{ "Event": { "analysis": "1", "date": "2026-07-07", "extends_uuid": "", "info": "[Threat Intel] Continues building ORB networks using new malware", "protected": false, "publish_timestamp": "1784349317", "published": true, "threat_level_id": "2", "timestamp": "1784349317", "uuid": "b6cb9d3b-b93e-443c-9c7f-efe8fbf9103a", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#7c6ad9", "local": false, "name": "misp-galaxy:producer=\"Cisco Talos Intelligence Group\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#e7d48a", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Owner/User Discovery - T1033\"", "relationship_type": "" }, { "colour": "#72ee33", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"", "relationship_type": "" }, { "colour": "#7d7034", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"", "relationship_type": "" }, { "colour": "#68f2ff", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Data from Local System - T1005\"", "relationship_type": "" }, { "colour": "#a92e1c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"", "relationship_type": "" }, { "colour": "#9feaf0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"", "relationship_type": "" }, { "colour": "#75ec20", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"", "relationship_type": "" }, { "colour": "#43c8db", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"", "relationship_type": "" }, { "colour": "#657ac3", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Protocol Tunneling - T1572\"", "relationship_type": "" }, { "colour": "#423494", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify System Firewall - T1562.004\"", "relationship_type": "" }, { "colour": "#adf1b0", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"", "relationship_type": "" }, { "colour": "#0c0051", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "relationship_type": "" }, { "colour": "#dac154", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"System Network Connections Discovery - T1049\"", "relationship_type": "" }, { "colour": "#7628f7", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"", "relationship_type": "" }, { "colour": "#ad5a96", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Hijack Execution Flow - T1574\"", "relationship_type": "" }, { "colour": "#f07d7c", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"", "relationship_type": "" }, { "colour": "#e08bb2", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"", "relationship_type": "" }, { "colour": "#356c41", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"", "relationship_type": "" }, { "colour": "#e12cbc", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"", "relationship_type": "" }, { "colour": "#92e858", "local": false, "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#110041", "local": false, "name": "rectifyq:sub-category=\"malware-analysis\"", "relationship_type": "" }, { "colour": "#120046", "local": false, "name": "rectifyq:sub-category=\"infra-profile\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#55acee", "local": false, "name": "rectifyq:MY-relevancy=\"potentially-relevant\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"china\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Linux\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"UNIX\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:operating-system=\"Windows\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:threat-actor=\"UAT-5918\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:tool=\"Netcat\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "link", "uuid": "856855e5-7e89-4253-8b34-7a469b009d44", "value": "https://blog.talosintelligence.com/uat-7810/" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "text", "uuid": "59d87759-9049-480c-8d3c-6ccfbcd03f12", "value": "An advanced persistent threat actor designated UAT-7810 maintains and expands the LapDogs Operational Relay Box network infrastructure. This China-nexus group develops custom malware including SHORTLEASH and its evolved version LONGLEASH, alongside newly discovered tools DOGLEASH (a C-based backdoor), JARLEASH (a JAVA-based administrative backdoor), and LEASHTEST (a testing binary for MIPS devices). The actor exploits known vulnerabilities in unpatched Ruckus wireless routers and ASUS AiCloud devices, targeting networking equipment across multiple hardware platforms including MIPS, ARM, and x64. UAT-7810 establishes relay networks that secondary threat actors leverage for attacks against high-value targets. Infrastructure analysis reveals four command servers hosting malicious payloads, with one located in Hong Kong and others associated with VPS instances across multiple countries." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "text", "uuid": "d3306e4f-ee93-4670-80b1-5f178efc23e0", "value": "Name: Continues building ORB networks using new malware\nAuthor: AlienVault\nAdversary: UAT-7810\nTags: [\"leashtest\", \"shortleash\", \"cve-2020-22653\", \"cve-2020-22658\", \"backdoor\", \"longleash\", \"china-nexus\", \"dogleash\", \"cve-2025-2492\", \"uat-7810\", \"ruckus routers\", \"jarleash\", \"cve-2023-25717\", \"orb networks\"]\nTgtd countries: []\nMlwr families: [\"SHORTLEASH\", \"LONGLEASH\", \"DOGLEASH\", \"JARLEASH\", \"LEASHTEST\"]\nAttack_ids: [\"T1033\", \"T1056.001\", \"T1082\", \"T1005\", \"T1140\", \"T1190\", \"T1036\", \"T1055\", \"T1572\", \"T1562.004\", \"T1090\", \"T1083\", \"T1049\", \"T1059.004\", \"T1574\", \"T1571\", \"T1027\", \"T1573\", \"T1095\", \"T1071.001\"]\nIndustries: []" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1784333443", "to_ids": false, "type": "threat-actor", "uuid": "d5501e2c-ea3d-4a9c-8ec3-72cf6240e56d", "value": "UAT-7810", "Tag": [ { "colour": "#7c6ad9", "local": false, "name": "misp-galaxy:producer=\"Cisco Talos Intelligence Group\"", "relationship_type": "" } ] }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "vulnerability", "uuid": "05530b0a-9015-4368-acc3-b3d5a150b588", "value": "CVE-2020-22653" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "vulnerability", "uuid": "6e9ffd17-73c0-42f0-9a33-9948f14d3c52", "value": "CVE-2020-22658" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "vulnerability", "uuid": "82d09a24-c262-4f65-98bb-c680e194ea4d", "value": "CVE-2023-25717" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "vulnerability", "uuid": "ba6c3090-ed57-4d64-92f8-ed50d6d57acc", "value": "CVE-2025-2492" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "vulnerability", "uuid": "373411ba-93e9-46ec-b482-97dc48b634cb", "value": "CVE-2025-20333" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1783652428", "to_ids": false, "type": "vulnerability", "uuid": "c0baf5e5-b5f5-4776-b172-f73e1a908d14", "value": "CVE-2025-20362" }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344535", "to_ids": true, "type": "sha256", "uuid": "7945119b-76a7-4fbb-a02f-183f0366b955", "value": "0352f3e338261d98895df4c7b7a76b296485b2290c72bce56603351d167d0601", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344536", "to_ids": true, "type": "sha256", "uuid": "65f8cfd8-9a53-4619-9708-ef868dc958e5", "value": "03926e3da998f32ad898b640bd15cf145768f9e849e6f18d81350234254c424e