{ "Event": { "analysis": "1", "date": "2026-06-16", "extends_uuid": "", "info": "[Threat Intel] What Is the BabaDeda Loader? Analysis of a New ClickFix Malware Campaign.", "protected": false, "publish_timestamp": "1784321921", "published": true, "threat_level_id": "3", "timestamp": "1784321921", "uuid": "affb4070-e72a-48bc-940b-6177df3f8e8c", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#160e6c", "local": false, "name": "misp-galaxy:producer=\"Morphisec\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:malpedia=\"Babadeda\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#120044", "local": false, "name": "rectifyq:sub-category=\"intrusion-analysis\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783335614", "to_ids": false, "type": "link", "uuid": "6d0a2bc5-a4c3-4100-b780-17449b937f9d", "value": "https://www.morphisec.com/blog/what-is-the-babadeda-loader-analysis-of-a-new-clickfix-malware-campaign/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783335615", "to_ids": false, "type": "text", "uuid": "2ce9eecd-5b96-4341-b645-f54441df1fd4", "value": "The BabaDeda loader family has undergone significant advancements in its capabilities, particularly in stealth, evasion, and payload flexibility. Discovered during April 2026, this evolved framework continues to conceal malicious payloads within seemingly legitimate installer packages while expanding its functionality. The attack methodology begins with a social engineering exploit known as ClickFix, which encourages users to execute commands via trusted operating system utilities. This initial step transitions into a sophisticated multi-stage loader that employs several tactics, including hidden PowerShell commands, in-memory shellcode, DLL sideloading, and external payload storage." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783335615", "to_ids": false, "type": "text", "uuid": "ec572ab7-e49f-468e-b5c6-666823213674", "value": "Name: What Is the BabaDeda Loader? Analysis of a New ClickFix Malware Campaign.\nAuthor: AlienVault\nAdversary: \nTags: [\"BabaDeda\", \"ClickFix\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: []" }, { "category": "Network activity", "comment": "IOC-description:CC=BG ASN=AS34368 zonata - natskovi & sie ltd.", "deleted": false, "disable_correlation": false, "timestamp": "1784305643", "to_ids": true, "type": "ip-dst", "uuid": "7ec10ce1-b9ea-4cc2-ab4f-5c61232ec8bc", "value": "91.92.243.161", "Tag": [ { "colour": "#ce048f", "local": false, "name": "asn:asn=\"209800\"", "relationship_type": "" }, { "colour": "#434f78", "local": false, "name": "asn:as-owner=\"METASPINNER-ASN\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305065", "to_ids": true, "type": "md5", "uuid": "0df87c54-cc81-4abd-b504-7f341a0150ad", "value": "b2e581c85432bd4df6a59a00cbda1cb3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=GB ASN=AS786 jisc services limited", "deleted": false, "disable_correlation": false, "timestamp": "1784305664", "to_ids": true, "type": "ip-dst", "uuid": "38b18d0b-dffc-44b2-93f8-f5431609c3bd", "value": "158.94.208.104", "Tag": [ { "colour": "#ce048f", "local": false, "name": "asn:asn=\"209800\"", "relationship_type": "" }, { "colour": "#434f78", "local": false, "name": "asn:as-owner=\"METASPINNER-ASN\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=RU ASN=AS42429 tele.ru ltd.", "deleted": false, "disable_correlation": false, "timestamp": "1784305686", "to_ids": true, "type": "ip-dst", "uuid": "04c7765f-c4de-4b10-98c7-585c9a5a4fba", "value": "77.238.248.158", "Tag": [ { "colour": "#be34e5", "local": false, "name": "asn:asn=\"216071\"", "relationship_type": "" }, { "colour": "#a24bb4", "local": false, "name": "asn:as-owner=\"VDSINA\"", "relationship_type": "" }, { "colour": "#d11a05", "local": false, "name": "asn:as-country=\"AE\"", "relationship_type": "" }, { "colour": "#43a976", "local": false, "name": "misp-galaxy:country=\"united arab emirates\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305707", "to_ids": true, "type": "domain", "uuid": "593fc211-b8e3-46a4-8bc3-e20b8f955910", "value": "cirealci.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-title:Arechclient2\nIOC-description:CC=IE ASN=AS25441 imagine communications group limited", "deleted": false, "disable_correlation": false, "timestamp": "1784305729", "to_ids": true, "type": "ip-dst", "uuid": "e388693a-8015-44ea-8b41-030399c93885", "value": "89.124.81.216", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=GB ASN=AS786 jisc services limited", "deleted": false, "disable_correlation": false, "timestamp": "1784305750", "to_ids": true, "type": "ip-dst", "uuid": "ad168bba-96d1-4601-ac16-10ed8a064878", "value": "158.94.208.92", "Tag": [ { "colour": "#ce048f", "local": false, "name": "asn:asn=\"209800\"", "relationship_type": "" }, { "colour": "#434f78", "local": false, "name": "asn:as-owner=\"METASPINNER-ASN\"", "relationship_type": "" }, { "colour": "#141680", "local": false, "name": "asn:as-country=\"DE\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"germany\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305770", "to_ids": true, "type": "url", "uuid": "b1603a36-d3c7-439e-b5d6-c2f5aabbaeda", "value": "http://91.92.243.161:3038", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=BG ASN=AS48452 traffic broadband communications ltd.", "deleted": false, "disable_correlation": false, "timestamp": "1784305791", "to_ids": true, "type": "ip-dst", "uuid": "f9b2feb4-b248-4917-877c-b2e923adfd1f", "value": "94.26.83.190", "Tag": [ { "colour": "#3668c7", "local": false, "name": "asn:asn=\"25211\"", "relationship_type": "" }, { "colour": "#b17da9", "local": false, "name": "asn:as-owner=\"EUROCRYPT-AS\"", "relationship_type": "" }, { "colour": "#059db5", "local": false, "name": "asn:as-country=\"BG\"", "relationship_type": "" }, { "colour": "#390b5f", "local": false, "name": "misp-galaxy:country=\"bulgaria\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=RU