681b35745be27c6dfb159a375", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "object_relation": "text", "timestamp": "1784153158", "to_ids": false, "type": "text", "uuid": "3d92effe-c979-4d33-b4bd-5057e5d2b74c", "value": "Type Description: HTML\nMicrosoft: Trojan:Win32/ClickFix.HAU!MTB\nClamAV: None\nVT Total Detection: 22/74\nFirst Submission: 2025-12-15T12:58:30+00:00\nLast Submission: 2025-12-15T12:58:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "object_relation": "ssdeep", "timestamp": "1784153158", "to_ids": true, "type": "ssdeep", "uuid": "78a58b5e-599d-4bac-8ae7-175497b9498c", "value": "96:I81Y8BbOUq61ru3h091PoUwSPZHmj6nzvqHv7A:XsUqAra091wJIGk8v7A" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153158", "to_ids": false, "type": "size-in-bytes", "uuid": "bdf97c56-b674-4dfb-83f4-95438992a3e3", "value": "5186" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "object_relation": "vhash", "timestamp": "1784153158", "to_ids": true, "type": "vhash", "uuid": "2675a2e8-418e-4a08-b00a-ccb7ff0b7400", "value": "21a5e57b48a8fc6fa12d1bcc4996b20b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T12:58:30+00:00", "last_seen": "2025-12-15T12:58:30+00:00", "object_relation": "filename", "timestamp": "1784153158", "to_ids": true, "type": "filename", "uuid": "dd512a63-cd24-49cb-9049-e2363a0ada7f", "value": "index.html" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154521", "uuid": "22a1b21d-1c19-4688-b7f3-9d0519c0d9f5", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "md5", "timestamp": "1784154521", "to_ids": true, "type": "md5", "uuid": "60e475cd-cf91-4089-9afc-dbf7b2da9ba3", "value": "423f21e2f2cda5a953003edfb35697ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "sha1", "timestamp": "1784154134", "to_ids": true, "type": "sha1", "uuid": "28d4384c-481f-461b-9f53-3c9177e0ae22", "value": "a05dc541699a34b1136f5bffb9f245947da3151b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "sha256", "timestamp": "1784154134", "to_ids": true, "type": "sha256", "uuid": "da1f4efd-4b09-4d83-92c9-21ffbcc8724a", "value": "21b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "text", "timestamp": "1784153180", "to_ids": false, "type": "text", "uuid": "8f454e60-aa62-4c01-8204-4e24a5973a70", "value": "Type Descriptio%WINDIR%\\Installer\nMicrosoft: None\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2025-12-15T15:01:33+00:00\nLast Submission: 2025-12-15T15:01:33+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "creation-time", "timestamp": "1784153180", "to_ids": false, "type": "datetime", "uuid": "9a1b280e-27ca-4909-8767-f41148f1f56d", "value": "2025-12-15T13:58:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "ssdeep", "timestamp": "1784153180", "to_ids": true, "type": "ssdeep", "uuid": "978d401d-d583-47ea-be05-7ef430bf3600", "value": "49152:B2+a9ZTGUJRqMwLVMMWZ3i5O7TEeiLjU/9ax/:LuqjeoU/9aV" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153180", "to_ids": false, "type": "size-in-bytes", "uuid": "e78f4e59-8e3f-41d3-b5ca-5c0627aa84b3", "value": "1773568" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "vhash", "timestamp": "1784153180", "to_ids": true, "type": "vhash", "uuid": "2b87c40b-fb69-4da3-b5b9-75c16f089585", "value": "4333ab3d7dd4fcc3736dd7c53f2f874f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:01:33+00:00", "last_seen": "2025-12-15T15:01:33+00:00", "object_relation": "filename", "timestamp": "1784153180", "to_ids": true, "type": "filename", "uuid": "85656712-aaa3-4a44-9bc5-4e003049dfff", "value": "fac66889e.