{ "Event": { "analysis": "1", "date": "2026-06-16", "extends_uuid": "", "info": "[Threat Intel] Attackers Weaponize Microsoft Teams Relays to Stay Hidden", "protected": false, "publish_timestamp": "1782253827", "published": true, "threat_level_id": "2", "timestamp": "1782253827", "uuid": "afa946fd-9cd9-4c73-93c2-b2147fdefd2e", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#892644", "local": false, "name": "misp-galaxy:producer=\"Symantec\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#f28fb8", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"OS Credential Dumping - T1003\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1087.002\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#bce57a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over Web Service - T1567\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#682cad", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote Services - T1021\"", "relationship_type": "" }, { "colour": "#bf01b7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Modify Registry - T1112\"", "relationship_type": "" }, { "colour": "#8ed4a7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"", "relationship_type": "" }, { "colour": "#461928", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Blocking - T1562.006\"", "relationship_type": "" }, { "colour": "#e43954", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#36d931", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#f055aa", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"", "relationship_type": "" }, { "colour": "#3970d7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Remote System Discovery - T1018\"", "relationship_type": "" }, { "colour": "#e1e63b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"DLL Side-Loading - T1574.002\"", "relationship_type": "" }, { "colour": "#fae37b", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Service Execution - T1569.002\"", "relationship_type": "" }, { "colour": "#c295b4", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Internal Proxy - T1090.001\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Ransomware\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781665206", "to_ids": false, "type": "link", "uuid": "1ea8a68d-6825-4247-8eb9-7f66c6be4107", "value": "https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1781665206", "to_ids": false, "type": "text", "uuid": "e4cbd721-c544-40a5-b225-bb53029921dc", "value": "Attackers deploying DragonForce ransomware against a major U.S. services firm concealed their command-and-control traffic within Microsoft Teams relay infrastructure using Backdoor.Turn, a custom Go-based remote access trojan. This novel technique leverages anonymous Teams visitor tokens and TURN relay servers to mask malicious communications as legitimate Microsoft traffic. The intrusion lasted one to two months, beginning in December 2025 with exploitation of an SQL server vulnerability. Attackers employed sophisticated defense evasion tactics including DLL side-loading with VirtualBox executables and multiple Bring Your Own Vulnerable Driver techniques. They exploited a previously unknown vulnerability in Huawei's HWAuidoOs2Ec.sys driver, along with several other vulnerable drivers, to terminate security processes at kernel level. The campaign demonstrates DragonForce's evolution into a highly capable ransomware cartel with advanced operational maturity." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1781665206", "to_ids": false, "type": "text", "uuid": "6163db61-4059-40d6-8e7c-56bab9122673", "value": "Name: Attackers Weaponize Microsoft Teams Relays to Stay Hidden\nAuthor: AlienVault\nAdversary: DragonForce\nTags: [\"dragonforce\", \"dll side-loading\", \"ransomware\", \"byovd\", \"cve-2023-52271\", \"cve-2025-61155\", \"cve-2025-1055\", \"turn relay\", \"credential theft\", \"vulnerable drivers\", \"backdoor.turn\", \"microsoft teams abuse\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: [\"Backdoor.Turn\", \"DragonForce\"]\nAttack_ids: [\"T1003\", \"T1087.002\", \"T1190\", \"T1567\", \"T1055\", \"T1021\", \"T1112\", \"T1555.003\", \"T1562.006\", \"T1562.001\", \"T1027\", \"T1486\", \"T1071.001\", \"T1136\", \"T1018\", \"T1574.002\", \"T1569.002\", \"T1090.001\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1781665206", "to_ids": false, "type": "threat-actor", "uuid": "60203426-c044-4ad7-b5f9-7dcae3cef4c8", "value": "DragonForce" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781665206", "to_ids": false, "type": "vulnerability", "uuid": "674972cd-6402-43d2-8e79-2b766c9950e9", "value": "CVE-2025-61155" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781665206", "to_ids": false, "type": "vulnerability", "uuid": "5bc5ef87-5ce5-4e96-90ad-755dacd844fd", "value": "CVE-2023-52271" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1781665206", "to_ids": false, "type": "vulnerability", "uuid": "177fee31-b16f-4a2e-8a36-3411fa01c1f0", "value": "CVE-2025-1055" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232904", "to_ids": true, "type": "sha256", "uuid": "74edeb89-0e8d-4dc7-bbb2-09382abbc979", "value": "048e18416177de2ead251abdf4d89837f6807c6aba4d5b1debe49adfdecbf05c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232905", "to_ids": true, "type": "sha256", "uuid": "469889d2-c52b-414c-a1a8-f0be992a270a", "value": "65ab49119c845801f29a57e8aa177146b2ffbd289d4278109b146f933380f951", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232906", "to_ids": true, "type": "sha256", "uuid": "50a4ec54-35f9-47f3-a32d-5d57703a0511", "value": "6bbf10bcbef7ac5102b54c81137859891a3802dbacd888be90f990d50e18b0b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232907", "to_ids": true, "type": "sha256", "uuid": "5629b55a-82b7-4d2b-ae0d-0199d33ae3c6", "value": "6f9fbe29f8cc2788e2bc9d631e0eea2a8e9837076837b55838005a0e654f0a9e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232908", "to_ids": true, "type": "sha256", "uuid": "d6482db5-947f-4889-a8a9-b200a6984a86", "value": "821da79d727351dd67ce5df7950e9a3de6647a3cf474bb3a093f67507fed92a6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232909", "to_ids": true, "type": "sha256", "uuid": "0725b4b5-fc81-4f2e-bdb6-85b04b524206", "value": "ce66b8221446c9b6d83f0ce6382f430e519601641e5daaaf1ca7a8a8806cb0b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232910", "to_ids": true, "type": "sha256", "uuid": "b8278979-8fcd-4ee3-872c-078a3cbbaf8b", "value": "e45b18c93d187aac5c4486f57483bc87580e15def82a312bfb377ff16eb96b22", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232911", "to_ids": true, "type": "sha256", "uuid": "7a70f70b-d411-4688-8590-187a7146e1d0", "value": "f174c19902523dcf005fa044b6598403a5e5c0a5982398d1bc0dcc5ec1cd351b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234245", "to_ids": true, "type": "ip-dst", "uuid": "84e68278-25c6-42ce-a877-6e993a54dc93", "value": "62.164.177.25", "Tag": [ { "colour": "#890b4e", "local": false, "name": "asn:asn=\"215929\"", "relationship_type": "" }, { "colour": "#24cf2b", "local": false, "name": "asn:as-owner=\"DATACAMPUS\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234267", "to_ids": true, "type": "url", "uuid": "caabdfb6-cf41-4944-b2a8-e056aea5c411", "value": "http://192.36.27.51/TechSupV18Fix3.zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234289", "to_ids": true, "type": "domain", "uuid": "07e112bd-fbf1-4b55-a4d4-058fee8112fc", "value": "comunidadesparentais.com.br", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234310", "to_ids": true, "type": "domain", "uuid": "1545b9ec-5b13-438d-bdda-f3beab7589e3", "value": "glanz-gmbh.de", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234332", "to_ids": true, "type": "domain", "uuid": "38882504-797d-4586-9338-639a022c59bb", "value": "mysimerp.net", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234353", "to_ids": true, "type": "domain", "uuid": "b63324c3-ce2a-4734-bd94-f6170201442a", "value": "professionalhomebasedbusiness.