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344537", "to_ids": true, "type": "sha256", "uuid": "b966b0d2-073a-41b6-b5ec-1a172a1cbeff", "value": "08701ed7975bf4f5688c2724d27ab497764200ad6f4dc53d3cc03b170378ced0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344538", "to_ids": true, "type": "sha256", "uuid": "cc4370dc-5030-4e5a-a3fd-db8064f4cf35", "value": "0a8555a71868749be8c905ed53296ce335af50a9262772b5e154ad3f9c35c2e4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344539", "to_ids": true, "type": "sha256", "uuid": "9d950323-0885-46f5-b766-cc0958e01547", "value": "0a8cae96e25e85c612b0736fe886f9b124ad70ec425bc2ec1a8a4135b25436ba", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344541", "to_ids": true, "type": "sha256", "uuid": "e057afa9-3f86-4558-90c7-6e277838c527", "value": "0af4c52a1d13e4132a1843ce7727abcf0ddd4d1ca6a4b17cdf599ec3f355c241", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344541", "to_ids": true, "type": "sha256", "uuid": "08aa96c9-6cd9-44de-b348-46e86ce52689", "value": "13acadb3541e75af50e02d5be56c2238b93d8f154ce5514be1558e6ee59a1432", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344542", "to_ids": true, "type": "sha256", "uuid": "2825dd17-424a-4bfb-8dd8-50224f553f53", "value": "1660536f448b8b9f086ce9ea3ce4e9deefc59a76711ea53ee6d8f08fc8c1bb99", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344543", "to_ids": true, "type": "sha256", "uuid": "e90bc3e1-e1b2-4f5d-8899-30b49dd8635f", "value": "16971f9706d70ac4925651c7c8719b9d77aff63e4c0a618129efc32c2c46b989", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344544", "to_ids": true, "type": "sha256", "uuid": "e84a4723-f598-4056-a72b-23693597869b", "value": "20fcba222f74dd68aaeb1f0ad30cdf702a828ee164a182b30d05d600c35b72d9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344546", "to_ids": true, "type": "sha256", "uuid": "a4c199a7-0936-4cf6-8f91-678085b26000", "value": "29686c933cec1e274467e2dae264625ae6f754824bb7f550bc9c3131f625562c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344547", "to_ids": true, "type": "sha256", "uuid": "62966d95-b52b-4dc0-93e8-e161523016ac", "value": "2e0e43776e2e1a37d882a1b2ebb7d337ee88950177e43831dae645a367824feb", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344548", "to_ids": true, "type": "sha256", "uuid": "720bf940-9d84-443d-8326-c947e1e32f91", "value": "2ebc1b6cf543e2cb3f22d9a5b54b6676bb71dde98df7532f8791297734e44fdd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344548", "to_ids": true, "type": "sha256", "uuid": "a5b154e2-ff22-4d91-b392-f5e4ee5176e5", "value": "3169a6dbcce684e2c5a2f166996b58ffa673df6e58b8edf2bdf3e66271c8c69e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344550", "to_ids": true, "type": "sha256", "uuid": "e25be3d9-ca02-42d9-bdbd-3e0e4215d1ce", "value": "323c3a91be60ebc3e06e942bad04899a15911cea23269e43d07829164b2ce5d4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344551", "to_ids": true, "type": "sha256", "uuid": "14fbbc31-5c0f-4ca5-820f-f6e3360856dd", "value": "33c10b77e1da9f0679023d55fb3057879d15609db9c1d46ee5c3ff1240a3d052", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344552", "to_ids": true, "type": "sha256", "uuid": "551053f3-3496-4920-877a-4c8e287b4caa", "value": "3d296af7f29c0425655bd1cc0be48fe4aba52ee6760a89e805ca2589f4ef4d77", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344552", "to_ids": true, "type": "sha256", "uuid": "0dbb4507-a72a-47fd-a64a-06f0b4d8677b", "value": "3fcaa3038e365b6ab0b121e2cd319c56b74e37381943a0da0e8dce407087cdb8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344553", "to_ids": true, "type": "sha256", "uuid": "18abde93-b457-4ece-9153-618f5e78be34", "value": "4130f49fa81a699a667cafdbd6d1f6e781edd686c947eb8ae27134f6dc2c43d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344555", "to_ids": true, "type": "sha256", "uuid": "122a2372-4b5c-4032-b270-37b9b0156e33", "value": "52b871429833e1dee348263844efb531f6a3fcd321f88dc8a876caaee912cedd", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344556", "to_ids": true, "type": "sha256", "uuid": "120d5031-8c74-45a7-9a2b-c6d677a6c931", "value": "534a4a5bff2609a2d6e088cb87465c08c2d69c6aaa7d2ffcbcd491274b8505f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344556", "to_ids": true, "type": "sha256", "uuid": "77658ce0-82f7-4c2e-b834-f533a9781587", "value": "53ac2b231c23d41234e55b1f7ed89f86234f785adbbe820959655d7b019d7df9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344557", "to_ids": true, "type": "sha256", "uuid": "e73b5d64-21bb-4893-b999-9e373df4d8ea", "value": "5c3f190571645c4641dcff2c07a4c3ab9acad06aa9607350a385729d8d6139f1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344558", "to_ids": true, "type": "sha256", "uuid": "77681097-7f7f-4221-acf0-932c420bbc0a", "value": "5db2ce9acd50f96d566e8d139f6490abf2bbf7a9293b876eeb4598fd2c37c515", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344558", "to_ids": true, "type": "sha256", "uuid": "40b5eb8b-2b1a-4ea6-a3a3-061bbbd9b93f", "value": "5dbfa033676b5caacfae902734ce462cd871181eefbe299250ca8ac7e139719e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344559", "to_ids": true, "type": "sha256", "uuid": "1f8d2d50-d18a-4ef9-9549-f2b5d6ca0917", "value": "5e225ea2648a8cba0fd94ec7fd8ce5315f5d0cc2922bafc9db3c8c41280e917c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344559", "to_ids": true, "type": "sha256", "uuid": "da0b5401-7b40-47e3-a4a1-ad598e67a05f", "value": "5eab4c61baa67ae2838a36c2e6ff0476a8f2117b96a7027b830c8cb46ce78efc", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344561", "to_ids": true, "type": "sha256", "uuid": "de269926-5db3-49b7-a7a9-b8edd5194649", "value": "5faea1650cac0f3ffd2dc1fb220182095a46e34158967d37c2a942e85e2ca97b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344562", "to_ids": true, "type": "sha256", "uuid": "4cab700c-6916-4320-b01e-87803ca4df71", "value": "604b53f87d6c070bf387e80c70a6df8d272fa3fc143148d41f13e59d52ab1f13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344563", "to_ids": true, "type": "sha256", "uuid": "c65a5f78-bc43-4302-8b51-8bc8fb3b270d", "value": "62d4ec87ed21f0d15cb769b0b2a5577cab41fc2cdb1e7e796c5bdff09264dd9a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344563", "to_ids": true, "type": "sha256", "uuid": "de8d0b23-ca1b-4d0b-a747-69b5a3b03ebb", "value": "6366d59b573d50fd23ff650923c4a8c1c918518a02d0a56f12c23533c45f439d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344564", "to_ids": true, "type": "sha256", "uuid": "6196f9d8-e2ce-4aed-80dd-f3ca253dace8", "value": "65feba2c971c214e71303ad2e0fbf62b45ebcaa784cbf3d0dab62786cb4c0469", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344565", "to_ids": true, "type": "sha256", "uuid": "cd34831a-863b-4f3f-bb70-70be680f7cd1", "value": "68445a37a9943a267a8b2100fba2678353d6ec88844505ccbba659e586c7a105", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344566", "to_ids": true, "type": "sha256", "uuid": "53c6da9a-0ab2-4a47-998e-691109aac1fa", "value": "6917c0f9eafefe42e33e791b75a7e503ff8b081bc10a98449e4076787dfc6c16", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344567", "to_ids": true, "type": "sha256", "uuid": "fe09bbff-f1b0-4efe-9e0f-1609c78f606e", "value": "6cda1e81667f869940401f05a55c8dea94dbdf3ceffb93b5f320a6462cfea44d