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154543", "uuid": "92aa46ba-95b3-4409-bf67-31430f20782a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "object_relation": "md5", "timestamp": "1784154543", "to_ids": true, "type": "md5", "uuid": "5e228f8b-e77f-4b2e-add5-1020502e8885", "value": "f51e8c279b4305a6490fd4549f62aa59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "object_relation": "sha1", "timestamp": "1784154135", "to_ids": true, "type": "sha1", "uuid": "22958e1f-111b-4f65-b6b8-73289f92e2a9", "value": "6f7ea584808460dc91ebb322f7bd80ec5b121e59", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "object_relation": "sha256", "timestamp": "1784154135", "to_ids": true, "type": "sha256", "uuid": "720a887c-f89b-464e-ac37-7f3d168c2288", "value": "48723a33bab89f174750576f9a62da35b3b9e5ac31a5a8f1ce9859a1b35bf8b8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "object_relation": "text", "timestamp": "1784153201", "to_ids": false, "type": "text", "uuid": "8378d0b5-e8da-46e7-b095-ec8184d4dd7b", "value": "Type Description: VBA\nMicrosoft: Trojan:BAT/Runner.GPTV!MTB\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2025-12-15T15:40:46+00:00\nLast Submission: 2025-12-15T15:40:46+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "object_relation": "ssdeep", "timestamp": "1784153201", "to_ids": true, "type": "ssdeep", "uuid": "e0d80133-ad2a-4ed1-923f-00524cdfdbe4", "value": "12:mSK1HL2hjQH8YWOXPMHGCoZMb/UXNC5b/IAD:N3ecYP0EW/R1/x" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153201", "to_ids": false, "type": "size-in-bytes", "uuid": "69b95bc4-b01c-40f2-9665-d52465051abc", "value": "394" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "object_relation": "vhash", "timestamp": "1784153201", "to_ids": true, "type": "vhash", "uuid": "1635ecc2-ef73-4b96-9d31-1a4dd188407f", "value": "da4bb67457c5e245ed29f343e0b23b8a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T15:40:46+00:00", "last_seen": "2025-12-15T15:40:46+00:00", "object_relation": "filename", "timestamp": "1784153201", "to_ids": true, "type": "filename", "uuid": "8576c861-eb88-4560-a1a8-2c6ef37232a4", "value": "ff.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154564", "uuid": "2c9cd194-fed6-4625-a391-885325fe90b8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "md5", "timestamp": "1784154564", "to_ids": true, "type": "md5", "uuid": "fad6fc61-a4e0-43d5-b814-2f669076f148", "value": "09715f6fef8948c0646fc15afde1ad4f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "sha1", "timestamp": "1784154136", "to_ids": true, "type": "sha1", "uuid": "1eb3198f-f177-488e-8b10-6514ffe0f561", "value": "0796f53ac8d0191621b05bf511fd1fdd6da0c903", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "sha256", "timestamp": "1784154136", "to_ids": true, "type": "sha256", "uuid": "2844c300-3779-4581-bb36-9fcbd4468d88", "value": "4c9fdc2823da505ef339d43c6ad38499b7e3447736733e42b5ab6b1afcfd42aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "text", "timestamp": "1784153222", "to_ids": false, "type": "text", "uuid": "be44488a-6375-40aa-8d73-fc437657e8c8", "value": "Type Description: PDF\nMicrosoft: Trojan:PDF/Ousaban.GVA!MTB\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2025-12-09T07:25:59+00:00\nLast Submission: 2026-07-15T09:28:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "creation-time", "timestamp": "1784153222", "to_ids": false, "type": "datetime", "uuid": "0d13fdbb-e34e-4ef9-b84c-d396392bdf9b", "value": "2025-12-08T17:14:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "ssdeep", "timestamp": "1784153222", "to_ids": true, "type": "ssdeep", "uuid": "d3c71c28-2ae1-4623-9516-a4733ff19085", "value": "6144:Uza0OpMIJI57R3E7d116HpCZNsrg4RAV2vmVo:2xO+W7Do8Ns04RAV2vmVo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153222", "to_ids": false, "type": "size-in-bytes", "uuid": "d3b46893-37aa-496f-ae5a-978b0c08f203", "value": "221136" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "vhash", "timestamp": "1784153222", "to_ids": true, "type": "vhash", "uuid": "ccbcb9a2-c1c5-4bd5-82f5-ec547caff919", "value": "9ac351fdf865a7cd59b1485e6ba89b1b5" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T07:25:59+00:00", "last_seen": "2026-07-15T09:28:28+00:00", "object_relation": "filename", "timestamp": "1784153222", "to_ids": true, "type": "filename", "uuid": "65408a12-5d63-4003-81f8-b4ca6dd7381f", "value": "199229.