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234377", "to_ids": true, "type": "domain", "uuid": "4ad5cda2-c5b9-48cd-a7a3-5fc42d4a1827", "value": "projetosmecanicos.com.br", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234399", "to_ids": true, "type": "domain", "uuid": "72e7a878-decc-435a-b67f-08cf0e045fc4", "value": "safefire.jo", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234420", "to_ids": true, "type": "domain", "uuid": "93b0d4c9-c2cd-4df7-9713-bf9818354aec", "value": "socialbizsolutions.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234444", "to_ids": true, "type": "domain", "uuid": "194e0a9c-ed9d-40c7-8b40-68a694d493b6", "value": "turnkeyaiagents.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check:24/06/2026", "deleted": false, "disable_correlation": false, "timestamp": "1782232912", "to_ids": true, "type": "sha256", "uuid": "7c4c6d50-e95c-4ba2-b4dd-6a43df0a6ff5", "value": "087f002df0a02c8c74f3ba5cd99cf29fb9efff38bf57b3d808e34a5dd4200dd2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234465", "to_ids": true, "type": "hostname", "uuid": "3d0a30de-3f60-44e6-b5e6-37ba694a0077", "value": "projetosmecanicos.com.br", "Tag": [ { "colour": "#669ae5", "local": false, "name": "AlreadyExistsError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1782234486", "to_ids": true, "type": "hostname", "uuid": "1631e713-67f0-4b41-8813-3f9a70a1dbcd", "value": "comunidadesparentais.com.br", "Tag": [ { "colour": "#669ae5", "local": false, "name": "AlreadyExistsError", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234507", "uuid": "472379c5-953d-4781-9c61-22bb085a183c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234507", "to_ids": true, "type": "md5", "uuid": "e4cfb705-d323-48f5-b51e-c0c71ea36032", "value": "ecb1d69999a730760b3c5654920f0ef6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232890", "to_ids": true, "type": "sha1", "uuid": "88d71c84-749a-445b-b689-d8c1f2dd9687", "value": "b4ddb0adf94e28b53e392900c5ff2f538616441b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232890", "to_ids": true, "type": "sha256", "uuid": "c975a028-c16c-478e-b940-692b23952fec", "value": "8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231105", "to_ids": true, "type": "ssdeep", "uuid": "2b2d23bb-b531-4484-85a0-bcc7c26545c5", "value": "6144:G9+6m01ZrYh4oEnZLWaAsRkA4w3RNo3Evm2Qk/A28ecH7sU+:EHrEOZqlQkApmeeecbsp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231105", "to_ids": false, "type": "size-in-bytes", "uuid": "53cb206b-4026-49ba-b68e-049bb720b9cc", "value": "277504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231105", "to_ids": true, "type": "vhash", "uuid": "3fc4fcc5-f997-4000-92a2-69444ade46a8", "value": "0250b76d7515551c0d1d1az3c2drz19z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231105", "to_ids": true, "type": "filename", "uuid": "85a6eb30-e395-49d6-a65d-6d8510381b0b", "value": "2026-02-09_ecb1d69999a730760b3c5654920f0ef6_cobalt-strike_conti" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231105", "to_ids": false, "type": "text", "uuid": "9fb5d067-9f94-4f82-8368-d6f38ee5d21c", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:49/69\nFirst Submission:2026-02-08T03:27:24.000000+00:00\nLast Submission:2026-02-09T11:15:32.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234529", "uuid": "39cb3a2b-7923-4e6c-b4aa-624cc59924ae", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234529", "to_ids": true, "type": "md5", "uuid": "b1eeb555-b52b-4741-a0c5-aaae5801efa2", "value": "0aaae94aeed94870f755487e8ec17259", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232891", "to_ids": true, "type": "sha1", "uuid": "482acd9d-0dc2-442d-aa9e-62cd0d0e1826", "value": "a86c445b9d233b6316a66842c5224265feda8ba7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232891", "to_ids": true, "type": "sha256", "uuid": "9d754f56-f15b-4c08-a254-badeab52a4dc", "value": "8284c8676cc22c4b2e66826ac16986da7ddecba1f2776b16771be17bfdc45dc2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231237", "to_ids": true, "type": "ssdeep", "uuid": "1f16198d-c6fe-4c17-a755-8c7970e09852", "value": "49152:HZ8rsb+PhO3azYTE4huelWcwstY2Q10VUzGY4XZjdlMDBSQ:Rb28akTEelfCbkuBR