ASN=AS12695 llc digital network", "deleted": false, "disable_correlation": false, "timestamp": "1784305813", "to_ids": true, "type": "ip-dst", "uuid": "32715ff0-20ec-4dbe-8227-ee19d3483007", "value": "95.163.152.190", "Tag": [ { "colour": "#c3e702", "local": false, "name": "asn:asn=\"210644\"", "relationship_type": "" }, { "colour": "#c047ce", "local": false, "name": "asn:as-owner=\"AEZA-AS\"", "relationship_type": "" }, { "colour": "#e1449b", "local": false, "name": "asn:as-country=\"GB\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united kingdom\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305834", "to_ids": true, "type": "url", "uuid": "361bb3df-c3db-46e3-845b-9b9354059a03", "value": "http://89.124.81.216:9000/wbinjget?q=B2E581C85432BD4DF6A59A00CBDA1CB3", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305855", "to_ids": true, "type": "url", "uuid": "67f0ff17-aa4b-449a-a1d9-9580c0f9b5bf", "value": "http://94.26.83.190:6600/t36umsn9/DataRescueCommunity", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305876", "to_ids": true, "type": "url", "uuid": "60744320-c6d8-4ff8-9003-d07088daafdb", "value": "http://95.163.152.190/linguist.zip", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305897", "to_ids": true, "type": "url", "uuid": "de30e257-fc3c-458b-b181-75a3744f9330", "value": "http://humansbad2026.com/track.php?d=", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305919", "to_ids": true, "type": "domain", "uuid": "264b43c7-b335-411f-a6e7-1ae790a1eaea", "value": "humansbad2026.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305066", "to_ids": true, "type": "sha256", "uuid": "0fc25264-e625-4717-99d0-c0da7c9a5a5e", "value": "3b4208ec304b60ba9d0ca74838ad7031224a32c36d6e1fa7c616a5ecf5074a5b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305066", "to_ids": true, "type": "sha256", "uuid": "869410c4-a894-44c3-8f00-867b7cd6a1ce", "value": "809d030d1fd65c909260b4b33bff9c99f775aea332d944ad1f64b4e5e81a6d60", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305068", "to_ids": true, "type": "sha256", "uuid": "4ea91319-5ebe-42d8-9f25-bcae95777d2c", "value": "9677584602ae15bdd20d91b9a14768a17c126107739e3853d969ff4e02e10e71", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 17/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784305069", "to_ids": true, "type": "sha256", "uuid": "eb662d08-bc61-423b-aba5-b98523db7871", "value": "d79a454beabcd59459c350c71598bffd6badb6a8905b0e9fa3c1ee22cbef7d7e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "On port 3038", "deleted": false, "disable_correlation": false, "timestamp": "1784294814", "to_ids": true, "type": "ip-dst|port", "uuid": "5403f645-03d0-4736-837c-650edb077a6b", "value": "91.92.243.161|3038" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305940", "to_ids": true, "type": "url", "uuid": "c05be320-16c3-45ed-a0eb-f7a16a8bf8eb", "value": "Luishoponline.com/vEaMG9H2/Visual.msi", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305961", "to_ids": true, "type": "url", "uuid": "934ccff1-a3b5-4f96-afee-11b4e397d790", "value": "89.124.81.216:9000/wbinjget?q=B2E581C85432BD4DF6A59A00CBDA1CB3", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784305982", "to_ids": true, "type": "url", "uuid": "0728eb56-fac8-4ba1-8a16-f0a0e9ce363b", "value": "94.26.83.190:6600/t36umsn9/DataRescueCommunity", "Tag": [ { "colour": "#f08989", "local": false, "name": "NotFoundError", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784306003", "to_ids": true, "type": "domain", "uuid": "2a79c5f7-fab6-45eb-8737-0b7ae5a66173", "value": "mqqeravi.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306024", "uuid": "3b90c1f4-59f8-4406-81e9-0206263f3ed8", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-description:MD5 of 2afa7b6f825ae82c0121117b2966c57d825e7f1cfecaef36e638f66a08060db6", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "md5", "timestamp": "1784306024", "to_ids": true, "type": "md5", "uuid": "5e24b75c-50a1-487f-a256-efd3816799e6", "value": "2efaac26a7e8c4efaaf643f19cb8b978", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of 2afa7b6f825ae82c0121117b2966c57d825e7f1cfecaef36e638f66a08060db6", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "sha1", "timestamp": "1784305047", "to_ids": true, "type": "sha1", "uuid": "dc2aa91f-b93e-422c-9286-2f753ec831e2", "value": "c11d639851e27293cddac5eec891e909cc641821", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-description:MD5 of 2afa7b6f825ae82c0121117b2966c57d825e7f1cfecaef36e638f66a08060db6", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "sha256", "timestamp": "1784305047", "to_ids": true, "type": "sha256", "uuid": "4274ecdd-0306-4ba8-be02-11137e3ce376", "value": "2afa7b6f825ae82c0121117b2966c57d825e7f1cfecaef36e638f66a08060db6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "text", "timestamp": "1784303244", "to_ids": false, "type": "text", "uuid": "5120a93e-18ca-4279-b7ac-e3fccba180c1", "value": "IOC-description:MD5 of 2afa7b6f825ae82c0121117b2966c57d825e7f1cfecaef36e638f66a08060db6\r\nType Description: Win32 DLL\nOriginal name: math.dll\nMicrosoft: Trojan:Win32/ShellcodeRunner!MTB\nClamAV: None\nVT Total Detection: 32/74\nFirst Submission: 2026-03-30T16:18:02+00:00\nLast Submission: 