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154585", "uuid": "830ec59e-4062-4c0a-90e5-bb3ead1c8425", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "md5", "timestamp": "1784154585", "to_ids": true, "type": "md5", "uuid": "eadfcfb9-9f7b-460c-89dd-6eaf009ae9ad", "value": "4fc3f2124ed00b1167929a2c0b01d8aa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "sha1", "timestamp": "1784154138", "to_ids": true, "type": "sha1", "uuid": "1bc4c66c-e401-46b8-8862-f36df450a6b0", "value": "8387318bfe303cd208ff20eaf4f5f1ff485c6d4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "sha256", "timestamp": "1784154138", "to_ids": true, "type": "sha256", "uuid": "8e26e38a-e237-4b1e-a63f-d5c79681a1fd", "value": "540ee1936e61d2344b5ebc93485589a351ec2f113a9b4940ae16f3baa4807392", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "text", "timestamp": "1784153244", "to_ids": false, "type": "text", "uuid": "eeb2c40a-d9a7-4657-afcd-3e2a6c7e58d1", "value": "Type Description: PDF\nMicrosoft: Trojan:Win32/Vigorf.A\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-05-19T08:12:22+00:00\nLast Submission: 2026-05-19T15:00:15+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "creation-time", "timestamp": "1784153244", "to_ids": false, "type": "datetime", "uuid": "47e6192a-aa32-47a5-9c35-954a01a7b2f3", "value": "2026-05-18T22:39:39+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "ssdeep", "timestamp": "1784153244", "to_ids": true, "type": "ssdeep", "uuid": "5d29f63e-92ba-4234-b678-0a7735cda796", "value": "48:Fh4zoKPDFb3vUb+HXklbC2AmHKGJiRkmIM6wUtj:FOcKRb3bkrAgJakm0wA" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153244", "to_ids": false, "type": "size-in-bytes", "uuid": "e3953832-00b4-478a-ae38-4d83622bb26c", "value": "1841" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "vhash", "timestamp": "1784153244", "to_ids": true, "type": "vhash", "uuid": "b0e0ab09-36cc-4c9f-a6af-53c9951682f4", "value": "95e5aa64d46eef154e3ec446822ea5f6b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-19T08:12:22+00:00", "last_seen": "2026-05-19T15:00:15+00:00", "object_relation": "filename", "timestamp": "1784153244", "to_ids": true, "type": "filename", "uuid": "ef512e1c-6e71-408a-8e12-a450e0f1ea06", "value": "PT3456SC6ES68EE.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154607", "uuid": "f3e69ddc-0a15-44a4-b221-c065d6f8aeed", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "md5", "timestamp": "1784154607", "to_ids": true, "type": "md5", "uuid": "80c67801-c75b-42c5-8ba0-38b5b1b49824", "value": "5e429dfee187a76401dc6eb72ff7afe3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "sha1", "timestamp": "1784154139", "to_ids": true, "type": "sha1", "uuid": "b93f9bea-12ff-4e16-b333-2d6d19fc2a37", "value": "4e67208d9cf79bd56366f843dd6ee577a6b90db4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "sha256", "timestamp": "1784154139", "to_ids": true, "type": "sha256", "uuid": "f847e99a-8b40-4f79-b857-8ece7a56cb0d", "value": "5837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "text", "timestamp": "1784153265", "to_ids": false, "type": "text", "uuid": "043e32a5-37d6-47c0-9f06-d909adb07f4c", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ousaban.GVE!MTB\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2025-12-09T13:05:41+00:00\nLast Submission: 