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231237", "to_ids": false, "type": "size-in-bytes", "uuid": "71bce854-9a7f-45bc-bb3c-9e19556e2da2", "value": "2314240" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231237", "to_ids": true, "type": "vhash", "uuid": "5854059f-a55f-4bb8-82ff-195c0f09bd26", "value": "0260a6050d0506060d1779z17z1xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231237", "to_ids": true, "type": "filename", "uuid": "fcedbdae-b079-466c-a2bb-9f1093b5c2a6", "value": "tdevflt.sys" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231237", "to_ids": false, "type": "text", "uuid": "f12f6618-28bd-4199-ac75-7f4dc14bda13", "value": "Type Description: Win32 EXE\nMicrosoft: PUA:Win32/SBYinYing\nVT Total Detection:50/69\nFirst Submission:2025-10-31T00:55:12.000000+00:00\nLast Submission:2026-06-21T11:34:13.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234550", "uuid": "d757d2c4-6017-467b-9b81-e9567a853896", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234550", "to_ids": true, "type": "md5", "uuid": "9112d6b5-f045-4b1f-84e6-c650b2c3175d", "value": "9d69a26674e86ad63f39ca36a93684c4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232892", "to_ids": true, "type": "sha1", "uuid": "fd0d1771-5023-4300-aebb-a4a008f5cabb", "value": "e3c39bb44f9040e3fff950e2499f1e125ffbc520", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232893", "to_ids": true, "type": "sha256", "uuid": "f7951d84-ddaf-4da7-b763-111c7767a89d", "value": "82b37a92589dfd4d67ca87eb9e52ac8e682e8e60d2211f59074cd5ccc693013b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231259", "to_ids": true, "type": "ssdeep", "uuid": "d9a70dd7-6e24-4d47-9283-0fa8d1b6b70e", "value": "1536:UfmJqdul1qVhrO9d/Wxj5S6dnJ4anVrKg+1tI4lW9:UYqI1qVpOz+xVSuJpVrKL1tZC" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231259", "to_ids": false, "type": "size-in-bytes", "uuid": "c8fe8253-7e33-4c86-937b-142fe2139dcf", "value": "61424" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231259", "to_ids": true, "type": "filename", "uuid": "4514803e-a18a-405b-b59d-26662a7a80c3", "value": "PX8cesL4fHBl5P4.txt" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231259", "to_ids": false, "type": "text", "uuid": "16853bf5-c76e-4c02-b6b8-21e1f36a2796", "value": "Type Description: PGP Security Key\nMicrosoft: None\nVT Total Detection:0/60\nFirst Submission:2026-01-07T16:22:43.000000+00:00\nLast Submission:2026-01-07T16:22:43.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234571", "uuid": "1bb4102a-c29f-414f-839d-c7f62974ea0f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234571", "to_ids": true, "type": "md5", "uuid": "6869a400-5f22-4bf5-b61f-0ae5e539e390", "value": "1189892b48b9b0ac1daec00a50621a80", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232894", "to_ids": true, "type": "sha1", "uuid": "15d38f42-d685-4385-9785-265de8e237fb", "value": "f5aced2bce2718ac8abfe0939c5f92b9f4c99622", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232894", "to_ids": true, "type": "sha256", "uuid": "ca39ae39-be50-4196-bd6c-0f51e592fcd1", "value": "9335f61f8ad276d94455c5b6876fea48152c3cea759f2598c8108ee461fa5759", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231282", "to_ids": true, "type": "ssdeep", "uuid": "048c0d3f-5d5d-44e2-9f47-a870b84809aa", "value": "196608:B2psMiU874ZZ+G5woFA+VGbXts/QkViImhrwFqlRNnOhqCe26zBQFrvZO/nA:MpsU874L+G5woFA+VGC/hVihBeWNnaq+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231282", "to_ids": false, "type": "size-in-bytes", "uuid": "24641d6b-66e1-40e3-97f3-ca2a5166b3cb", "value": "11615102" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231282", "to_ids": true, "type": "vhash", "uuid": "cba1bb90-7bb3-4051-b3f6-74a4bdc2018e", "value": "4f192177644c186c0f7e941332bcb68c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231282", "to_ids": true, "type": "filename", "uuid": "622ddf7b-6f66-44a2-814c-cca635acf523", "value": "m.zip" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 22/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231282", "to_ids": false, "type": "text", "uuid": "ad032a9c-1ed4-4d9e-9cf6-73bff2755949", "value": "Type Description: ZIP\nMicrosoft: None\nVT Total Detection:24/67\nFirst Submission:2025-05-12T18:49:27.000000+00:00\nLast Submission:2025-05-12T18:49:27.