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344568", "to_ids": true, "type": "sha256", "uuid": "2f4d7452-b609-4959-9bd1-8f578aa92d65", "value": "6dbd507ca7cecea861f9cf704b3c5c37f5bd5392886a8c2562088892b7703fa5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344568", "to_ids": true, "type": "sha256", "uuid": "c26df17b-cef3-4f9f-a5f4-fb3bc8d4526a", "value": "745538dea8ed9aec4466e67a9d0aecf9e7026ff16a792d1d6f306e8b67d3f34c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344570", "to_ids": true, "type": "sha256", "uuid": "d61570d6-a5aa-4f55-9697-355af9264c8b", "value": "76d9e2a2ff313f5b91cc67aab1127122baee1c3efbae1087e58a25bc5f1eb065", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344571", "to_ids": true, "type": "sha256", "uuid": "f7ce9daf-7b7e-4c48-8101-641f3bdfcf85", "value": "8459ff264a2c81c68a34c4ee6bc109d141ad28b96037d34ff112322a4c853739", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344571", "to_ids": true, "type": "sha256", "uuid": "03d45c23-92f8-4d7c-92c7-2a7610b937f6", "value": "880425fee707e9f42e0b8d60119ed639b1ad506ea29877d126bdebce379cd229", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344572", "to_ids": true, "type": "sha256", "uuid": "e137148f-4470-4ea9-9454-97ea5e9ab248", "value": "89f0a67bc595ab8bce02c2f95f9292ad06e1868207e809c76bd16f0cab800c06", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344573", "to_ids": true, "type": "sha256", "uuid": "44fb3b05-ed4b-4317-b7ef-b9891530b125", "value": "8c104da0e66ef6384663309aaf8fb49f549f2785d835eec620b265f8aa11d9f0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344574", "to_ids": true, "type": "sha256", "uuid": "e902dde2-2339-427c-8fa6-e0ccca1cad45", "value": "912adea5339c73cb4a777a3e9f98bf3cb08da6622c9dd3b4cc9b083cb03d10a2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344575", "to_ids": true, "type": "sha256", "uuid": "219bb23b-c9f7-4f45-88ea-ab96a3601e64", "value": "9a927c37a31b80975c5c5467f112b61478c9493c046281046443525358a5acb0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344575", "to_ids": true, "type": "sha256", "uuid": "3997385e-6425-4a8c-b55c-282668945e4a", "value": "9d52cb4febf3342c34dcc8198dcaf453458be3699ab47dc08616aa7f18daa7fa", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344576", "to_ids": true, "type": "sha256", "uuid": "041697f1-e735-45dc-91f8-f739b60b5202", "value": "b5969636eec376ad6c3ece2202b1722219955638e09b6f96d4cfc0598d3b1890", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344577", "to_ids": true, "type": "sha256", "uuid": "5ba20050-5ab2-49e3-9d2d-82435bad8bf8", "value": "b8d247fd1fb85d24a17afeec3815906dfbcdc5359647910b4a153900ec999a0f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344578", "to_ids": true, "type": "sha256", "uuid": "dd10f224-9c1a-4878-8def-c02ff8e22be7", "value": "b9fe48bda9a6c8787981a24f8bbc723a6f6aa80cab5fa53481937382f3c6ce85", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344579", "to_ids": true, "type": "sha256", "uuid": "ad0ed26c-c8e2-4530-88d4-727b924fddd2", "value": "bf70c6f3a8e913f526ec57eeec50e1306f7b34b037915b7a1cf2968cc46acc58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344580", "to_ids": true, "type": "sha256", "uuid": "d70d6357-07b7-4a06-9dcc-acd0345603c2", "value": "c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344581", "to_ids": true, "type": "sha256", "uuid": "e0432fb3-8696-4d69-9040-705849691f14", "value": "c494c878e28284539419612616d964ab9224cbe27e57f42293d91d02d684e3db", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344582", "to_ids": true, "type": "sha256", "uuid": "18aa95da-f076-4bbe-8bbc-13ffef3bcfa3", "value": "c7c9bfa9ffcd8fb6a2afe656f510c406ddc58ebff48ce1d0fd3fad951b46a36e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344582", "to_ids": true, "type": "sha256", "uuid": "213ab868-297a-46c0-8baa-0ed7800a6666", "value": "d1f963b88672f3676a7da1580262ba0d4f367cc57a94b551754c20f77a670c43", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344584", "to_ids": true, "type": "sha256", "uuid": "68dacc93-f63c-4309-9a5e-50ce0863d5b7", "value": "d4861088161fc72b9922abf933b4ea664a807105ec1eab4a173253aa60bfe6d7", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344585", "to_ids": true, "type": "sha256", "uuid": "63b8fc4c-2f76-45e0-ac4f-3659a103843d", "value": "d5cf7315186a78ab6a7475c338bdf101bc6461930aaa7a012a02cf93f347c207", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344586", "to_ids": true, "type": "sha256", "uuid": "9b4cd11f-b0c9-49e5-a5f1-f3da26487d55", "value": "d81201d0fc19977e51104438a5b9cba861f4da20cea3ae9183edf16ab11d98f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344587", "to_ids": true, "type": "sha256", "uuid": "afeac885-399b-4c64-91fe-15bd4866cc59", "value": "d871d76171504597bbda387689e12e7a5e354c360ff135f4df231cec68c761af", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344588", "to_ids": true, "type": "sha256", "uuid": "2f90283b-a9df-4b24-b643-0fb85654780b", "value": "d973ad5a80c3d7468a9c392db4166857ed32b5d61cd6755766ba8922156dada3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344588", "to_ids": true, "type": "sha256", "uuid": "467d0750-e232-4522-b178-92084c8d76d4", "value": "dd0fc1a88180fde8367bec7086f99294f36b8332f12994293139ed532d2ebbac", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344589", "to_ids": true, "type": "sha256", "uuid": "c5656542-69f6-437b-b3fb-37052e73e61c", "value": "e5d2de8ae98579bfb940290f60e59a502b3065345aaf765456387989c0488b20", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344590", "to_ids": true, "type": "sha256", "uuid": "82643336-d326-40a6-8d76-104df82e9e0d", "value": "f235d2e044c2f7814e6bbcd835b9fd9f10f227dacfb9396185ec2013e7df4db4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344591", "to_ids": true, "type": "sha256", "uuid": "54a0b579-a8e1-49cc-b2d6-dcfb52ec1218", "value": "f3fbf4481f30fd840f35568746f54be49eb92b2c9ac95597a7760abb171cb54b", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "No sample in VT\r\nLast check: 18/07/2026", "deleted": false, "disable_correlation": false, "timestamp": "1784344592", "to_ids": true, "type": "sha256", "uuid": "ee4af5ae-7cdb-41b9-90c9-b3b1d28a4536", "value": "f5a57dfae488d9dfe260b32460a1d947fb5af58ceaf2fb0139bc08b4bb79a966", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347667", "to_ids": true, "type": "ip-dst", "uuid": "8c19b3a7-8103-414f-b7f0-c415f86bab72", "value": "95.182.100.231", "Tag": [ { "colour": "#0ad24b", "local": false, "name": "asn:asn=\"56971\"", "relationship_type": "" }, { "colour": "#e724d1", "local": false, "name": "asn:as-owner=\"AS56971 AS56971 Cloud\"", "relationship_type": "" }, { "colour": "#fbf8fb", "local": false, "name": "asn:as-country=\"HK\"", "relationship_type": "" }, { "colour": "#daa28c", "local": false, "name": "misp-galaxy:country=\"hong kong\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=SG ASN=AS141995 contabo asia private limited", "deleted": false, "disable_correlation": false, "timestamp": "1784347689", "to_ids": true, "type": "ip-dst", "uuid": "518ab1af-4ffa-4f29-b5b2-444596920414", "value": "194.233.92.26", "Tag": [ { "colour": "#f5eba1", "local": false, "name": "asn:asn=\"141995\"", "relationship_type": "" }, { "colour": "#a6347d", "local": false, "name": "asn:as-owner=\"CAPL-AS-AP Contabo Asia Private