2026-03-30T16:18:02+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "creation-time", "timestamp": "1784303245", "to_ids": false, "type": "datetime", "uuid": "6fe612ef-d839-4c26-9c3a-4f2c7ba27bb3", "value": "2026-03-07T12:06:27+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "ssdeep", "timestamp": "1784303244", "to_ids": true, "type": "ssdeep", "uuid": "a6f35e66-4de7-49bf-b849-2224f8ad1ada", "value": "1536:4icsFp8ZO7CQPFqvZvoBJ3rwsPyUr7XsRj4H8mru/M6QDdSzYPzi:46OZO7RcBA318Rjkru/MP4zYu" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303244", "to_ids": false, "type": "size-in-bytes", "uuid": "ada8a2f7-7ddc-4a97-b272-05d1f3aa99cf", "value": "67072" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "vhash", "timestamp": "1784303244", "to_ids": true, "type": "vhash", "uuid": "353763c4-0a55-49ac-99fd-0c92623b04e2", "value": "1640b65d1555155c05155074z11z1d1z2jz3ez8" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-30T16:18:02+00:00", "last_seen": "2026-03-30T16:18:02+00:00", "object_relation": "filename", "timestamp": "1784303244", "to_ids": true, "type": "filename", "uuid": "7eac34c5-b817-4ffc-b94c-9dd6281f64aa", "value": "math.dll" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306045", "uuid": "f7f6b2bc-3965-4006-905f-47fd7b553240", "Attribute": [ { "category": "Payload delivery", "comment": "IOC-title:Cabinet_Archive\nIOC-description:MD5 of 1e1d25391cf825d9607f652249e33cf1d2b98f260b587a1b1b33710e2ea6b91f", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "md5", "timestamp": "1784306045", "to_ids": true, "type": "md5", "uuid": "65d3453c-4542-4170-813f-1d014ab8de23", "value": "3c32116f5e98f5920c2d9f2b19755077", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:Cabinet_Archive\nIOC-description:MD5 of 1e1d25391cf825d9607f652249e33cf1d2b98f260b587a1b1b33710e2ea6b91f", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "sha1", "timestamp": "1784305048", "to_ids": true, "type": "sha1", "uuid": "d1492f30-046b-49e3-b46d-733f7dda80dd", "value": "bf43af6116053819ebd41ee1deb40f85446c774d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "IOC-title:Cabinet_Archive\nIOC-description:MD5 of 1e1d25391cf825d9607f652249e33cf1d2b98f260b587a1b1b33710e2ea6b91f", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "sha256", "timestamp": "1784305048", "to_ids": true, "type": "sha256", "uuid": "f691f320-bf54-42f0-a898-a33a07a7b029", "value": "1e1d25391cf825d9607f652249e33cf1d2b98f260b587a1b1b33710e2ea6b91f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "text", "timestamp": "1784303266", "to_ids": false, "type": "text", "uuid": "d0d4e3d1-7f27-42ec-a211-01e2576db7c7", "value": "IOC-title:Cabinet_Archive\nIOC-description:MD5 of 1e1d25391cf825d9607f652249e33cf1d2b98f260b587a1b1b33710e2ea6b91f\r\nType Descriptio%WINDIR%\\Installer\nMicrosoft: None\nClamAV: None\nVT Total Detection: 21/74\nFirst Seen In The Wild: 2026-05-22T20:34:29+00:00\nFirst Submission: 2026-05-17T09:53:28+00:00\nLast Submission: 2026-05-17T09:53:28+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "creation-time", "timestamp": "1784303266", "to_ids": false, "type": "datetime", "uuid": "422333b5-8b76-45f6-8ca9-56663f1caf1c", "value": "2026-05-13T17:37:16+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "ssdeep", "timestamp": "1784303266", "to_ids": true, "type": "ssdeep", "uuid": "4b391368-e80c-4b64-98a1-4209c91aee17", "value": "196608:S54AOu7HL6F8dKEBQvzbCmxYYrgY79A/J:k47s40KEBQvzbDWugYBA/J" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303266", "to_ids": false, "type": "size-in-bytes", "uuid": "4deb9630-cd47-4ac7-9fe2-9fe8a20bd176", "value": "7340032" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "vhash", "timestamp": "1784303266", "to_ids": true, "type": "vhash", "uuid": "20b729c1-73bd-4b1d-bdea-25905f1b8553", "value": "32fe66a890dbb4ef39f48ef6ec4a5e8d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-17T09:53:28+00:00", "last_seen": "2026-05-17T09:53:28+00:00", "object_relation": "filename", "timestamp": "1784303266", "to_ids": true, "type": "filename", "uuid": "2c330cf3-1e46-4487-b081-b00970f55466", "value": "Rah.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-16T18:36:00+00:00", "last_seen": "2026-03-23T21:09:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306066", "uuid": "00021b9b-6339-4f4f-9d0d-28ed35425f1e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-16T18:36:00+00:00", "last_seen": "2026-03-23T21:09:07+00:00", "object_relation": "md5", "timestamp": "1784306066", "to_ids": true, "type": "md5", "uuid": "2c941ca7-5bba-4ea9-9dc5-8409a3592c84", "value": "ab2f2d242d0206b0ef29e74a1eb266c8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-16T18:36:00+00:00", "last_seen": "2026-03-23T21:09:07+00:00", "object_relation": "sha1", "timestamp": "1784305049", "to_ids": true, "type": "sha1", "uuid": "ee8ebb03-f8c4-4a5a-8135-78853ff02bc3", "value": "a04a16628e0c1a7774412986215b3970edf47cab", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-16T18:36:00+00:00", "last_seen": "2026-03-23T21:09:07+00:00", "object_relation": "sha256", "timestamp": "1784305049", "to_ids": true, "type": "sha256", "uuid": "db30ae8e-ce54-4a8e-a253-a675078820e8", "value": "0c0dc13805564d986b5eac6c5e8c90d336256fbb7f8a0c52180f1f5c690fe203", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-16T18:36:00+00:00", "last_seen": "2026-03-23T21:09:07+00:00", "object_relation": "text", "timestamp": "1784303288", "to_ids": false, "type": "text", "uuid": "eb2752be-cf12-41ca-9cbc-dbe15e65c5da", "value": "Type Description: RAR\nMicrosoft: None\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-03-16T18:36:00+00:00\nLast Submission: 2026-03-23T21:09:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-16T18:36:00+00:00", "last_seen": "2026-03-23T21:09:07+00:00", "object_relation": "ssdeep", "timestamp": "1784303288", "to_ids": true, "type": "ssdeep", "uuid": "ee6774e2-1c62-4540-a2b9-b4d2f599dfc9", "value": "393216:pCTVQ+vOc6hzBEywdA843AKEDSb/j8ku00nA4SpBqV:pCKEMhzTwdA1AK5cHpVQ8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-16T18:36:00+00:00", "last_seen": "2026-03-23T21:09:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303288", "to_ids": false, "type": "size-in-bytes", "uuid": "e0ef954a-cb82-43b6-8a48-be9944365904", "value": "18639579" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-16T18:36:00+00:00", "last_seen": "2026-03-23T21:09:07+00:00", "object_relation": "filename", "timestamp": "1784303288", "to_ids": true, "type": "filename", "uuid": "026a3302-84b2-4c1f-9e33-b2d7c4ca1259", "value": "linguist.