2025-12-09T13:05:41+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "creation-time", "timestamp": "1784153265", "to_ids": false, "type": "datetime", "uuid": "24fd6d8e-1964-4d66-b48c-b59cfed79ca3", "value": "2025-12-04T18:33:08+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "ssdeep", "timestamp": "1784153265", "to_ids": true, "type": "ssdeep", "uuid": "02628283-9f10-42ca-b2cc-72086e1069ba", "value": "393216:N938A8ABckgbL/Q6QkvLf0Pae7Uvn4ywq45P36A1w31d7YEW:XL8bVL/Q6QkvLfPn4ywrPWF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153265", "to_ids": false, "type": "size-in-bytes", "uuid": "08fc6dda-bc10-4d1f-aee5-d8dbeb6ac304", "value": "52602368" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "vhash", "timestamp": "1784153265", "to_ids": true, "type": "vhash", "uuid": "fcc9ce4b-c182-40bb-8cfa-084377235d1d", "value": "0570b6666d5c0d5d151c014262z97008816za145z32ze80301az2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T13:05:41+00:00", "last_seen": "2025-12-09T13:05:41+00:00", "object_relation": "filename", "timestamp": "1784153265", "to_ids": true, "type": "filename", "uuid": "fcb64f8b-b356-4ab4-b32f-912acdadda15", "value": "WinLSP.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-20T09:22:00+00:00", "last_seen": "2026-05-20T09:35:30+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154628", "uuid": "93c6e449-8f2d-476d-8cc8-815a093cc74d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T09:22:00+00:00", "last_seen": "2026-05-20T09:35:30+00:00", "object_relation": "md5", "timestamp": "1784154628", "to_ids": true, "type": "md5", "uuid": "11c2b5d6-4d40-4a02-b71b-58dbf4f967ce", "value": "a2bb87605a871d179590c371eb635eb4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T09:22:00+00:00", "last_seen": "2026-05-20T09:35:30+00:00", "object_relation": "sha1", "timestamp": "1784154140", "to_ids": true, "type": "sha1", "uuid": "a10e3a30-3112-4ffd-b886-c164efe43ce1", "value": "b5df59e43c1bb44cbd53698a7bdd90f959aba732", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T09:22:00+00:00", "last_seen": "2026-05-20T09:35:30+00:00", "object_relation": "sha256", "timestamp": "1784154140", "to_ids": true, "type": "sha256", "uuid": "c0de5d7d-7611-40b0-97fa-9d0b30a78d7c", "value": "5a2ed557c357ba8f96f2d55a8a00695987806b5df766cd1dfdab0cbed111774a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T09:22:00+00:00", "last_seen": "2026-05-20T09:35:30+00:00", "object_relation": "text", "timestamp": "1784153287", "to_ids": false, "type": "text", "uuid": "5a8961be-5cb9-462f-b346-f8248e786c2e", "value": "Type Description: VBA\nMicrosoft: Trojan:VBS/Obfuse.PGOX!MTB\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-05-20T09:22:00+00:00\nLast Submission: 2026-05-20T09:35:30+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-20T09:22:00+00:00", "last_seen": "2026-05-20T09:35:30+00:00", "object_relation": "ssdeep", "timestamp": "1784153287", "to_ids": true, "type": "ssdeep", "uuid": "001170ea-a642-42a4-a10d-af636765b86e", "value": "768:MQM4i1z31o8ZIiScjm021OYw64xvT3URTQL0rvSZAc:MjL1z3y8WiZL7YExT4TQ0+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T09:22:00+00:00", "last_seen": "2026-05-20T09:35:30+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153287", "to_ids": false, "type": "size-in-bytes", "uuid": "579363c6-f797-45c5-87ef-500c2a18add7", "value": "36611" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-20T09:22:00+00:00", "last_seen": "2026-05-20T09:35:30+00:00", "object_relation": "filename", "timestamp": "1784153287", "to_ids": true, "type": "filename", "uuid": "f3ef6024-34d9-453a-9ba7-a8c9803dff0a", "value": "facture_1779263676_2622.vbs" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154649", "uuid": "06400824-6f93-49da-9599-27875539f35d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "md5", "timestamp": "1784154649", "to_ids": true, "type": "md5", "uuid": "4e89d263-e66e-4e6f-97a4-9ea716bc8c3d", "value": "cfca7bc16b1d0babb5312b84edf11e95", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "sha1", "timestamp": "1784154141", "to_ids": true, "type": "sha1", "uuid": "bca566cc-2cc3-4d8f-90ca-bbe0fbeeec74", "value": "9c90925e07c27238c4571455bfc8ccbd2d203ec7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "sha256", "timestamp": "1784154141", "to_ids": true, "type": "sha256", "uuid": "47422bfb-82cd-4379-98b0-95ee8439eed5", "value": "5e06af187b45476ade0d953e834fced6197d0a33ac60c2575877660e26ab15e8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "text", "timestamp": "1784153310", "to_ids": false, "type": "text", "uuid": "ae41a33b-0952-4988-bc92-4d936df0e0bd", "value": "Type