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234593", "uuid": "e67e9906-c2d6-4860-a71e-da537e28d524", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234593", "to_ids": true, "type": "md5", "uuid": "b90c6025-b731-436d-bd1b-073b838bcaab", "value": "44a5f72f7229d9f42a0bc75f9b6296d3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232895", "to_ids": true, "type": "sha1", "uuid": "f5611bed-03e0-4b79-81ba-95a5d11232b0", "value": "91322a1c2c0625fc919ec99e5a5eed00fe901193", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232895", "to_ids": true, "type": "sha256", "uuid": "93bccea8-3370-4bbc-a326-c0561a4ab96b", "value": "aea26980059ef2ad11e99556a4edfa1f8ec769fa9f06aa573b81bedf319954b5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231304", "to_ids": true, "type": "ssdeep", "uuid": "a4bd0ac7-b8d4-4c13-af33-0537a404dd4e", "value": "393216:l4YAOa2Y/FPGk5oEwxnGNqsnFZur3Ilmsi2wONZz5T:ONbT" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231304", "to_ids": false, "type": "size-in-bytes", "uuid": "9afe5597-1fa8-4ffd-929d-a4c6f5f08349", "value": "16555600" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231304", "to_ids": true, "type": "vhash", "uuid": "6bc32743-d3ff-47d7-9135-f60c658a656a", "value": "0170a65d5c0d1d151c051212106007a009e1013z1a185ze0301d9030702186z3" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231304", "to_ids": true, "type": "filename", "uuid": "55616d99-9d10-4460-9e27-ae0f5fa0ea9a", "value": "netscan.exe" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231304", "to_ids": false, "type": "text", "uuid": "048d1178-3e43-4c3c-bafc-bbe024c80030", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:6/69\nFirst Submission:2020-07-14T06:52:08.000000+00:00\nLast Submission:2024-02-18T19:35:32.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234614", "uuid": "120f7ceb-9354-4f82-a988-a5728725e278", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234614", "to_ids": true, "type": "md5", "uuid": "402bfb71-af58-49e8-889e-aad4bbb610b9", "value": "9f36877ed925f1dc2cf53db235c53b8c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232896", "to_ids": true, "type": "sha1", "uuid": "c483b161-0a56-419e-8292-9a73dd0da63a", "value": "5a1fe9e72e94d4c92b866f1fc167a5bc098b70bb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232896", "to_ids": true, "type": "sha256", "uuid": "24d713f6-5a88-4124-b578-e23002202308", "value": "cd078957167e1af4de39aecdb981cd14156fa81d5a9c6ac51e74ae5b6199a12a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231327", "to_ids": true, "type": "ssdeep", "uuid": "707248cf-2580-4eaa-840f-c7dee281495f", "value": "196608:AOjqC4P7ZYTfbEYyFFSSMJd9e+kXNT9v2vED9O9NhweQgl+LY0jBE+h:AAqCudYP4TnMfUNT9vO698hTELLE2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231327", "to_ids": false, "type": "size-in-bytes", "uuid": "6ef7a5a5-7505-4e27-b91b-adb110dfe3da", "value": "11614504" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231327", "to_ids": true, "type": "vhash", "uuid": "00673814-e825-4f00-9c3e-d17a64cb2b6e", "value": "4f192177644c186c0f7e941332bcb68c" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231327", "to_ids": true, "type": "filename", "uuid": "d55501ba-2f4f-49da-a3ed-ddc0660918f8", "value": "n.zip" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 22/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231327", "to_ids": false, "type": "text", "uuid": "ebee5b8a-3e49-45ba-866c-d8adfdc04869", "value": "Type Description: ZIP\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:26/67\nFirst Submission:2025-05-19T17:25:06.000000+00:00\nLast Submission:2025-05-19T17:25:06.