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306087", "uuid": "bb26a512-f6f8-4d42-a3ac-965d07b52d63", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "md5", "timestamp": "1784306087", "to_ids": true, "type": "md5", "uuid": "b60ad1e6-2044-489d-95a7-e72e0b86477f", "value": "b79e88fd133a9931413acc769641760b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "sha1", "timestamp": "1784305051", "to_ids": true, "type": "sha1", "uuid": "c1d5d562-3a72-4ecd-b775-28205ec74c8a", "value": "5e8479009be21513112a380ef27cffc721eb1e94", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "sha256", "timestamp": "1784305051", "to_ids": true, "type": "sha256", "uuid": "b5fd947b-4231-4e63-82f6-e4c693293ff6", "value": "3e881c9663db5c80a0093f4b0f7008aa1e73866c57aa672e53b38274df4c2807", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 07/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "text", "timestamp": "1784303332", "to_ids": false, "type": "text", "uuid": "561bce39-1948-404a-a971-a91dad2aa3b5", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: Signed\nSigning date: 08:50 AM 04/30/2026\nSigners: RibbonSoft GmbH; Sectigo Public Code Signing CA R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/73\nFirst Submission: 2026-05-23T21:35:49+00:00\nLast Submission: 2026-05-23T21:35:49+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "creation-time", "timestamp": "1784303332", "to_ids": false, "type": "datetime", "uuid": "06593886-921b-4047-8707-eabadf51e892", "value": "2026-04-30T08:42:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "ssdeep", "timestamp": "1784303332", "to_ids": true, "type": "ssdeep", "uuid": "25524605-43bd-4e1a-aff4-dee9a1d5a171", "value": "6291456:Lo+f1DCn1nDpqFoiPL14Ae6NYYAxq4FlX7dR:Lt9Dond6oOL+Afsx3JR" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303332", "to_ids": false, "type": "size-in-bytes", "uuid": "640d1feb-ae16-43bb-9213-814548f6e314", "value": "239804416" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "vhash", "timestamp": "1784303332", "to_ids": true, "type": "vhash", "uuid": "d4decdb1-3b3c-4be3-b757-daf1526ef96e", "value": "7e50ba935f6b8ab0cdca2c69d8c1b29d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-23T21:35:49+00:00", "last_seen": "2026-05-23T21:35:49+00:00", "object_relation": "filename", "timestamp": "1784303332", "to_ids": true, "type": "filename", "uuid": "9a014277-3e4e-4fe1-a672-356e03d6dce9", "value": "qcad-3.32.7-pro-win64-qt6-installer.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306108", "uuid": "b1480a3e-65a3-49ec-81c7-169a4c68ff3c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "md5", "timestamp": "1784306108", "to_ids": true, "type": "md5", "uuid": "12e1551d-54ff-4ad6-a679-3c9a2ff201c5", "value": "9a7015530be1100dd935abe85c302ec5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "sha1", "timestamp": "1784305052", "to_ids": true, "type": "sha1", "uuid": "8a4c6d43-36c7-4e88-b865-89e62fb07ee1", "value": "6551d63ddcf77f1a240f822976d923900273e685", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "sha256", "timestamp": "1784305052", "to_ids": true, "type": "sha256", "uuid": "7186a906-668b-41c1-a585-78e94ce7b353", "value": "425501b6428e19536be925b4a286f73ae94270bc23ac516832ea27ba6c875998", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "text", "timestamp": "1784303354", "to_ids": false, "type": "text", "uuid": "03794f2d-c7bb-41b3-b69c-2745cf43548a", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.\nSigning date: 01:25 PM 04/10/2026\nSigners: DxO Lab\nMicrosoft: None\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-04-14T16:37:01+00:00\nLast Submission: 2026-04-17T10:39:31+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "creation-time", "timestamp": "1784303354", "to_ids": false, "type": "datetime", "uuid": "d1c44a34-1e04-42b6-9073-2ef14633d239", "value": "2026-04-10T13:25:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "ssdeep", "timestamp": "1784303354", "to_ids": true, "type": "ssdeep", "uuid": "3a873969-85c1-47ee-b5c0-ee3b6ea4e500", "value": "786432:ueXobjKspPu15wkrBph4exeLAgCqEFPh4s6pfoaA4cNV3s4JR1alF:XXYmsUJph2AuuP2npA84JXaD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303354", "to_ids": false, "type": "size-in-bytes", "uuid": "e495beab-1403-4be0-9e9a-31bd6b1fa4d6", "value": "29241344" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "vhash", "timestamp": "1784303354", "to_ids": true, "type": "vhash", "uuid": "ae2c12ca-7042-4e35-abb5-c5beeec771e4", "value": "32fe66a890dbb4ef39f48ef6ec4a5e8d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-14T16:37:01+00:00", "last_seen": "2026-04-17T10:39:31+00:00", "object_relation": "filename", "timestamp": "1784303354", "to_ids": true, "type": "filename", "uuid": "ad8e5b68-10b4-4fff-9567-8913c9067661", "value": "UserID84593257" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306130", "uuid": "1fd356a3-022a-4206-89ee-2a204feb96c9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "md5", "timestamp": "1784306130", "to_ids": true, "type": "md5", "uuid": "b36780c5-3246-4595-a68a-75aef73bebe4", "value": "0391cc7f5e979b36d82a3f3ebe00f4dd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "sha1", "timestamp": "1784305053", "to_ids": true, "type": "sha1", "uuid": "8a0d4c7e-2329-428d-92d8-a05aeed7cf77", "value": "7f516d2214e98d6119a3614649d850fc942b6fcb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "sha256", "timestamp": "1784305053", "to_ids": true, "type": "sha256", "uuid": "65f6d9d4-d0ec-4b12-8d91-f3c226397244", "value": "5c6144b1bb4c195a4dcd7ebac8c427852c7e15cb5b4f5217dda0cfb39a90062a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "text", "timestamp": "1784303375", "to_ids": false, "type": "text", "uuid": "50c19e57-850b-4bb9-925e-d343df95dfe3", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.