Limited\"", "relationship_type": "" }, { "colour": "#d906de", "local": false, "name": "asn:as-country=\"SG\"", "relationship_type": "" }, { "colour": "#ad61df", "local": false, "name": "misp-galaxy:country=\"singapore\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=DK ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1784347710", "to_ids": true, "type": "ip-dst", "uuid": "8d03b052-397c-44dd-95b6-0809b0e31148", "value": "217.15.160.247", "Tag": [ { "colour": "#f5eba1", "local": false, "name": "asn:asn=\"141995\"", "relationship_type": "" }, { "colour": "#a6347d", "local": false, "name": "asn:as-owner=\"CAPL-AS-AP Contabo Asia Private Limited\"", "relationship_type": "" }, { "colour": "#d906de", "local": false, "name": "asn:as-country=\"SG\"", "relationship_type": "" }, { "colour": "#ad61df", "local": false, "name": "misp-galaxy:country=\"singapore\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "IOC-description:CC=GB ASN=ASNone", "deleted": false, "disable_correlation": false, "timestamp": "1784347731", "to_ids": true, "type": "ip-dst", "uuid": "64b0256c-6779-44be-80df-c54a1a8ebfbd", "value": "217.15.164.147", "Tag": [ { "colour": "#f5eba1", "local": false, "name": "asn:asn=\"141995\"", "relationship_type": "" }, { "colour": "#a6347d", "local": false, "name": "asn:as-owner=\"CAPL-AS-AP Contabo Asia Private Limited\"", "relationship_type": "" }, { "colour": "#d906de", "local": false, "name": "asn:as-country=\"SG\"", "relationship_type": "" }, { "colour": "#ad61df", "local": false, "name": "misp-galaxy:country=\"singapore\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347752", "to_ids": true, "type": "url", "uuid": "eb8dd347-6670-49e1-bbd6-38af34c1c8f7", "value": "http://217.15.160.247:8088/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347773", "to_ids": true, "type": "url", "uuid": "8bd952d9-3121-4596-8350-669a12e7cce9", "value": "http://217.15.160.247:2222/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347794", "to_ids": true, "type": "url", "uuid": "b118a140-c2b2-4b2b-8108-0d8589732fba", "value": "http://217.15.160.247:99/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347815", "to_ids": true, "type": "url", "uuid": "e13737ac-1c19-4acb-a4dc-4533ea4921bf", "value": "http://194.233.92.26:8088/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347836", "to_ids": true, "type": "url", "uuid": "d8ba7af2-cc3b-4759-8308-b4124064400a", "value": "http://194.233.92.26:2222/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347857", "to_ids": true, "type": "url", "uuid": "2b73717a-ee75-4a0d-b1fb-6d8b3661e424", "value": "http://217.15.164.147:99/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347878", "to_ids": true, "type": "url", "uuid": "69709582-5fcb-483a-a602-981ecccb9986", "value": "http://217.15.164.147:8088/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347900", "to_ids": true, "type": "url", "uuid": "d29edf93-f342-4dcf-a844-48e8b290a089", "value": "http://217.15.164.147:2222/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1784347922", "to_ids": true, "type": "url", "uuid": "b2688977-f43e-4863-8ff5-b2228d14b6cb", "value": "http://95.182.100.231:2222/", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-21T06:21:18+00:00", "last_seen": "2025-06-21T06:21:18+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347943", "uuid": "fe302b8c-e29f-44ba-9c62-ece1a2396e57", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:21:18+00:00", "last_seen": "2025-06-21T06:21:18+00:00", "object_relation": "md5", "timestamp": "1784347943", "to_ids": true, "type": "md5", "uuid": "aca82bd4-e5f6-446f-8e3d-43d318f6dbd5", "value": "d93d716ff2df6dfbf0b285a284d91d31", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:21:18+00:00", "last_seen": "2025-06-21T06:21:18+00:00", "object_relation": "sha1", "timestamp": "1784344519", "to_ids": true, "type": "sha1", "uuid": "c14c2f69-17ab-43b6-949a-37d4bf1bd5f4", "value": "d2a29063b23cfcf74b03f78a9fe89003886dfc04", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:21:18+00:00", "last_seen": "2025-06-21T06:21:18+00:00", "object_relation": "sha256", "timestamp": "1784344519", "to_ids": true, "type": "sha256", "uuid": "bb72e3f1-5fd2-4be1-ae24-fef7889d0c44", "value": "1b5649b479fd625de5c8120873644b5eb669cc89cd504582c18e0ae350fd8823", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-21T06:21:18+00:00", "last_seen": "2025-06-21T06:21:18+00:00", "object_relation": "text", "timestamp": "1784341564", "to_ids": false, "type": "text", "uuid": "28066957-5212-4b00-8815-91a7a79276a3", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: Unix.Backdoor.Agent-10059999-0\nVT Total Detection: 22/74\nFirst Submission: 2025-06-21T06:21:18+00:00\nLast Submission: 2025-06-21T06:21:18+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:21:18+00:00", "last_seen": "2025-06-21T06:21:18+00:00", "object_relation": "ssdeep", "timestamp": "1784341564", "to_ids": true, "type": "ssdeep", "uuid": "6ea8586f-2013-4d48-8be5-a88ff23c76e1", "value": "6144:uwi8CNdlYQyntY4WHSwmbKALgSwdjZAnHTH1fp:uwhSHhJHkD" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-21T06:21:18+00:00", "last_seen": "2025-06-21T06:21:18+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341564", "to_ids": false, "type": "size-in-bytes", "uuid": "7200ef8c-a01e-4e4e-bac2-6ed94b72d450", "value": "304556" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:21:18+00:00", "last_seen": "2025-06-21T06:21:18+00:00", "object_relation": "vhash", "timestamp": "1784341564", "to_ids": true, "type": "vhash", "uuid": "c39cc27c-05f0-47d6-824f-105c8b1525c4", "value": "c3ad0242391315fbff07a7455292fde3" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347965", "uuid": "b5e4e0ca-29df-4d4a-a1ba-48bd2acea418", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "object_relation": "md5", "timestamp": "1784347965", "to_ids": true, "type": "md5", "uuid": "afd6dca2-0324-4a3e-914d-04c3cb28c10c", "value": "b802af85e119c39c3077e9cde13d6477", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "object_relation": "sha1", "timestamp": "1784344521", "to_ids": true, "type": "sha1", "uuid": "ca19cebb-6610-4c84-8b74-e635888c6b48", "value": "f25a28894a1185e8d2702a29a937816fdfa2687a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "object_relation": "sha256", "timestamp": "1784344521", "to_ids": true, "type": "sha256", "uuid": "506466ad-739c-41a7-986d-a88ed2832887", "value": "29c7fccc6ef8cbfe4da9a169c7c74bacaea1fb515a1fddef91ab1b1522f76e4c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "object_relation": "text", "timestamp": "1784341627", "to_ids": false, "type": "text", "uuid": "e88396f4-0c77-4b9c-ae34-4c6d33d8d0c5", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: Unix.Backdoor.Agent_armv7-10060003-0\nVT Total Detection: 30/74\nFirst Submission: 2026-05-11T04:25:23+00:00\nLast Submission: 2026-05-11T04:25:23+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "object_relation": "ssdeep", "timestamp": "1784341627", "to_ids": true, "type": "ssdeep", "uuid": "b0323573-5e32-45d8-bfe6-abc97c60dbb0", "value": "1536:OJ2zGVArtKKOhKXjvCP553i5J22qN56GOrkuZr/REugYJDPkO+Cp5E:bGVAZyojaPTIsFsGO9Zr/REugmPkXCp" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341627", "to_ids": false, "type": "size-in-bytes", "uuid": "256d8a54-afb3-485b-8bd8-520479c674b7", "value": "86168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "object_relation": "vhash", "timestamp": "1784341627", "to_ids": true, "type": "vhash", "uuid": "c36b1ec9-32ec-456a-b29f-3d1661a04cd9", "value": "2ee98d9fbf83df672e00c05ffc4f88c6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-05-11T04:25:23+00:00", "last_seen": "2026-05-11T04:25:23+00:00", "object_relation": "filename", "timestamp": "1784341627", "to_ids": true, "type": "filename", "uuid": "bcbb4647-6de1-497a-8a1a-066efe7cda44", "value": "1gxtlgok.