Description: PDF\nMicrosoft: Trojan:PDF/Ousaban.GVA!MTB\nClamAV: None\nVT Total Detection: 26/74\nFirst Submission: 2025-12-09T09:33:06+00:00\nLast Submission: 2025-12-09T09:33:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "creation-time", "timestamp": "1784153310", "to_ids": false, "type": "datetime", "uuid": "a997fa4d-905c-435d-a26c-bb1bbf7a5dea", "value": "2025-12-08T17:14:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "ssdeep", "timestamp": "1784153310", "to_ids": true, "type": "ssdeep", "uuid": "0854b1cc-fa28-4349-9407-9dca0707a95d", "value": "6144:Kza0OpMIJI57R317d116HpCZNsrg4RAV2vmVe:AxO+v7Do8Ns04RAV2vmVe" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153310", "to_ids": false, "type": "size-in-bytes", "uuid": "b24ccdf0-8d40-4424-b53a-a48281abe834", "value": "224796" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "vhash", "timestamp": "1784153310", "to_ids": true, "type": "vhash", "uuid": "0f5bcbdc-3d85-4b2b-aab3-a29149ce20d0", "value": "94ceeaf7df6054d9ffa24ed60b7f9a867" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-09T09:33:06+00:00", "last_seen": "2025-12-09T09:33:06+00:00", "object_relation": "filename", "timestamp": "1784153310", "to_ids": true, "type": "filename", "uuid": "73fb43fc-1f7a-4e5c-bf5b-404923e03470", "value": "FACTURE08122025_IMPROVED.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154670", "uuid": "dee3a971-ec8e-405f-b365-d2870faf5af9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "md5", "timestamp": "1784154670", "to_ids": true, "type": "md5", "uuid": "b1af2c7a-69d0-451b-87b2-80cf1bb69601", "value": "d26958ebfb9cd1cc6fcbeaf970233e16", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "sha1", "timestamp": "1784154142", "to_ids": true, "type": "sha1", "uuid": "5b6fffce-0e00-4291-bd76-86a555845940", "value": "68c703c142bc4b68ff6710ca94fc2c37184da0dc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "sha256", "timestamp": "1784154142", "to_ids": true, "type": "sha256", "uuid": "0babb4f6-5b3e-4750-9f8f-56ee095c635e", "value": "6bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee73", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "text", "timestamp": "1784153352", "to_ids": false, "type": "text", "uuid": "24ee643d-01ce-49d3-8783-cce7572a9e03", "value": "Type Description: PDF\nMicrosoft: Trojan:Win32/Vigorf.A\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-05-26T07:02:40+00:00\nLast Submission: 2026-05-26T09:16:15+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "creation-time", "timestamp": "1784153353", "to_ids": false, "type": "datetime", "uuid": "3f962f2b-09d5-402f-b596-38d935cee256", "value": "2026-05-25T19:15:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "ssdeep", "timestamp": "1784153352", "to_ids": true, "type": "ssdeep", "uuid": "14910122-71f7-4a01-ae07-75c504561fe0", "value": "48:Fh4zoKPDeIEoHLxXkFoxdHvJJiC0pkmI+6DUZX:FOcKtRHLBjx7JL0pkmcD4" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153352", "to_ids": false, "type": "size-in-bytes", "uuid": "bc4fb8d3-51ef-4043-83d8-8a6dd36cb065", "value": "1848" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "vhash", "timestamp": "1784153352", "to_ids": true, "type": "vhash", "uuid": "25c291ad-e862-4f77-aba2-cebf0bc606e5", "value": "95e5aa64d46eef154e3ec446822ea5f6b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-26T07:02:40+00:00", "last_seen": "2026-05-26T09:16:15+00:00", "object_relation": "filename", "timestamp": "1784153352", "to_ids": true, "type": "filename", "uuid": "3b5459f0-0109-4c03-b9ec-e343f220cbb0", "value": "AR3456SC6ES68EE.