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234636", "uuid": "b034e41c-69ed-4391-9749-b3828390dd26", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234636", "to_ids": true, "type": "md5", "uuid": "d35e2cb5-fc99-44e2-aec2-a32bd870da30", "value": "d52ea82bd00042891d07a9da1a9dd4a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232897", "to_ids": true, "type": "sha1", "uuid": "345842d1-93d1-4873-88a5-15a0f14ace0c", "value": "3f4b7115399e8eee1a16b9a51d7743c1503fc76b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232897", "to_ids": true, "type": "sha256", "uuid": "242e4359-9ac6-4605-a6d2-5cdaf0fd3dee", "value": "d0da2832ae1e13a98f7ce7e33a66c1b0d9797b81f69ece134e4462ea55ac923e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231372", "to_ids": true, "type": "ssdeep", "uuid": "eb964d08-6250-47ed-894d-08c04817cdd7", "value": "196608:82eqobqaU+5q6Drw0WUNI86da2EbhyF8ZmvgNx/Y:80obqaV06DrwJU8FEbMF8KgNx/" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231372", "to_ids": false, "type": "size-in-bytes", "uuid": "ff2d7733-2889-471f-9f74-d63c3a5204f0", "value": "19465048" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231372", "to_ids": true, "type": "vhash", "uuid": "d4e5e31a-d6e9-4810-bf94-6db4d3708ac8", "value": "0170965d65156c0d1d1d72915050071za51113z1c135ze0501cb061z21c7z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231372", "to_ids": true, "type": "filename", "uuid": "4f81dd02-0222-4d1a-bf8e-aa99643811c5", "value": "netscan.exe" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231372", "to_ids": false, "type": "text", "uuid": "cfd46c3d-cb0b-453d-b794-393544f4f6d7", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:8/69\nFirst Submission:2025-09-26T13:07:48.000000+00:00\nLast Submission:2025-12-03T15:06:21.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234658", "uuid": "bd345d88-d806-448b-aadb-e23fa1aee8fe", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234658", "to_ids": true, "type": "md5", "uuid": "37055566-bb27-4e49-a792-022be021e257", "value": "284abb964d033c82feff9f77df18ac81", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232898", "to_ids": true, "type": "sha1", "uuid": "60a2c51e-06bd-4f06-81c3-420ef569c8e5", "value": "40a1015cfcd76b774fbffa2faa32cdf41316f8ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232898", "to_ids": true, "type": "sha256", "uuid": "510dc968-eb86-4463-b052-eb5f3ea7cd99", "value": "d20a3c928761fe00ac522eeb474612b5804cd9108453ea8591106d5d4428428e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231395", "to_ids": true, "type": "ssdeep", "uuid": "07cca5ba-bbe1-4d43-ad16-5df4d515b15f", "value": "196608:LOLN8NZKi4nACjGS/+lUJzZEnvnmF50Y:LOLN8NZknACySuUx2nvna50" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231395", "to_ids": false, "type": "size-in-bytes", "uuid": "cf4177f0-927a-44e5-8dd2-dda3c582b175", "value": "7191944" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231395", "to_ids": true, "type": "vhash", "uuid": "1cb32b93-0fdb-41e1-a633-931b60505cb8", "value": "17608664055d156d15155aza22z237z1ez1d012z11z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231395", "to_ids": true, "type": "filename", "uuid": "bcc26701-9594-4bb5-bd30-acfbab6f22c7", "value": "VBoxRT.dll VBoxRT.dll VBoxRT.dll" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231395", "to_ids": false, "type": "text", "uuid": "6953406e-e91f-439e-8ee8-914bd2a6f6e2", "value": "Type Description: Win32 DLL\nMicrosoft: Trojan:Win32/Qwexlafiba!rfn\nVT Total Detection:30/70\nFirst Submission:2025-05-12T18:50:22.000000+00:00\nLast Submission:2026-06-18T18:35:53.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234679", "uuid": "b329ba2c-3900-41a6-8f05-40f9cdd7160d", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234679", "to_ids": true, "type": "md5", "uuid": "dd7b4dc8-e511-4aed-ab71-b5c7283f3aca", "value": "cb34be5126520f4c402be3c6f09e11cf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232899", "to_ids": true, "type": "sha1", "uuid": "c67b3df6-548e-4f50-bc72-003d5336e66f", "value": "7edbc5d18449fabd1ac214fa3959ea5a9e330a12", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232899", "to_ids": true, "type": "sha256", "uuid": "afac6087-2372-46aa-885a-c16dfc8b370e", "value": "b6628d201c2a68d2a3de2a87de7a5acfe21b101a97928e1c8d5c82102d967383", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231461", "to_ids": true, "type": "ssdeep", "uuid": "1591d06b-b79c-495e-b6a0-b74f07eb627c", "value": "768:Xr4RHf81bai0PsswsXSf0v+HK7Tk8XWsQ+wYiTP9+t3h6R13TYi9z2L:Xr4RHchdoW0QK88XWsdw7T8t3h6r7zk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231461", "to_ids": false, "type": "size-in-bytes", "uuid": "f7e60589-1312-44a5-a69b-b44f7c9f2f54", "value": "60272" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231461", "to_ids": true, "type": "vhash", "uuid": "4bc109c6-d101-40c1-9a33-25833226d041", "value": "064096651d75761657651iz45xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231461", "to_ids": true, "type": "filename", "uuid": "ac483b66-5327-427f-b343-7d82881c49c6", "value": "GameDriverX64.sys" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231461", "to_ids": false, "type": "text", "uuid": "02f437b1-c3a5-4c57-b706-b8d18246a420", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/VulnDrv!MTB\nVT Total Detection:15/69\nFirst Submission:2023-11-29T13:40:17.000000+00:00\nLast Submission:2026-06-18T09:46:08.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234700", "uuid": "7be6abe2-1bc5-46dc-8b72-e31c2dce1bab", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234700", "to_ids": true, "type": "md5", "uuid": "137fdeaa-55a3-45ff-a536-1a72f37f628d", "value": "4bf04cbed03b5ee7c54ad9a6956fbf00", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232900", "to_ids": true, "type": "sha1", "uuid": "6fb83bfa-4fd7-4803-976a-02c306043445", "value": "d4abfc5dea73f765dec892f75c72def8a5daf0fe", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232901", "to_ids": true, "type": "sha256", "uuid": "90fcd879-c643-4df1-bea1-6b01e1f3a4c1", "value": "142bac0e2148e0d47891b6cd7311195c4acbe33b700fad54a201c52a2bc46219", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231483", "to_ids": true, "type": "ssdeep", "uuid": "51199633-dd30-46ca-8abf-e992b4a85c40", "value": "49152:qU9EYlJ0K4S1AXsHTTDaGCF6zdx6J2qU7ve6KbnQ7/KXF8NA+iGQbL8I7wKL+55P:V" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231483", "to_ids": false, "type": "size-in-bytes", "uuid": "14de5c9a-9742-4045-83a8-ca41276b7d74", "value": "10729128" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231483", "to_ids": true, "type": "filename", "uuid": "99f4327a-7743-488b-bbd7-e73b5bd65565", "value": "Z011g.crt" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 22/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231483", "to_ids": false, "type": "text", "uuid": "78a0864a-b022-4f93-ada0-2a990cf79497", "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:0/61\nFirst Submission:2025-05-19T17:27:41.000000+00:00\nLast Submission:2025-05-19T17:27:41.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234722", "uuid": "7b4ead72-5916-4aa3-8615-8c936f86bd78", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234722", "to_ids": true, "type": "md5", "uuid": "bcb42b47-72cd-4bfa-8317-8339b4e7eab9", "value": "b21d53f1873045b279cd052587998018", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232901", "to_ids": true, "type": "sha1", "uuid": "f03d3b0d-ed0f-4066-af8c-c0519eddecfa", "value": "2ad2edd1e418b867247e4b09ed5f9600432b5863", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232901", "to_ids": true, "type": "sha256", "uuid": "93cb4618-3942-4fab-bbd2-0e27210b3ecb", "value": "8395b621bb4415090f232c59fc41d24ea41a519b58eabe512f3ae7d2fdf049a3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#270095", "local": false, "name": "rectifyq:ioc=\"low-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231506", "to_ids": true, "type": "ssdeep", "uuid": "2e4bdd80-0260-4fcd-99b9-b5dcfab9639c", "value": "49152:33P762z7giaWXgQZ0exVb2qdv+eyVQMR98WxFw0NB7sYfO5uE+zVSDfxeUvg9dOr:J" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231506", "to_ids": false, "type": "size-in-bytes", "uuid": "d38a85bc-d743-4a7e-accb-0ad1070b36cb", "value": "10729724" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231506", "to_ids": true, "type": "filename", "uuid": "60941021-fe3b-4e86-889f-fe48f12b7cfd", "value": "cMGpS3D6.crt" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231506", "to_ids": false, "type": "text", "uuid": "e323fb58-3257-4d1f-9519-2138df534c01", "value": "Type Description: JavaScript\nMicrosoft: None\nVT Total Detection:1/60\nFirst Submission:2025-05-12T18:53:39.000000+00:00\nLast Submission:2026-06-18T18:37:59.