\nSigning date: 06:37 PM 05/04/2026\nSigners: XnView Contributors\nMicrosoft: None\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-05-07T22:55:23+00:00\nLast Submission: 2026-07-11T00:38:36+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "creation-time", "timestamp": "1784303375", "to_ids": false, "type": "datetime", "uuid": "246836f7-c9e7-4ce5-a32a-bae01f8611ab", "value": "2026-05-04T18:36:40+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "ssdeep", "timestamp": "1784303375", "to_ids": true, "type": "ssdeep", "uuid": "711d21f9-cc12-4f00-a1a8-587a67cee5c6", "value": "786432:zaFkTLQtQdL+J/2f4Hw+5kh3Br/G8JWOgLJ6DuPUXoK0kox:zQntQdL0eywGOBTGM1Ohmr0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303375", "to_ids": false, "type": "size-in-bytes", "uuid": "a7341b11-4c75-4adc-a643-951684929307", "value": "35729408" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "vhash", "timestamp": "1784303375", "to_ids": true, "type": "vhash", "uuid": "f42cca62-cd6e-4763-9032-04d5a1ad3faa", "value": "32fe66a890dbb4ef39f48ef6ec4a5e8d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-07T22:55:23+00:00", "last_seen": "2026-07-11T00:38:36+00:00", "object_relation": "filename", "timestamp": "1784303375", "to_ids": true, "type": "filename", "uuid": "cfbbbbf1-0213-4edb-ac18-536d33c220d7", "value": "5c6144b1bb4c195a4dcd7ebac8c427852c7e15cb5b4f5217dda0cfb39a90062a.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306151", "uuid": "552f13e7-e228-4a19-8120-f29d205041a9", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "md5", "timestamp": "1784306151", "to_ids": true, "type": "md5", "uuid": "b92543c9-03ee-4cb9-85d3-ceb12a7bbbd4", "value": "72018dbb62d4b6b74ee2fadb2ff1017e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "sha1", "timestamp": "1784305054", "to_ids": true, "type": "sha1", "uuid": "64a2077f-cf03-4ed1-9546-26a6a28b4a53", "value": "7226b1058948683d91d191ffab662dd80aad60e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "sha256", "timestamp": "1784305054", "to_ids": true, "type": "sha256", "uuid": "06383ca8-813d-485a-9444-8fdaa1dd58f5", "value": "71f19394bf15ae47b668fcbe13d0fe4d46d8c06ce004eeccf82c8d1770bba558", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 12/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "text", "timestamp": "1784303398", "to_ids": false, "type": "text", "uuid": "10121635-c262-4c27-9ef5-d584667070b6", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: Signed\nSigning date: 02:46 PM 03/26/2026\nSigners: DOCUNIZE GmbH; Microsoft ID Verified CS AOC CA 01; Microsoft ID Verified Code Signing PCA 2021; Microsoft Identity Verification Root Certificate Authority 2020\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-05-13T11:53:48+00:00\nLast Submission: 2026-05-15T08:17:06+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "creation-time", "timestamp": "1784303398", "to_ids": false, "type": "datetime", "uuid": "5daa6ff1-269b-4bf8-88fe-0fa018a72f5a", "value": "2026-03-26T14:46:20+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "ssdeep", "timestamp": "1784303398", "to_ids": true, "type": "ssdeep", "uuid": "f0c612d1-2b9d-4a73-b61f-f46f7733444a", "value": "1572864:2x6gqEi81QxvRDkeS2kpUOmrmRcgS1LHGE:2x6ii81QxphLkpp4m" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303398", "to_ids": false, "type": "size-in-bytes", "uuid": "8f3b92cb-d1da-4993-9ca5-a0ce3ebbfcc8", "value": "56946688" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "vhash", "timestamp": "1784303398", "to_ids": true, "type": "vhash", "uuid": "5c47f1ba-41be-497d-ada4-1ce6a8aa81f9", "value": "32fe66a890dbb4ef39f48ef6ec4a5e8d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T11:53:48+00:00", "last_seen": "2026-05-15T08:17:06+00:00", "object_relation": "filename", "timestamp": "1784303398", "to_ids": true, "type": "filename", "uuid": "9f73327b-450c-4325-8dbc-7178b8523b29", "value": "Docunize.Setup.Cloud.x64.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306172", "uuid": "55c35d48-ba54-4058-9b70-e524b0c44385", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "md5", "timestamp": "1784306172", "to_ids": true, "type": "md5", "uuid": "007e6241-1df6-4529-b3d1-25e81498a0f6", "value": "564225ac669e086ae672d70660e04a32", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "sha1", "timestamp": "1784305055", "to_ids": true, "type": "sha1", "uuid": "260ab0e0-9620-45f3-bc8d-bdfe45aabd89", "value": "47e6480a471f4a53b27005cf72c2f0319c65e3b0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "sha256", "timestamp": "1784305056", "to_ids": true, "type": "sha256", "uuid": "c93fface-ff81-41f4-a9bd-ac088faf2e6a", "value": "7eb345c26a1b827e7b2ef5b7881cb406b04b056ebc36cc92e3f7643decd2671f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "text", "timestamp": "1784303420", "to_ids": false, "type": "text", "uuid": "03124f35-8aff-4b1c-a89f-089f90b258a7", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.