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784347987", "uuid": "4425c1eb-955a-4919-a2b9-6ce04233634f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "object_relation": "md5", "timestamp": "1784347987", "to_ids": true, "type": "md5", "uuid": "0ba3a46f-ee53-4ce9-8d8b-01c4403d0525", "value": "0ac403c5532af4b6da2b94a68df0558e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "object_relation": "sha1", "timestamp": "1784344521", "to_ids": true, "type": "sha1", "uuid": "2bf1b662-a4b2-4bba-bd02-de4bf128144c", "value": "5203b0935da77739fc0450a91c8761aaf172069c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "object_relation": "sha256", "timestamp": "1784344522", "to_ids": true, "type": "sha256", "uuid": "bf9390d7-426e-4490-be38-77b50b5ab017", "value": "324d95024fc8da5c92b5a1f4825aed5a2a91c9ca8fb6aa52abb332a4c9cf4257", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "object_relation": "text", "timestamp": "1784341731", "to_ids": false, "type": "text", "uuid": "a86f146b-cdc8-4e46-8b1a-de14ee23b90d", "value": "Type Description: JAR\nMicrosoft: None\nClamAV: Java.Backdoor.Agent-10060000-0\nVT Total Detection: 14/74\nFirst Submission: 2026-03-06T14:39:28+00:00\nLast Submission: 2026-03-06T14:39:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "object_relation": "ssdeep", "timestamp": "1784341731", "to_ids": true, "type": "ssdeep", "uuid": "db710bfa-39aa-4c81-b290-c94d10fe8181", "value": "786432:sPUdwJEx34PppVXLxs+AWo36InzZ8oGwQs:sMdwJPp3xHoK6zmocs" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341731", "to_ids": false, "type": "size-in-bytes", "uuid": "a60c63aa-f77d-4ea5-8710-358c2d4cd15f", "value": "25244388" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "object_relation": "vhash", "timestamp": "1784341731", "to_ids": true, "type": "vhash", "uuid": "1f05dbab-f74c-4b9b-ab7f-a3cd4ca008f3", "value": "5b17ef62645d14cb3e96a437bc3121bd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T14:39:28+00:00", "last_seen": "2026-03-06T14:39:28+00:00", "object_relation": "filename", "timestamp": "1784341731", "to_ids": true, "type": "filename", "uuid": "baa6ae70-9f03-4ff5-b053-78a3b8e51261", "value": "resource-1.0-SNAPSHOT.jar" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348008", "uuid": "9afb89b8-b361-46ed-8e74-27d84707b8ef", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "object_relation": "md5", "timestamp": "1784348008", "to_ids": true, "type": "md5", "uuid": "2d43bc84-d7ed-4ffa-a5ab-b076aeee4c53", "value": "b1a355ee498f911dd127e3ba94ece526", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "object_relation": "sha1", "timestamp": "1784344522", "to_ids": true, "type": "sha1", "uuid": "6e27bd01-e2bd-4733-b591-8259268719d7", "value": "a6e4afcb4b9a64d6666f98c116d108c5502f40f2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "object_relation": "sha256", "timestamp": "1784344522", "to_ids": true, "type": "sha256", "uuid": "f39a1c73-04a1-42fc-8269-16710313c441", "value": "3878dd5c8eba1e5b53ab2e07e7b5482e95a3fd3e98268bcd7861318bc9902376", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 17/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "object_relation": "text", "timestamp": "1784341773", "to_ids": false, "type": "text", "uuid": "34829da1-9259-4ae4-abbf-e625f71b7eb1", "value": "Type Description: ELF\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: Unix.Backdoor.Agent_armv7-10060003-0\nVT Total Detection: 29/74\nFirst Submission: 2026-07-14T17:35:11+00:00\nLast Submission: 2026-07-14T17:35:11+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "object_relation": "ssdeep", "timestamp": "1784341773", "to_ids": true, "type": "ssdeep", "uuid": "d87415df-3a6b-4284-83d3-9e63422a329b", "value": "1536:OJ2zGVArtKKOhKXjvCP553i5J22qN56GOrkuZr/REugYJDPkO+C25E:bGVAZyojaPTIsFsGO9Zr/REugmPkXC2" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341773", "to_ids": false, "type": "size-in-bytes", "uuid": "c4103d80-6fc1-4c76-bace-310afe727519", "value": "86168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "object_relation": "vhash", "timestamp": "1784341773", "to_ids": true, "type": "vhash", "uuid": "9b2ec7c8-1e41-4fdf-a584-eeb46532d72b", "value": "2ee98d9fbf83df672e00c05ffc4f88c6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:35:11+00:00", "last_seen": "2026-07-14T17:35:11+00:00", "object_relation": "filename", "timestamp": "1784341773", "to_ids": true, "type": "filename", "uuid": "d48a20fa-a39e-4308-b3c5-61e5432bf6c1", "value": "r81o2bh4.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-30T13:48:02+00:00", "last_seen": "2026-04-30T13:48:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348029", "uuid": "47fc1580-914f-4e94-89e1-98ef97b9705f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T13:48:02+00:00", "last_seen": "2026-04-30T13:48:02+00:00", "object_relation": "md5", "timestamp": "1784348029", "to_ids": true, "type": "md5", "uuid": "d5bec6fa-bfcc-4096-8451-b81a0dfc0dd0", "value": "c3f93af99454e2cd99b7f8587c1a9c74", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T13:48:02+00:00", "last_seen": "2026-04-30T13:48:02+00:00", "object_relation": "sha1", "timestamp": "1784344524", "to_ids": true, "type": "sha1", "uuid": "c3cd7175-0040-4dc4-9760-74317ae9641e", "value": "49ca0b42f9c53e322fa9d703d4fa283aa88c1f7f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T13:48:02+00:00", "last_seen": "2026-04-30T13:48:02+00:00", "object_relation": "sha256", "timestamp": "1784344524", "to_ids": true, "type": "sha256", "uuid": "06a17218-014f-4b4a-93da-8a545073c079", "value": "3b89d183eb014e29d9d0d4e45fc2b784a7fcfcf31dd48fd3bde30f8d956383d1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#260093", "local": false, "name": "rectifyq:ioc=\"no-detection-by-any-vendor\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T13:48:02+00:00", "last_seen": "2026-04-30T13:48:02+00:00", "object_relation": "text", "timestamp": "1784341795", "to_ids": false, "type": "text", "uuid": "853d8994-7297-47cf-b207-8b6d168c99f1", "value": "Type Description: INI\nMicrosoft: None\nClamAV: None\nVT Total Detection: 0/74\nFirst Submission: 2026-04-30T13:48:02+00:00\nLast Submission: 