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154691", "uuid": "1c2523f3-9f6e-492f-9fb1-1b0c6ab025bd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "md5", "timestamp": "1784154691", "to_ids": true, "type": "md5", "uuid": "f4582fa0-f553-4812-ab1a-bd5b8ef39844", "value": "27322beafc4566cba87c4165e3364bbf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "sha1", "timestamp": "1784154143", "to_ids": true, "type": "sha1", "uuid": "edbdf700-5c15-4ab5-8d71-665f4255137e", "value": "1ea2a4742d4ac4eb963f2e5ee936bc98f66e8840", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "sha256", "timestamp": "1784154144", "to_ids": true, "type": "sha256", "uuid": "6a7a9a5e-7243-466b-b2f5-af0393dac417", "value": "9d07a83cf89685651ea8992047ae694c24f6ddef193044357debd15ce07a64fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "text", "timestamp": "1784153374", "to_ids": false, "type": "text", "uuid": "7dce43e1-0b64-4218-9084-dd26e89dccd6", "value": "Type Description: PDF\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-06-09T08:27:24+00:00\nLast Submission: 2026-06-16T10:01:07+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "creation-time", "timestamp": "1784153375", "to_ids": false, "type": "datetime", "uuid": "739eb9ca-6508-452f-a87e-ee6e5829eff0", "value": "2026-06-08T19:45:13+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "ssdeep", "timestamp": "1784153374", "to_ids": true, "type": "ssdeep", "uuid": "03c35d1b-7b59-45c9-8d49-da36bbfc3a55", "value": "48:Fh4zoKPDFb3vUb+HXkG2AmHK9YiFkmIUGUSTi:FOcKRb3bCAnY8km9Gm" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153374", "to_ids": false, "type": "size-in-bytes", "uuid": "aed5bff2-bd38-4496-be24-51362be3923f", "value": "1805" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "vhash", "timestamp": "1784153374", "to_ids": true, "type": "vhash", "uuid": "c203e348-e4ff-48c8-a45a-35793227fe5d", "value": "95e5aa64d46eef154e3ec446822ea5f6b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-09T08:27:24+00:00", "last_seen": "2026-06-16T10:01:07+00:00", "object_relation": "filename", "timestamp": "1784153374", "to_ids": true, "type": "filename", "uuid": "3a616532-8473-4b39-83e6-eba2c46241e7", "value": "PT656S16A93D69E.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154713", "uuid": "e0bf1270-79e2-400d-8396-1e541b6f65b1", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "object_relation": "md5", "timestamp": "1784154713", "to_ids": true, "type": "md5", "uuid": "c457dc1f-eba3-4fe6-ae3a-830b45146038", "value": "0f1b1f2a275430243f016fc8a2fbbdef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "object_relation": "sha1", "timestamp": "1784154145", "to_ids": true, "type": "sha1", "uuid": "7cf85504-9efc-4ddd-96df-84421a7ce652", "value": "7f684ac03b7fb2458f8386996d867ebb6f2444d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "object_relation": "sha256", "timestamp": "1784154145", "to_ids": true, "type": "sha256", "uuid": "65741504-7722-4f9b-8ae6-c844c11e79d0", "value": "9e81ade09cc18f0fc09d73e72d2e0bffad02f52fdcc26553e473cee8cabc1567", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "object_relation": "text", "timestamp": "1784153396", "to_ids": false, "type": "text", "uuid": "622c3d78-e184-44a4-95b3-777e7fefa404", "value": "Type Description: HTML\nMicrosoft: Trojan:Win32/ClickFix.HAU!MTB\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2025-12-15T13:43:51+00:00\nLast Submission: 