\nSigning date: 06:13 PM 04/09/2026\nSigners: DxO Labs\nMicrosoft: None\nClamAV: None\nVT Total Detection: 34/74\nFirst Submission: 2026-04-10T17:21:43+00:00\nLast Submission: 2026-04-10T17:21:43+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "creation-time", "timestamp": "1784303420", "to_ids": false, "type": "datetime", "uuid": "ce4490fd-a948-469f-b481-2296d2cc9210", "value": "2026-04-09T18:12:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "ssdeep", "timestamp": "1784303420", "to_ids": true, "type": "ssdeep", "uuid": "04537ca9-97e4-4121-af80-84d2cf3703b0", "value": "786432:tee25Gh2q6fthijmAYf7E3318QBcM8stOxhs7u6KvKDsd1P:w9UynwH1xO5st1K6KC41P" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303420", "to_ids": false, "type": "size-in-bytes", "uuid": "01290717-c217-4e94-be4d-775610025272", "value": "29790208" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "vhash", "timestamp": "1784303420", "to_ids": true, "type": "vhash", "uuid": "8c1dd79a-76d4-43b9-a79f-c1b3d9f97026", "value": "32fe66a890dbb4ef39f48ef6ec4a5e8d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-10T17:21:43+00:00", "last_seen": "2026-04-10T17:21:43+00:00", "object_relation": "filename", "timestamp": "1784303420", "to_ids": true, "type": "filename", "uuid": "9d4cd1c5-a285-4da7-b803-f35d59d959cd", "value": "tist.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306193", "uuid": "572ce647-aa00-4fd1-861d-2cda8dde79a7", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "object_relation": "md5", "timestamp": "1784306193", "to_ids": true, "type": "md5", "uuid": "d1092a0a-989d-4f82-a2f8-3b660fb9aab4", "value": "a17a14e20f89110dfe9ad4da085fff7a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "object_relation": "sha1", "timestamp": "1784305057", "to_ids": true, "type": "sha1", "uuid": "00254c3b-8aa6-42d1-99e2-9b51aef5b07e", "value": "a13f2427eaca13b969b6f2ba109f194d19d8fa9f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "object_relation": "sha256", "timestamp": "1784305057", "to_ids": true, "type": "sha256", "uuid": "9a716e30-d5bf-4387-b59c-2b797f26d038", "value": "91255813151e6fb3d2a45e088490214c110ff035bbd1ee01ff430782868c77b3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "object_relation": "text", "timestamp": "1784303462", "to_ids": false, "type": "text", "uuid": "435462bc-d1f3-4838-b7f9-420cf533c19a", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-04-06T19:41:56+00:00\nLast Submission: 2026-04-08T10:29:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "object_relation": "ssdeep", "timestamp": "1784303462", "to_ids": true, "type": "ssdeep", "uuid": "356778c8-339d-4b9f-9b08-53c4fdd28094", "value": "1572864:4We6YPZoJh4I3OBrUy53JYkGl+GX90hbCGIVgfEcR7W+K7Fk:4J6YBoT4COTVeplDXeOG3fHRSRk" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303462", "to_ids": false, "type": "size-in-bytes", "uuid": "dcc9c19d-fd2a-45a7-820b-2acf8a56f054", "value": "61000339" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "object_relation": "vhash", "timestamp": "1784303462", "to_ids": true, "type": "vhash", "uuid": "303ef02a-5a80-4864-babd-295b6fdfc2ca", "value": "f89b7a8d5e64facf27db7098d8e8280f" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-06T19:41:56+00:00", "last_seen": "2026-04-08T10:29:45+00:00", "object_relation": "filename", "timestamp": "1784303462", "to_ids": true, "type": "filename", "uuid": "e505f3f7-357b-4a55-8db3-c2934d77d5f0", "value": "JSON.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306214", "uuid": "13e79258-5dfa-4edb-9721-4349bbb07f8c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "md5", "timestamp": "1784306214", "to_ids": true, "type": "md5", "uuid": "d6e43fa9-3620-4bcd-aebd-4260eb9d2b92", "value": "b42854b7d8f7f27771ef4b97a61c94a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "sha1", "timestamp": "1784305058", "to_ids": true, "type": "sha1", "uuid": "581ddb73-095b-4218-bfee-244dc0c5ecb3", "value": "2243b21636f705acc327d26e06ff26bfdf3a6e6d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "sha256", "timestamp": "1784305058", "to_ids": true, "type": "sha256", "uuid": "e68ba3fe-3be7-49dc-9b82-b101dd4e310b", "value": "9a736f4812b485f9cf5b1332a791b205b5135a4b3a0c41f473ad9cc9fbe2d75c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "text", "timestamp": "1784303505", "to_ids": false, "type": "text", "uuid": "eb5b70f6-04aa-461f-aff6-985119a5748c", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.\nSigning date: 01:56 PM 04/09/2026\nSigners: OBS Studio Community\nMicrosoft: None\nClamAV: None\nVT Total Detection: 29/74\nFirst Submission: 2026-04-16T18:49:14+00:00\nLast Submission: 2026-04-16T18:49:14+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "creation-time", "timestamp": "1784303505", "to_ids": false, "type": "datetime", "uuid": "d152c9f4-ae1a-4adb-9979-ead0c610f7a6", "value": "2026-04-09T13:55:48+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "ssdeep", "timestamp": "1784303505", "to_ids": true, "type": "ssdeep", "uuid": "85484daf-8e6f-498f-a7fa-61767726124a", "value": "786432:TQylGAYI/Z1RjNGuAe/lilbHp7bgqpBu/6nLQGtSc0xZ/KAucZv:TjlGAYK1x4zpxi6LHnYQAB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303505", "to_ids": false, "type": "size-in-bytes", "uuid": "98c41b9e-a7d7-4cb1-8727-cfde426d3c51", "value": "36663296" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "vhash", "timestamp": "1784303505", "to_ids": true, "type": "vhash", "uuid": "4e8f862f-886a-450a-8c68-8005ede85299", "value": "32fe66a890dbb4ef39f48ef6ec4a5e8d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-16T18:49:14+00:00", "last_seen": "2026-04-16T18:49:14+00:00", "object_relation": "filename", "timestamp": "1784303505", "to_ids": true, "type": "filename", "uuid": "15cd3599-b4cd-4184-ad45-1c2c6447c8e8", "value": "1aca351f.