2026-04-30T13:48:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T13:48:02+00:00", "last_seen": "2026-04-30T13:48:02+00:00", "object_relation": "ssdeep", "timestamp": "1784341795", "to_ids": true, "type": "ssdeep", "uuid": "85e65e5f-ec66-4c7d-a08c-4b8d4f42946c", "value": "12:OH6qpGsl/ecFYbfXblKuesIwuj23MH9xRM3Mt3MWM6H3Mv:Oh0s93FYjXblKuesrvez+Q7+" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T13:48:02+00:00", "last_seen": "2026-04-30T13:48:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341795", "to_ids": false, "type": "size-in-bytes", "uuid": "d5ede90c-ffde-4d77-80f4-8370c4affb0f", "value": "505" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T13:48:02+00:00", "last_seen": "2026-04-30T13:48:02+00:00", "object_relation": "filename", "timestamp": "1784341795", "to_ids": true, "type": "filename", "uuid": "462c7c9b-3a56-4f33-adc6-f03c080b6a96", "value": "application.properties" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348050", "uuid": "71ef18e4-9958-46d8-adf9-f77847e2e4fb", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "object_relation": "md5", "timestamp": "1784348050", "to_ids": true, "type": "md5", "uuid": "1419c902-ca0f-41c6-99a2-4dfe380ab08a", "value": "fe0fda0a0d424550900ca274ca9164c0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "object_relation": "sha1", "timestamp": "1784344525", "to_ids": true, "type": "sha1", "uuid": "1d7e4a4d-fa5e-4e16-9792-7aa75f0a915e", "value": "ea0bdcfb79b5c47988bf1fb7d39e5515a83e5d88", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "object_relation": "sha256", "timestamp": "1784344525", "to_ids": true, "type": "sha256", "uuid": "75c5c95d-e536-4292-a04c-c9d6390e1294", "value": "425bf771c8c9f740b1ae9803dcb4fd45af4d6a6f171fcc72fc7d511095ca82ce", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "object_relation": "text", "timestamp": "1784341879", "to_ids": false, "type": "text", "uuid": "ee0d7ebf-531e-4627-9962-c180080b3be9", "value": "Type Description: ELF\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: Unix.Backdoor.Agent_armv7-10060003-0\nVT Total Detection: 24/74\nFirst Submission: 2026-07-14T17:36:45+00:00\nLast Submission: 2026-07-14T17:36:45+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "object_relation": "ssdeep", "timestamp": "1784341879", "to_ids": true, "type": "ssdeep", "uuid": "f1e69774-c9b7-4f23-aff7-ef4d38e976a4", "value": "1536:OJ2zGVArtKKOhKXjvCP553i5J22qN56GOrkuZr/REugYJDPkO+C05E:bGVAZyojaPTIsFsGO9Zr/REugmPkXC0" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341879", "to_ids": false, "type": "size-in-bytes", "uuid": "049bd458-c0c7-471e-9b53-56691bd6f716", "value": "86168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "object_relation": "vhash", "timestamp": "1784341879", "to_ids": true, "type": "vhash", "uuid": "f94ca7c6-89b6-47cd-8940-1c15cb8ab2a2", "value": "2ee98d9fbf83df672e00c05ffc4f88c6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:36:45+00:00", "last_seen": "2026-07-14T17:36:45+00:00", "object_relation": "filename", "timestamp": "1784341879", "to_ids": true, "type": "filename", "uuid": "21a4664d-73ac-46ff-8050-764cc0bca5b0", "value": "1glx5bv.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348071", "uuid": "d1a9f458-c85e-44bb-9e63-f5f38dbca43f", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "object_relation": "md5", "timestamp": "1784348071", "to_ids": true, "type": "md5", "uuid": "20e8731e-3636-46e4-b695-847ebe76035c", "value": "15c2d7df8b6387d997df00100fff18b9", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "object_relation": "sha1", "timestamp": "1784344526", "to_ids": true, "type": "sha1", "uuid": "8241500e-923c-4db9-8f28-d6816af510cf", "value": "ecc3060358ecd559d99476f853d1635dcd20bbd1", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "object_relation": "sha256", "timestamp": "1784344526", "to_ids": true, "type": "sha256", "uuid": "82ed3e29-8f2a-4fb5-9ea6-ac28d4d61aa0", "value": "57bdab2ba4b05ec0338c06632599393d5b14227f31a43fe950ea8fdd47428715", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "object_relation": "text", "timestamp": "1784341965", "to_ids": false, "type": "text", "uuid": "8866c8bd-a459-4dfa-9474-4d4a7cab34ef", "value": "Type Description: ELF\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: None\nVT Total Detection: 11/74\nFirst Submission: 2026-07-14T17:20:28+00:00\nLast Submission: 2026-07-14T17:20:28+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "object_relation": "ssdeep", "timestamp": "1784341965", "to_ids": true, "type": "ssdeep", "uuid": "f92eb500-a486-4311-aaf6-1e245dac4ea7", "value": "1536:79FgWP3NwfE/uObMeAJNk3E1K0kCjkl60T9mK4A+KArqB:79FgW/b/uleANMKKXXYDK4A9YqB" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "object_relation": "size-in-bytes", "timestamp": "1784341965", "to_ids": false, "type": "size-in-bytes", "uuid": "f2b78e2c-3722-43e3-97fe-32c65ec9abe6", "value": "95304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "object_relation": "vhash", "timestamp": "1784341965", "to_ids": true, "type": "vhash", "uuid": "92ce5870-d28b-4cf7-a033-4618c894cd28", "value": "f9b0c2dc1270e61036f0cca972bb090d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:20:28+00:00", "last_seen": "2026-07-14T17:20:28+00:00", "object_relation": "filename", "timestamp": "1784341965", "to_ids": true, "type": "filename", "uuid": "7be7ed39-248f-4620-a53e-b07a5aedfe43", "value": "jqoxme.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-06-21T06:22:56+00:00", "last_seen": "2025-06-21T06:22:56+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348092", "uuid": "5ecc81a1-e42f-4be6-95a7-89b4b06f1c3b", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:22:56+00:00", "last_seen": "2025-06-21T06:22:56+00:00", "object_relation": "md5", "timestamp": "1784348092", "to_ids": true, "type": "md5", "uuid": "0a9aee22-be28-4090-af42-b1225ce2150f", "value": "da9ea2b94af1eb20f3b4fcdc7390b4e2", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:22:56+00:00", "last_seen": "2025-06-21T06:22:56+00:00", "object_relation": "sha1", "timestamp": "1784344527", "to_ids": true, "type": "sha1", "uuid": "c8023a8a-2d0f-496f-89db-abe3c20a8820", "value": "703d70d4c0abfdc251772889bcdc15a4425c60d6", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:22:56+00:00", "last_seen": "2025-06-21T06:22:56+00:00", "object_relation": "sha256", "timestamp": "1784344527", "to_ids": true, "type": "sha256", "uuid": "90bf160a-b661-4ae9-9543-fcf33e3a7255", "value": "755fcee1337a252203002ecfdf673a08cfadeda8d738bef2d518a08e0626aa4f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-21T06:22:56+00:00", "last_seen": "2025-06-21T06:22:56+00:00", "object_relation": "text", "timestamp": "1784342301", "to_ids": false, "type": "text", "uuid": "9f547d4a-f829-4c77-972e-9e5a8b29a892", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: Unix.Backdoor.Agent-10059998-0\nVT Total Detection: 31/74\nFirst Seen In The Wild: 2026-02-13T09:10:17+00:00\nFirst Submission: 2025-06-21T06:22:56+00:00\nLast Submission: 