2025-12-15T13:46:09+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "object_relation": "ssdeep", "timestamp": "1784153396", "to_ids": true, "type": "ssdeep", "uuid": "f6cec446-68b6-4d4d-8e0c-dd45fe7c48f1", "value": "96:981Y8LbJUj6uRvY+3h0VorAyCjj6nH14Ab9X3Tw:ydUjhR0CMtjAWAb9Xjw" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153396", "to_ids": false, "type": "size-in-bytes", "uuid": "1a35289f-8a30-4f58-ab74-bbc9bcee7c49", "value": "4518" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "object_relation": "vhash", "timestamp": "1784153396", "to_ids": true, "type": "vhash", "uuid": "d81b4d52-4cb8-47c9-bf63-0cdc6d357834", "value": "b5cc2a66034e3a72a9d98bed2b2750c7" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-12-15T13:43:51+00:00", "last_seen": "2025-12-15T13:46:09+00:00", "object_relation": "filename", "timestamp": "1784153396", "to_ids": true, "type": "filename", "uuid": "07e26a1c-b72c-4c98-b71d-664dc188fdda", "value": "index.html" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154734", "uuid": "aa58b67a-87ca-49a7-8c63-91f5927b84d6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "md5", "timestamp": "1784154734", "to_ids": true, "type": "md5", "uuid": "2d95b753-9756-46b4-a505-d8599450fd4c", "value": "34de907216b4d3311da22c62be1521d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "sha1", "timestamp": "1784154146", "to_ids": true, "type": "sha1", "uuid": "30c81dbb-b46c-444b-81c9-165e0fedc680", "value": "9a43e9b3b1dfe5e08311f5ef6bbe58efea50ee72", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "sha256", "timestamp": "1784154146", "to_ids": true, "type": "sha256", "uuid": "0e2f9b71-709c-4e15-b9c7-696318de1613", "value": "e2f0c2d4c1552cd81fa012043e4a5ac832582b639b7b6b7eccc0c4802d7a8ad8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "text", "timestamp": "1784153417", "to_ids": false, "type": "text", "uuid": "74c54d5a-1ecc-418a-9ff8-4a7752c8e159", "value": "Type Description: PDF\nMicrosoft: Trojan:Script/Wacatac.B!ml\nClamAV: None\nVT Total Detection: 30/74\nFirst Submission: 2026-05-12T06:10:50+00:00\nLast Submission: 2026-05-13T14:26:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "creation-time", "timestamp": "1784153417", "to_ids": false, "type": "datetime", "uuid": "16d4c9a0-45fc-4b2a-b011-1c2a8bbdf82e", "value": "2026-05-11T23:48:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "ssdeep", "timestamp": "1784153417", "to_ids": true, "type": "ssdeep", "uuid": "59f77142-b585-4035-a696-8811230b3695", "value": "48:Fh4zoKPDeIEoHLxXk9oxdH/5i5kmIttU3v:FOcKtRHLBjxl5Ykm4tC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153417", "to_ids": false, "type": "size-in-bytes", "uuid": "a49dfc5b-fce1-47ea-8fe0-8ec1a816057b", "value": "1823" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "vhash", "timestamp": "1784153417", "to_ids": true, "type": "vhash", "uuid": "d94790a6-df06-40a9-bb52-b9cc02ffe20a", "value": "95e5aa64d46eef154e3ec446822ea5f6b" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-12T06:10:50+00:00", "last_seen": "2026-05-13T14:26:36+00:00", "object_relation": "filename", "timestamp": "1784153417", "to_ids": true, "type": "filename", "uuid": "b14cd714-e94b-45e2-a709-2065d995c04a", "value": "ES3456SC6ES68EE.pdf" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154756", "uuid": "aab35de1-47ad-4479-9e7a-ce009cfbc0c8", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "object_relation": "md5", "timestamp": "1784154756", "to_ids": true, "type": "md5", "uuid": "e811638d-4dce-498b-bb3c-a4605f1e10bb", "value": "a6cd7334e0dc72c126fca3d5afc0007c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "object_relation": "sha1", "timestamp": "1784154147", "to_ids": true, "type": "sha1", "uuid": "b7d48b61-1bc1-4e51-ab4d-8a4978fed8fb", "value": "8673379e2981d79f5ff752ff84c78bb281e04950", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "object_relation": "sha256", "timestamp": "1784154147", "to_ids": true, "type": "sha256", "uuid": "ecccc33b-86c3-4763-879b-43afa1b4424f", "value": "e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "object_relation": "text", "timestamp": "1784153439", "to_ids": false, "type": "text", "uuid": "99d270d3-feca-4e95-bc3e-6cf2012c2394", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Ousaban.GVE!MTB\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2025-04-28T11:06:48+00:00\nLast