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306236", "uuid": "52036913-c973-48c3-882f-73e039727b7a", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "md5", "timestamp": "1784306236", "to_ids": true, "type": "md5", "uuid": "95262633-a181-4793-9dd6-8d083416a8e6", "value": "96a500e229c949126c76ece63b462783", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "sha1", "timestamp": "1784305059", "to_ids": true, "type": "sha1", "uuid": "6dfe4033-7da4-4c1a-b405-feb293b9e9d7", "value": "f881e865170a98d656424d293b2e9b430fc4c990", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "sha256", "timestamp": "1784305059", "to_ids": true, "type": "sha256", "uuid": "fb3683e7-a002-4d8e-bd85-e60a559b3527", "value": "a8a2148d6cf70d06a9c2ecded8b1a21f982cf11ffc9774442209f536a66a8630", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "text", "timestamp": "1784303526", "to_ids": false, "type": "text", "uuid": "27bc27f8-e250-43c5-b02d-a3aafa6054c0", "value": "Type Descriptio%WINDIR%\\Installer\nVerified: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.\nSigning date: 05:59 PM 05/11/2026\nSigners: Veritas Technologies\nMicrosoft: None\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-05-13T12:26:36+00:00\nLast Submission: 2026-07-11T00:41:04+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "creation-time", "timestamp": "1784303526", "to_ids": false, "type": "datetime", "uuid": "788e2c9e-25c9-4d9b-91fb-22557d76aa37", "value": "2026-05-11T17:59:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "ssdeep", "timestamp": "1784303526", "to_ids": true, "type": "ssdeep", "uuid": "0bcd92f0-13aa-4528-89c4-c06645d11262", "value": "196608:FaXCT4MrSlx/UatPxv4/iSZ06W49kb7UBLw1508am+LCmggnYBiuCDmw46+:FaaF+D/7PxIi4274wY8atLCJgYkuCT+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303526", "to_ids": false, "type": "size-in-bytes", "uuid": "a6b8a6d2-7408-427e-8dff-0d3ac983ff86", "value": "11997184" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "vhash", "timestamp": "1784303526", "to_ids": true, "type": "vhash", "uuid": "9b5b6a00-9803-42e6-9980-3d344e26883e", "value": "32fe66a890dbb4ef39f48ef6ec4a5e8d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-13T12:26:36+00:00", "last_seen": "2026-07-11T00:41:04+00:00", "object_relation": "filename", "timestamp": "1784303526", "to_ids": true, "type": "filename", "uuid": "d38d8c31-ba9a-41ca-91a5-5adb2b77dd5f", "value": "a8a2148d6cf70d06a9c2ecded8b1a21f982cf11ffc9774442209f536a66a8630.msi" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-24T14:38:42+00:00", "last_seen": "2026-04-09T13:24:35+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306257", "uuid": "37195360-883f-4c12-b544-bb96ca2907dd", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-24T14:38:42+00:00", "last_seen": "2026-04-09T13:24:35+00:00", "object_relation": "md5", "timestamp": "1784306257", "to_ids": true, "type": "md5", "uuid": "0a586ad6-0b1e-4194-9255-152d37a31017", "value": "b388dc84647810d29aa04d826c17a302", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-24T14:38:42+00:00", "last_seen": "2026-04-09T13:24:35+00:00", "object_relation": "sha1", "timestamp": "1784305060", "to_ids": true, "type": "sha1", "uuid": "46f2d266-4747-4419-81fb-34da5cadaddc", "value": "4a6e1f0105fe642c50e28cbae91999ab02edcdad", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-24T14:38:42+00:00", "last_seen": "2026-04-09T13:24:35+00:00", "object_relation": "sha256", "timestamp": "1784305061", "to_ids": true, "type": "sha256", "uuid": "d86b611b-44bc-44ca-bde0-6d6189d2252d", "value": "c92950568a2b757d4ee0bad84b33f5b3414f0d5fdf3d3f5b06e7d304a7ccf1a1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-24T14:38:42+00:00", "last_seen": "2026-04-09T13:24:35+00:00", "object_relation": "text", "timestamp": "1784303547", "to_ids": false, "type": "text", "uuid": "cf87c426-d1c1-4247-900d-afee9c7785ca", "value": "Type Description: unknown\nMicrosoft: None\nClamAV: None\nVT Total Detection: 31/74\nFirst Submission: 2026-03-24T14:38:42+00:00\nLast Submission: 2026-04-09T13:24:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-24T14:38:42+00:00", "last_seen": "2026-04-09T13:24:35+00:00", "object_relation": "ssdeep", "timestamp": "1784303547", "to_ids": true, "type": "ssdeep", "uuid": "4fbdd9d9-12cf-4c51-bfd7-f0a68733337f", "value": "1536:0JvV1GSeLGYdWq0P/yim/1y1ejY6yFOB:BSeL1K/yjgf6yFOB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-24T14:38:42+00:00", "last_seen": "2026-04-09T13:24:35+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303547", "to_ids": false, "type": "size-in-bytes", "uuid": "89486093-76ac-40f1-a7a4-b18cea28c80c", "value": "53323" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-24T14:38:42+00:00", "last_seen": "2026-04-09T13:24:35+00:00", "object_relation": "filename", "timestamp": "1784303547", "to_ids": true, "type": "filename", "uuid": "9446ab79-ac95-4dcb-bad7-5bdeab6e3e72", "value": "my_l .bin" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306278", "uuid": "d9b457fb-bd21-4c2e-a7ed-e9c5cadd2d50", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "md5", "timestamp": "1784306278", "to_ids": true, "type": "md5", "uuid": "160df145-8f2e-4e3e-96fc-3f2d0ef561d4", "value": "7a323f4c80cf4962fe2e79e91e7a2287", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "sha1", "timestamp": "1784305062", "to_ids": true, "type": "sha1", "uuid": "c00a0472-8baa-4b0d-9716-c4312abd1163", "value": "8ed98ab169b91d5b989b7fffe17cd8f936cfe130", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "sha256", "timestamp": "1784305062", "to_ids": true, "type": "sha256", "uuid": "bc697f1c-8715-4154-84cc-7bdedf0e16f7", "value": "dcd612f1d86ff5c9b43f1a3d0baea16b9c08e4b844bcd82564c720ee1caafe3c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 08/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "text", "timestamp": "1784303590", "to_ids": false, "type": "text", "uuid": "5c05687c-39af-43a6-84be-3b1a92f1c6f9", "value": "Type Description: Win32 EXE\nMicrosoft: Trojan:Win64/PureLogs.DVN!MTB\nClamAV: None\nVT Total Detection: 52/73\nFirst Submission: 2026-04-20T09:23:58+00:00\nLast Submission: 2026-05-04T07:13:38+00:00" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "creation-time", "timestamp": "1784303590", "to_ids": false, "type": "datetime", "uuid": "d8a77f6a-00a1-4fa3-93d1-0131658451b8", "value": "2026-04-07T08:58:24+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "ssdeep", "timestamp": "1784303590", "to_ids": true, "type": "ssdeep", "uuid": "cebc322a-e79b-475e-863a-3d9e895841ae", "value": "3072:cJOobBT2UE5iRUcBOQjmN4vvnOjIBDMbgiAkINpNhdxjK/+lsamiNqfbdTHFbaai:czTM5H5QjmqvSIBaAkImtaQRHFbwP" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303590", "to_ids": false, "type": "size-in-bytes", "uuid": "dfa555ba-2f32-426b-9547-b5982db8307a", "value": "357888" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "vhash", "timestamp": "1784303590", "to_ids": true, "type": "vhash", "uuid": "2a539c44-a4ed-4933-bebd-a78a85a9d30b", "value": "035076655d555d05151az449z5tz" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-20T09:23:58+00:00", "last_seen": "2026-05-04T07:13:38+00:00", "object_relation": "filename", "timestamp": "1784303590", "to_ids": true, "type": "filename", "uuid": "271d5c0a-0f4f-43b0-ac36-416cea9395df", "value": "my_s.bin" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306300", "uuid": "937780b5-1d39-4c43-a72e-57b5156a388e", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "object_relation": "md5", "timestamp": "1784306300", "to_ids": true, "type": "md5", "uuid": "f428e653-ddf8-4190-af78-b5d5c1ce28a7", "value": "5bc96a16c9e7c511daf601fddb32b9c6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "object_relation": "sha1", "timestamp": "1784305063", "to_ids": true, "type": "sha1", "uuid": "a14cd7ea-7ec6-415e-b581-8eb67d543240", "value": "e3d14db5f451eddb11fb628ee247e38451e95718", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "object_relation": "sha256", "timestamp": "1784305063", "to_ids": true, "type": "sha256", "uuid": "0d76e17e-48e0-4cea-992a-b2728b64d90b", "value": "e38550a29e4ff48d8cd4df5ab34a88b9b28f23d50e66129c896689cd334849a9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "object_relation": "text", "timestamp": "1784303611", "to_ids": false, "type": "text", "uuid": "06a552d5-7d8c-4dd8-be90-937a82bb2986", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 28/74\nFirst Submission: 2026-03-30T16:16:22+00:00\nLast Submission: 2026-03-30T16:16:22+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "object_relation": "ssdeep", "timestamp": "1784303611", "to_ids": true, "type": "ssdeep", "uuid": "fc8fb5cd-491b-4934-a990-6579a3365fe8", "value": "786432:lQSfIkufGv5e+TOjOvSBDhYXbrOeEzwEQkE:lQzhGMBwr5EzwEQH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303611", "to_ids": false, "type": "size-in-bytes", "uuid": "6d69e7a1-adc0-40b7-b71d-25d998cd4d44", "value": "29137735" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "object_relation": "vhash", "timestamp": "1784303611", "to_ids": true, "type": "vhash", "uuid": "7d0d3a17-49f5-4c96-9ec5-cdd21117cfd7", "value": "b19b1e3de2ba8c4766dd2e6ed81a9354" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-30T16:16:22+00:00", "last_seen": "2026-03-30T16:16:22+00:00", "object_relation": "filename", "timestamp": "1784303611", "to_ids": true, "type": "filename", "uuid": "e5f882ab-d736-4fe6-984a-72b9df6b34ec", "value": "linguist.zip" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784306321", "uuid": "056e1c7b-1c55-45b9-b3b4-aa9c8d4d2c12", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "object_relation": "md5", "timestamp": "1784306321", "to_ids": true, "type": "md5", "uuid": "92fd5c73-7889-42c7-b8bf-5c3b83504940", "value": "62e2316f2d053228f64f1a3028de850e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "object_relation": "sha1", "timestamp": "1784305064", "to_ids": true, "type": "sha1", "uuid": "16710481-3d41-422e-805d-e3f421dda689", "value": "d587f24f720c2e604f3d9e740699d6518c04cd92", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "object_relation": "sha256", "timestamp": "1784305064", "to_ids": true, "type": "sha256", "uuid": "18ae9021-20d3-41f7-bf39-f2f021f02547", "value": "fa25acfac32c557f809ab544764d4348f31cf9909ad9d512883d6cba8369ba88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 17/07/2026\nLast-scan: 15/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "object_relation": "text", "timestamp": "1784303633", "to_ids": false, "type": "text", "uuid": "39e82137-b066-4a79-91aa-7405808fe45a", "value": "Type Description: ZIP\nMicrosoft: None\nClamAV: None\nVT Total Detection: 23/74\nFirst Submission: 2026-04-08T22:02:31+00:00\nLast Submission: 2026-04-08T22:02:31+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "object_relation": "ssdeep", "timestamp": "1784303633", "to_ids": true, "type": "ssdeep", "uuid": "0b657e0d-0aac-4eb7-93cd-41de359c2203", "value": "786432:qK+K61AiHeBNJ3OsC3VVrrnjUJ9Wg46uGsLuH7XTC4LWbBM5P:qHK61AWeBP3fC3vcH41GDH7XTpL" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "object_relation": "size-in-bytes", "timestamp": "1784303633", "to_ids": false, "type": "size-in-bytes", "uuid": "268b1865-0c70-46e7-9541-c3078b9b192c", "value": "33808111" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "object_relation": "vhash", "timestamp": "1784303633", "to_ids": true, "type": "vhash", "uuid": "8a46e495-cb37-4f00-b768-6c454abcc428", "value": "c5aade1cfe482f49fe08b3f08622a1d1" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-08T22:02:31+00:00", "last_seen": "2026-04-08T22:02:31+00:00", "object_relation": "filename", "timestamp": "1784303633", "to_ids": true, "type": "filename", "uuid": "196a3fa4-d49c-47a2-a9cc-36d6e199df80", "value": "coreldesigner.zip" } ] } ] } }