2025-06-21T06:22:56+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:22:56+00:00", "last_seen": "2025-06-21T06:22:56+00:00", "object_relation": "ssdeep", "timestamp": "1784342301", "to_ids": true, "type": "ssdeep", "uuid": "1d79ccbc-9be1-4bbe-b913-eb68a57dfd10", "value": "24576:PO0YtSgGloDNLzsC5HF32OyU9vDgHiEi80jAz+zhqM0CXZhWWU5WVZ1S9qgym/Ac:PNGH6jYZ2qrm/AtwWRjR2RptsuMndnsj" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-06-21T06:22:56+00:00", "last_seen": "2025-06-21T06:22:56+00:00", "object_relation": "size-in-bytes", "timestamp": "1784342301", "to_ids": false, "type": "size-in-bytes", "uuid": "86c5192d-1f3f-4a1f-9fb8-e0ccc4dd931e", "value": "2056392" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-06-21T06:22:56+00:00", "last_seen": "2025-06-21T06:22:56+00:00", "object_relation": "vhash", "timestamp": "1784342301", "to_ids": true, "type": "vhash", "uuid": "847bba0e-de9e-46ec-a3ef-31a1067a82bd", "value": "c3ad0242391315fbff07a7455292fde3" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348114", "uuid": "112c6daf-2142-4438-b4b1-48cfc5d294e2", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "object_relation": "md5", "timestamp": "1784348114", "to_ids": true, "type": "md5", "uuid": "42d7ff6e-afde-4935-952f-174052bd719b", "value": "aa5c1c168f95b636668b223baf53094a", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "object_relation": "sha1", "timestamp": "1784344528", "to_ids": true, "type": "sha1", "uuid": "049c5232-9916-4a6f-a8b7-4554aa7f9542", "value": "ac66ceb8b5e6a420c95f07c9ebf0e603ab404aa5", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "object_relation": "sha256", "timestamp": "1784344528", "to_ids": true, "type": "sha256", "uuid": "75c4f686-8371-4cf0-9285-24e88591c692", "value": "9b9e0e5a1eb469b8d20dc23351e08ff5d5731e1cedce0ddee9bbd00a76217f13", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 18/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "object_relation": "text", "timestamp": "1784342470", "to_ids": false, "type": "text", "uuid": "6e67635c-6ca4-4205-9fb5-bd4a7e78f457", "value": "Type Description: ELF\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: Unix.Backdoor.Agent_mips32-10060001-0\nVT Total Detection: 28/74\nFirst Submission: 2026-07-08T02:08:44+00:00\nLast Submission: 2026-07-08T02:08:44+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "object_relation": "ssdeep", "timestamp": "1784342470", "to_ids": true, "type": "ssdeep", "uuid": "f43b644c-5187-4cb3-a703-a1297b51a2ff", "value": "1536:BX5KVTIdYFk58akt2MEK9FegrVjvuXHA8L3yleX9EmV+8Ws/tEFhKAVSLnrqH:BJKVTbYCregrp2XLCcg8B/twoeorqH" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "object_relation": "size-in-bytes", "timestamp": "1784342470", "to_ids": false, "type": "size-in-bytes", "uuid": "9f5204ba-d413-4c7b-b60b-e3a9eec9ba8d", "value": "95304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "object_relation": "vhash", "timestamp": "1784342470", "to_ids": true, "type": "vhash", "uuid": "fc27e2c2-e769-409d-b6bd-4be200c92e1c", "value": "f9b0c2dc1270e61036f0cca972bb090d" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-08T02:08:44+00:00", "last_seen": "2026-07-08T02:08:44+00:00", "object_relation": "filename", "timestamp": "1784342470", "to_ids": true, "type": "filename", "uuid": "0209b5c0-bb6c-4c0c-8ab9-d288ea10b58d", "value": "m02awp.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348135", "uuid": "ab98258c-28d3-423f-847c-4aa235615096", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "object_relation": "md5", "timestamp": "1784348135", "to_ids": true, "type": "md5", "uuid": "27316e30-fcae-4669-b249-d77ed11daadd", "value": "42c715523f5365ca7ce30f5254affaef", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "object_relation": "sha1", "timestamp": "1784344529", "to_ids": true, "type": "sha1", "uuid": "a2155ec6-278f-4834-84e1-c487346138d6", "value": "b3c187bce26934c3992ac84d4b1b77ed607e0ed0", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "object_relation": "sha256", "timestamp": "1784344529", "to_ids": true, "type": "sha256", "uuid": "389bba57-04ef-47da-8789-d47a5b2ef7b5", "value": "ac8eae94d27122f4751bc96d9ea52d30000b7ca37569a2291b2710824ca3396f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "object_relation": "text", "timestamp": "1784342512", "to_ids": false, "type": "text", "uuid": "6feac628-37aa-4932-8455-4a0feaaa27db", "value": "Type Description: ELF\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: Unix.Backdoor.Agent_armv7-10060003-0\nVT Total Detection: 25/74\nFirst Submission: 2026-07-14T17:54:07+00:00\nLast Submission: 2026-07-14T17:54:07+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "object_relation": "ssdeep", "timestamp": "1784342512", "to_ids": true, "type": "ssdeep", "uuid": "17dcabc6-5a7f-4290-93c9-97ee033799b9", "value": "1536:OJ2zGVArtKKOhKXjvCP553i5J22qN56GOrkuZr/REugYJDPkO+Co5E:bGVAZyojaPTIsFsGO9Zr/REugmPkXCo" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "object_relation": "size-in-bytes", "timestamp": "1784342512", "to_ids": false, "type": "size-in-bytes", "uuid": "bfdea33e-9415-447d-9f79-50e265b4d066", "value": "86168" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "object_relation": "vhash", "timestamp": "1784342512", "to_ids": true, "type": "vhash", "uuid": "d42370a0-22d6-4691-b23b-f5cd40d82cda", "value": "2ee98d9fbf83df672e00c05ffc4f88c6" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T17:54:07+00:00", "last_seen": "2026-07-14T17:54:07+00:00", "object_relation": "filename", "timestamp": "1784342512", "to_ids": true, "type": "filename", "uuid": "e42ed69b-1a55-43e9-87f6-a52ce7635335", "value": "ifbqzheym.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348156", "uuid": "ce04fef9-ea5d-443b-af2b-a5e889d5837c", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "object_relation": "md5", "timestamp": "1784348156", "to_ids": true, "type": "md5", "uuid": "cc8eda62-9a54-4398-b11b-374b197cb33b", "value": "d9cd03eedc1b1ae0266064783a5380b4", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "object_relation": "sha1", "timestamp": "1784344530", "to_ids": true, "type": "sha1", "uuid": "8af0db53-9451-45dd-abc9-6f0d0e2b0400", "value": "6c92fba568d81ba1ea8dd595d0d09aa1a2d7bde3", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "object_relation": "sha256", "timestamp": "1784344530", "to_ids": true, "type": "sha256", "uuid": "dc80abad-bedb-4522-b93e-d1ed79fb3f69", "value": "bafba443170e54ef7fd431ce7f1b5e202719f3fd022e4ef70788904f574d2cdf", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "object_relation": "text", "timestamp": "1784342596", "to_ids": false, "type": "text", "uuid": "85c8a135-76b8-4a18-b02e-11d39a9a2e4a", "value": "Type Description: JAR\nMicrosoft: None\nClamAV: Java.Backdoor.Agent-10060000-0\nVT Total Detection: 16/74\nFirst Seen In The Wild: 2026-07-07T11:00:33+00:00\nFirst Submission: 2026-03-06T18:46:35+00:00\nLast Submission: 2026-03-06T18:46:35+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "object_relation": "ssdeep", "timestamp": "1784342596", "to_ids": true, "type": "ssdeep", "uuid": "bd4f0438-76a3-4d21-af0a-446943ecadc4", "value": "786432:XPUdwJEx34PppVXLxs+AWo36InzZ8oGwQz:XMdwJPp3xHoK6zmocz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "object_relation": "size-in-bytes", "timestamp": "1784342596", "to_ids": false, "type": "size-in-bytes", "uuid": "9b48cfbd-a67f-4dad-ae16-f44577004518", "value": "25244394" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "object_relation": "vhash", "timestamp": "1784342596", "to_ids": true, "type": "vhash", "uuid": "67c9bbad-75dc-4eea-ad67-e5dad7a3b76d", "value": "5b17ef62645d14cb3e96a437bc3121bd" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-03-06T18:46:35+00:00", "last_seen": "2026-03-06T18:46:35+00:00", "object_relation": "filename", "timestamp": "1784342596", "to_ids": true, "type": "filename", "uuid": "8a5bf8d4-2d82-426e-8b30-ff58bef83357", "value": "resource-1.0-SNAPSHOT.back" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348177", "uuid": "8642cf3a-fb8f-41c5-8bf6-ac96e8603ce6", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "object_relation": "md5", "timestamp": "1784348177", "to_ids": true, "type": "md5", "uuid": "d3d724c4-d3e4-43c2-9c66-119436e8cae4", "value": "6bf66dec794c9deb2c7b75c04901c27f", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "object_relation": "sha1", "timestamp": "1784344532", "to_ids": true, "type": "sha1", "uuid": "316480c5-7415-4320-b479-046630cb2ce7", "value": "be78918f4ebbafa2f576f50240c44e76e3d4ea4d", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "object_relation": "sha256", "timestamp": "1784344532", "to_ids": true, "type": "sha256", "uuid": "d5f8b3c2-938d-4b32-bfda-c752b4831bee", "value": "c92541f273eeb576d39235d0a5c6f18f2574b132a1022598edfa38065783ab98", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "object_relation": "text", "timestamp": "1784342701", "to_ids": false, "type": "text", "uuid": "d462f76e-6252-4716-8e82-13eb7511c7b4", "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Multiverze!rfn\nClamAV: None\nVT Total Detection: 24/74\nFirst Submission: 2025-05-04T10:04:00+00:00\nLast Submission: 2025-05-04T10:04:00+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "object_relation": "ssdeep", "timestamp": "1784342701", "to_ids": true, "type": "ssdeep", "uuid": "a280d451-9f75-40b6-b2e3-eabf63eb9a7f", "value": "384:9BsnefFJPa37FMrgPbnC6IrKEkGMrFFsoiRnwLT+It00F7GGTyF1:jiedRKZMrN6I3wPnuICLF" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "object_relation": "size-in-bytes", "timestamp": "1784342701", "to_ids": false, "type": "size-in-bytes", "uuid": "b800d4bf-d7dc-4f50-bc89-cb0d81179ac8", "value": "28496" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "object_relation": "vhash", "timestamp": "1784342701", "to_ids": true, "type": "vhash", "uuid": "9575a3f0-9119-45e2-8be6-12736e97f101", "value": "44e455bbbcf3dab36afdb865428f35ec" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2025-05-04T10:04:00+00:00", "last_seen": "2025-05-04T10:04:00+00:00", "object_relation": "filename", "timestamp": "1784342701", "to_ids": true, "type": "filename", "uuid": "22f5ce00-91b9-4e3b-8d41-e739f6742635", "value": "linux3_10-glibc2_17-aarch64" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348198", "uuid": "73e2c792-27d2-4aea-9f00-00d8651b2816", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "object_relation": "md5", "timestamp": "1784348198", "to_ids": true, "type": "md5", "uuid": "1fdbbce6-c97c-456e-9cae-35d77cfc34c0", "value": "bdd9811d3c7a33691b1d8b5ad931a5f8", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "object_relation": "sha1", "timestamp": "1784344533", "to_ids": true, "type": "sha1", "uuid": "272dab9e-daa7-4e7a-afe9-e6da3b362d7a", "value": "653cdcef2f062ae6ff01363c1221d4f2ed456401", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "object_relation": "sha256", "timestamp": "1784344533", "to_ids": true, "type": "sha256", "uuid": "0d7af0b3-a98b-4807-be54-a644f8cee63a", "value": "dc4f25b2247cfdd6fc96848db30a178baa4419a4c854e86e315b465836102d14", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#220082", "local": false, "name": "rectifyq:samples-found-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "object_relation": "text", "timestamp": "1784342851", "to_ids": false, "type": "text", "uuid": "58d7d2a7-30d2-43e0-80cd-1975106d8ca4", "value": "Type Description: ELF\nMicrosoft: Trojan:Win32/Casdet!rfn\nClamAV: Unix.Backdoor.Agent_mips32el-10060006-0\nVT Total Detection: 15/74\nFirst Submission: 2026-07-14T18:01:29+00:00\nLast Submission: 2026-07-14T18:01:29+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "object_relation": "ssdeep", "timestamp": "1784342851", "to_ids": true, "type": "ssdeep", "uuid": "1f1e57e5-3a43-47d2-9f24-9d8d53b83320", "value": "1536:5FjQQ7+B2orrwoXb6FIPE9X7uwFHbw/L0h9RPH6dur5:5zoHE7RpF7Asz" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "object_relation": "size-in-bytes", "timestamp": "1784342851", "to_ids": false, "type": "size-in-bytes", "uuid": "4b1fdaeb-2c48-42eb-9e51-b804bc0188ba", "value": "95304" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "object_relation": "vhash", "timestamp": "1784342851", "to_ids": true, "type": "vhash", "uuid": "af76f340-f7af-4ecb-9cbd-8381e2cd383f", "value": "fa9a299ba26141d9bde84bbd02a01ec2" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-07-14T18:01:29+00:00", "last_seen": "2026-07-14T18:01:29+00:00", "object_relation": "filename", "timestamp": "1784342851", "to_ids": true, "type": "filename", "uuid": "9fb45ee8-a183-4df3-aedc-3ed43f84f28e", "value": "158xp5u9e.exe" } ] }, { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "first_seen": "2026-04-30T13:49:02+00:00", "last_seen": "2026-04-30T13:49:02+00:00", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1784348219", "uuid": "5dd52824-3404-492c-be77-71a09cf5d8ef", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T13:49:02+00:00", "last_seen": "2026-04-30T13:49:02+00:00", "object_relation": "md5", "timestamp": "1784348219", "to_ids": true, "type": "md5", "uuid": "e0e02306-c88e-4ea2-9e34-ccdc3ee5e35e", "value": "c34296f59ff1a1b2ac46563c6044df7e", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T13:49:02+00:00", "last_seen": "2026-04-30T13:49:02+00:00", "object_relation": "sha1", "timestamp": "1784344534", "to_ids": true, "type": "sha1", "uuid": "6d3bae13-45fe-4ce9-9250-bd42fb15ec4f", "value": "88a2c33308392243b1b6efef6568c31637ff3252", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T13:49:02+00:00", "last_seen": "2026-04-30T13:49:02+00:00", "object_relation": "sha256", "timestamp": "1784344534", "to_ids": true, "type": "sha256", "uuid": "1110be13-0280-49ab-a59d-a4fd232b8691", "value": "e799d72929d7ccc7f6b6109742b8cc482838303207efc989543b6e1ca6d16e9c", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Other", "comment": "Checked: 18/07/2026\nLast-scan: 16/07/2026", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T13:49:02+00:00", "last_seen": "2026-04-30T13:49:02+00:00", "object_relation": "text", "timestamp": "1784342914", "to_ids": false, "type": "text", "uuid": "7a4ce1f4-3537-4c80-8496-a759aeba14e5", "value": "Type Description: Shell script\nMicrosoft: None\nClamAV: None\nVT Total Detection: 6/74\nFirst Submission: 2026-04-30T13:49:02+00:00\nLast Submission: 2026-04-30T13:49:02+00:00" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "first_seen": "2026-04-30T13:49:02+00:00", "last_seen": "2026-04-30T13:49:02+00:00", "object_relation": "ssdeep", "timestamp": "1784342914", "to_ids": true, "type": "ssdeep", "uuid": "e7ac0126-3c0d-4130-b112-88d7a9be6ceb", "value": "12:tUB9TYPB9rAfQ+yk/wjIR7k/bDWwjIR7M:tU7kkfQ+NIek/HeM" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T13:49:02+00:00", "last_seen": "2026-04-30T13:49:02+00:00", "object_relation": "size-in-bytes", "timestamp": "1784342914", "to_ids": false, "type": "size-in-bytes", "uuid": "073a04cf-c0e4-4c09-8502-d56fb7febc20", "value": "587" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "first_seen": "2026-04-30T13:49:02+00:00", "last_seen": "2026-04-30T13:49:02+00:00", "object_relation": "filename", "timestamp": "1784342914", "to_ids": true, "type": "filename", "uuid": "10cf768a-42bb-4f81-8320-b38a26020616", "value": "start.sh" } ] } ] } }