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234743", "uuid": "51b82eef-3dde-4f7b-a1a9-c4b09c6f1ba3", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234743", "to_ids": true, "type": "md5", "uuid": "10dcf213-ebb4-472b-9038-612367547c91", "value": "9b04a93e05ccff94667f04bffa7af600", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232902", "to_ids": true, "type": "sha1", "uuid": "047f5fa2-c574-45b7-b224-3802a4c3cc66", "value": "468121e7d6952799f92940677268937c4c5f92ed", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232902", "to_ids": true, "type": "sha256", "uuid": "51b073a5-5531-4978-b6ae-ae5b7420dfca", "value": "b16e217cdca19e00c1b68bdfb28ead53b20adeabd6edcd91542f9fbf48942877", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231529", "to_ids": true, "type": "ssdeep", "uuid": "40cf8204-43ef-411f-9f8a-f24a2050914f", "value": "384:coJavQ0S1Q6Q+ih75TsYq15sSiwrBRL5/Zm+DoURR0rJFpIx7XqnYPLQa6jaJIEb:QS19Rih7ZsvgwrHdljGJFpI9XqymS" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231529", "to_ids": false, "type": "size-in-bytes", "uuid": "7791dba6-e8c5-4849-9598-08bfc3b2f0c8", "value": "27936" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231529", "to_ids": true, "type": "vhash", "uuid": "e2d06a89-78d1-4a14-9e4f-c2245a1a19c7", "value": "024076651d151e55151iz28xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231529", "to_ids": true, "type": "filename", "uuid": "c798d850-817d-4c9e-b870-382fda554cc4", "value": "K7RKScan" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231529", "to_ids": false, "type": "text", "uuid": "c6c500f1-781c-4a77-bedf-190d4ad6aa48", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:6/70\nFirst Submission:2016-08-04T12:03:58.000000+00:00\nLast Submission:2026-06-21T00:34:09.000000+00:00" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1782234764", "uuid": "f6933f40-b1c8-4aa4-a9a6-bc445edd7936", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1782234764", "to_ids": true, "type": "md5", "uuid": "e980fe29-2f7a-43a7-b9fc-283748bd77cb", "value": "521f17a8b04bffb3ad5130fb24a8c372", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1782232903", "to_ids": true, "type": "sha1", "uuid": "6ac040ba-cdaa-4171-950b-a378b7b14941", "value": "ddf6112b8124ecbaf05f6b315c28302c3ee6ffd2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1782232903", "to_ids": true, "type": "sha256", "uuid": "857a9089-12bb-4a1e-a389-3d95c000d776", "value": "252a8bb2eb9c96c5e6cc7cab822e2ed0d508032f9350351221781684e86c03ab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1782231551", "to_ids": true, "type": "ssdeep", "uuid": "120da694-a8bf-4ce1-8f55-88c75c8cbd30", "value": "384:fWT7WKllIBt9dS6Bn/amID5aUAtAcwHbftAVBMIYioQrHvPxh8E9VF0NyQEvxXhD:L6OQlKVrYioQjPxWEauXhIf3Wx9zpQ5" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1782231551", "to_ids": false, "type": "size-in-bytes", "uuid": "32e6ca45-6dcb-415a-96bb-47bc320112e3", "value": "38816" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1782231551", "to_ids": true, "type": "vhash", "uuid": "fb4b7ff7-ca62-4673-be1e-19ab3e29dad4", "value": "034076651d651615151iz21xz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1782231551", "to_ids": true, "type": "filename", "uuid": "f0c01185-9e18-4577-9dbc-86a5b804d3ce", "value": "wsftprm.sys" }, { "category": "Other", "comment": "Checked: 24/06/2026\nLast-scan\t: 23/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1782231551", "to_ids": false, "type": "text", "uuid": "63824709-f394-4a70-99c5-ae69e4460583", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/Malgent!MSR\nVT Total Detection:16/69\nFirst Submission:2025-12-14T15:18:44.000000+00:00\nLast Submission:2026-03-24T06:33:06.000000+00:00" } ] } ] } }