Submission: 2025-04-28T11:06:48+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "object_relation": "creation-time", "timestamp": "1784153439", "to_ids": false, "type": "datetime", "uuid": "084d6502-7f69-4c9a-a4b9-a6e27bb158aa", "value": "2025-04-10T16:47:57+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "object_relation": "ssdeep", "timestamp": "1784153439", "to_ids": true, "type": "ssdeep", "uuid": "23a1ccca-1299-4973-8b4d-3c54415c7ce5", "value": "393216:j5lvEOd66FjsJk1sG++L/QcVR0Pae7Uvn4ywqA5PsVfWuxdRND5dHUEW:R8/Isb+L/QcVRPn4ywTPsVJz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153439", "to_ids": false, "type": "size-in-bytes", "uuid": "2dfa290c-1138-488e-b8da-83f2c72e6ad7", "value": "53153792" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-04-28T11:06:48+00:00", "last_seen": "2025-04-28T11:06:48+00:00", "object_relation": "vhash", "timestamp": "1784153439", "to_ids": true, "type": "vhash", "uuid": "0ee34368-6ac1-46d7-afed-174412a067af", "value": "0570b6666d5c0d5d551c022260400a2009515z16145zd0100f90301az2" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784154777", "uuid": "7b8136fb-8f16-4065-af48-0450b7fecdbb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "object_relation": "md5", "timestamp": "1784154777", "to_ids": true, "type": "md5", "uuid": "0f507954-ac13-4d09-abf5-bf6eb153da7a", "value": "b8ccce9fb21ae1662a94bdb0a93e9667", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "object_relation": "sha1", "timestamp": "1784154149", "to_ids": true, "type": "sha1", "uuid": "e1c5bb17-2e09-4305-810c-3656ac1e81db", "value": "5d6b2e9c44b2a8680b35448a9121d6001a065f09", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "object_relation": "sha256", "timestamp": "1784154149", "to_ids": true, "type": "sha256", "uuid": "8070c589-e249-4885-84af-4b3e6d61aa9e", "value": "fadbb8061715128bebecf7bc59132b6bb04fe8cc39b965aa5b8722dffe28d7e7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 16/07/2026\nLast-scan: 14/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "object_relation": "text", "timestamp": "1784153460", "to_ids": false, "type": "text", "uuid": "64491907-9e53-4e98-9fd0-94e5901a3012", "value": "Type Description: HTML\nMicrosoft: Trojan:HTML/Ousaban.GVC!MTB\nClamAV: None\nVT Total Detection: 21/74\nFirst Submission: 2026-06-17T03:09:12+00:00\nLast Submission: 2026-06-17T03:09:12+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "object_relation": "ssdeep", "timestamp": "1784153460", "to_ids": true, "type": "ssdeep", "uuid": "240a1823-a72c-48d5-bd8a-8785ff049ace", "value": "192:9mMuhYy6K88lc9cb9sTxEy1gyGjy/dWPFkgRv0vGaT8bl2voJpL3pCQSCd0F0gAB:wjvgMFb5sa9" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "object_relation": "size-in-bytes", "timestamp": "1784153460", "to_ids": false, "type": "size-in-bytes", "uuid": "dd729004-f792-4e70-a0cb-ed4a5c43b9e5", "value": "12634" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "object_relation": "vhash", "timestamp": "1784153460", "to_ids": true, "type": "vhash", "uuid": "0009062e-4f37-4d99-b7d1-fa84ac1e08e0", "value": "babef4459a5d54112be9be602172882a" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-06-17T03:09:12+00:00", "last_seen": "2026-06-17T03:09:12+00:00", "object_relation": "filename", "timestamp": "1784153460", "to_ids": true, "type": "filename", "uuid": "326649bf-c4f5-467c-adef-1194ec294ea0", "value": "popunder.html" } ] } ] } }